up vote 1 down vote favorite
1
share [g+] share [fb]

I want to help guard against getting hacked (again). One thing I want to do is watch the files that have been hacked in the past (twice in fact, always the same files modified) so i can be alerted if this happens again. What is the best way to watch files for modification? This is on a linux server (and I tried installing the program "audit" but am unable to run it on this shared host so using it is out of the question).

I'm really looking for the simplest, low resource, solution. A basic unix script I could run via cron would be ideal.

EDIT I am using a unix shell script called Filetraq to handle watching my files. It is available here: http://filetraq.xidus.net/ I had to modify the script a bit as it is old and doesn't play well with diff plus I wanted to add some other variables and text, but it is quite basic and easy to use.

link|improve this question
80% accept rate
2  
That's not going to prevent hacking. How are the files being accessed? You need to address how the access is occurring, if you want it to stop. – LukeR Jul 20 '10 at 0:10
At best, this will tell you when you have been hacked. It will not prevent that hacking. – John Gardeniers Jul 20 '10 at 2:42
I modified the title to better reflect what I was looking for... watching for modifications in the event of a hack, not actually preventing getting hacked. – Lothar_Grimpsenbacher Jul 20 '10 at 3:46
feedback

1 Answer

up vote 4 down vote accepted

You can use a Host Based IDS (HIDS). Basically it's a software that generates a 'trusted' database with information and cryptographic checksums of important files on your host. After that database is created you can set it to check the files daily, and take actions if any of the files change. Some HIDS also check memory for problems. OSSEC and Tripwire are two open source softwares that may help.

link|improve this answer
1  
I like AIDE these days. – Warner Jul 20 '10 at 1:26
+1 for both AIDE and OSSEC. – GruffTech Jul 20 '10 at 2:57
AIDE! I was trying to remember the name, thanks Warner. – coredump Jul 20 '10 at 5:27
1  
+1 for a good answer - but its not enough to just look at files which have previously been hacked - you need to monitor all the executable files, libs, kernel and config files for any network services – symcbean Jul 20 '10 at 11:30
Consider generating and recording MD5 checksums on your base install files and folders as another means of determining "what has changed" without your knowledge. – jl. Jul 20 '10 at 15:11
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.