Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does something like security intrusion reporting tool exist in Linux? Something that would report (after logging in) security/system change things like that:

Failed Login Attempts: 
jsmith from against example-host performed 37 times 
Account changes: 
New user: name=c0rt3z uid=1050 

P.S.: sorry if this is duplicate, i don't know how is this type of things in Linux named

share|improve this question
up vote 3 down vote accepted

It's hard to answer your question because it's so general. There exist many security features in Linux, some of which are provided by the base operating system and others by standalone applications. The specifics of these vary between distributions so without knowing what Linux distribution you are using it is hard to make concrete suggestions.

I highly recommend you start with your distribution's security guide or general documentation.

A few ideas to get you started:

  • the syslog facility, specifically auth.log: authenication information is logged here
  • logwatch: a tool to help you sort and parse logfiles for the information you care about
  • Fail2Ban: automatically drops IP addresses of clients who pass a threshold for number of login failures
  • Tripwire: monitors files for changes
  • AppArmor, or SELinux: Mandatory Access Control mechanisms for applications and the kernel.
  • Auditd: userspace auditing for file modification (similar to tripwire)
  • Shell history logging (e.g., ~/.bash_history).
share|improve this answer

The simplest way I can think of, which avoids getting to grips with serious auditing tools, is to just install logwatch.

You can then receive daily emails listing (among many useful bits of information) a summary of failed login attempts, along with newly created users and groups.

share|improve this answer
this seems to be too simple, but thanks, maybe I'll try it – Matej Aug 14 '11 at 21:07

I think what you're looking for is Samhain. It will monitor your system for changes and notify you, but it's a bit more proactive than just whenever you happen to log in.

I used to use Osiris for this kind of thing, but it hasn't been updated in years.

By the way, this kind of security auditing is called Host Integrity Monitoring.

share|improve this answer
Samhain is a new one to me. I generally don't have much interest in Host Integrity Monitoring systems, but it seems pretty cool. – kce Aug 14 '11 at 20:53
thanks, I'll look at it – Matej Aug 14 '11 at 21:06

There are numerous ways you could protect your server against a 'brute-force' attack. Some of these methods are more difficult to implement but in the long term can give you better security.

If you want a real simple solution you could implement Fail2Ban. For something more advanced you can implement the same basic functionality by using iptables hashlimits.

You could also disable password based authentication in sshd, move it to a non-standard port, or setup a proper firewall.

Because this question really falls down a rabbit hole that has created an entire industry I'd suggest you look at a security guide for your linux distribution. The Ubuntu guide is a good start.

share|improve this answer
Thanks for answer, but I've already disabled password auth, moved ssh to non-standard port and I use denyhosts against ssh bruteforce. I'm not looking for these systems to secure Linux box, I'm looking for something that will warn me for system changes caused probably by attackers. – Matej Aug 14 '11 at 20:39

No one mentioned OSSEC.

Some examples:

FTP server:

Received From: (x) 192.168.4.x->/var/log/secure
Rule: 11210 fired (level 10) -> "Multiple failed login attempts."
Portion of the log(s):

Jul 23 22:52:50 x proftpd[5243]: x.localdomain (::ffff:x.x.x.x[::ffff:x.x.x.x]) - Maximum login attempts (3) exceeded, connection refused

SSH server:

Sep 17 12:38:00 x sshd[6995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x user=y

and web server:

Received From: x->/var/log/httpd/error_log
Rule: 30109 fired (level 9) -> "Attempt to login using a non-existent user."
Portion of the log(s):

[Fri Dec 03 23:27:59 2010] [error] [client x] user mBGq7XfBP7ZPs not found: /
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.