Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need a log file of penetration attempts to my server. Ideally, this log should contain all attempts including logins, HTTPD activities, FTP activities, NFS, and other conventional open ports. However, it is enough for me to have HTTPD, FTP, and NFS.

Is there such service (or log files) available in CentOS (built-in preferred)?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

There is no single log file that included that logs all these things. You will need to go through all your logs and extract single lines. You can ofcourse facilitate this with a regex.

One thing you might want to opt for is using OSSEC on your machine. It's a host based intrusion detection system and it actually keeps logs of all malicious login attempts on your server. Even better: it blocks ip's when they try to bruteforce your machine.

share|improve this answer
    
Thanks. I am hacking around OSSEC and it seems this is my solution. It gathers various log files (stated by @Toqeer) and integrates them. –  ahmad Sep 22 '12 at 9:51
    
Have a look at lfd too, csf bundles it in and it works well for what you've described. –  Ben Lessani - Sonassi Sep 22 '12 at 11:31

Following are the logs files.

Http:

/var/log/httpd/access.log - All the information about who access your site.

/var/log/httpd/error.log - All the error logs of your web-site are stored there.

It also depends on virtualhost configurations what file you defined for logs, default files are above.

Security:

All security related logs stored in

/var/log/secure

Syslog: System wide messages stored in

/var/log/messages

Maillog: Maillog stored in

/var/log/maillog

VSFTPD: ftp log file depends on your configuration. see the xferlog_file=/var/log/xferlog if you are using vsftpd and also enable xferlog_enable=YES

Better to configure fail2ban for log file monitoring.

share|improve this answer

What you (probably) want is called a "host intrusion detection system". Search for that term (and linux) to see what is available.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.