2

I need a log file of penetration attempts to my server. Ideally, this log should contain all attempts including logins, HTTPD activities, FTP activities, NFS, and other conventional open ports. However, it is enough for me to have HTTPD, FTP, and NFS.

Is there such service (or log files) available in CentOS (built-in preferred)?

3 Answers 3

3

There is no single log file that included that logs all these things. You will need to go through all your logs and extract single lines. You can ofcourse facilitate this with a regex.

One thing you might want to opt for is using OSSEC on your machine. It's a host based intrusion detection system and it actually keeps logs of all malicious login attempts on your server. Even better: it blocks ip's when they try to bruteforce your machine.

2
  • Thanks. I am hacking around OSSEC and it seems this is my solution. It gathers various log files (stated by @Toqeer) and integrates them.
    – lashgar
    Sep 22, 2012 at 9:51
  • Have a look at lfd too, csf bundles it in and it works well for what you've described. Sep 22, 2012 at 11:31
1

Following are the logs files.

Http:

/var/log/httpd/access.log - All the information about who access your site.

/var/log/httpd/error.log - All the error logs of your web-site are stored there.

It also depends on virtualhost configurations what file you defined for logs, default files are above.

Security:

All security related logs stored in

/var/log/secure

Syslog: System wide messages stored in

/var/log/messages

Maillog: Maillog stored in

/var/log/maillog

VSFTPD: ftp log file depends on your configuration. see the xferlog_file=/var/log/xferlog if you are using vsftpd and also enable xferlog_enable=YES

Better to configure fail2ban for log file monitoring.

0

What you (probably) want is called a "host intrusion detection system". Search for that term (and linux) to see what is available.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .