Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have looked at many logs and it seems that some of them are more relevant for monitoring purposes against hackers. The ones I found are:

-auth.log
-mail.log: if i'm running a mail server, will this be important?
-btmp
-secure
-faillog
-apache2/access.log
-mysql.log & mysql.err

Note: I'm running LAMP and using phpMyAdmin to access DB.

Is there anything that is useless in that list? Anything that I should include?

Also, I fail to open up these log files that don't have ".log" extensions. I guess I'm supposed to execute them, but even User doesn't have execute permissions on them and when I chmod 700, nothing happens when I execute them. How am I supposed to do it?

Thanks in advance

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted
  • error.log of your httpd-Server
  • Your php-error-log (wherever you configured it to be)

Apart from that this is not enough to protect your system. Using IPS (like SELinux) and a HIDS (like aide, samhain or tripwire) will help more than that.

If your PHP-Application has SQL-injection problems you need to review your code - as these measures will not help either.

share|improve this answer
    
Thank you for your help. I will look up your suggestions. As for the SQL injections, I am using PDO in my PHP app. This is probably secure enough isn't it? Thanks again –  ericd Sep 27 '12 at 1:06
    
@ericd PDO is just an abstraction layer for sql-type databases (so you do not need to change the code much if you switch from mySQL to MSSQL, Oracle or Postgres or ...). It does imho not prevent sql-injections. –  Nils Sep 27 '12 at 20:40
add comment

What is put in each log is determined by /etc/rsyslog.conf (for debian squeeze -- different if you are using a different syslog daemon).

auth.log usually will show password hack attempts, I monitor for ssh attempts. apache2/error.log will give you http errors.

mail.log is important -- we use sendmail / dovecot and sasl, sasl and dovecot show up here.

I would recommend looking at the package fail2ban. If you install it for your distribution, it should have some of the settings already tuned to what you've got. It looks for login failures and errors, can be configured to email you hack attempts as well as automatically block offending IP addresses and ports.

share|improve this answer
    
Thanks for your suggestion. I will read fail2ban documentation –  ericd Sep 27 '12 at 1:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.