Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I´m looking for a simple way to monitor critical folders for changes to recognize hacks on a ubuntu 12.04 server. After Days of reading How To´s on different programms I´m a bit confused which way to go. The candidates I´ve googled so far are:

  • Tripwire
  • Samhain
  • Iwatch
  • Ossec

As written all I need is a not ressource intense way to check if something changed on my system (if so send an emai).

Beside the 4 solutions I´ve read that Linux gives you already the possibility to monitor and inform about file changes with Upstart. It´s already included within ubuntu what makes it glittering for me. Unfortunately I couldn´t find any How to´s for Upstart file monitoring.

Last but not least, I could also imagine to set up a simple cronjob which compares f.e. the size of critical folders with a given size.

Thankful for pointing me in the right direction,

tony

share|improve this question
    
what exactly is your question? and an md5 sum is probably more reliable than a simple size chack for your cron. –  lVlint67 Jan 2 at 8:35
    
How many files are you trying to monitor? If it is few and they change infrequently, then performance is less of an issue. Also, if it is just one server, I would stick with a simple solution not requiring a centralized reporting tool. –  jeffatrackaid Jan 2 at 16:56
add comment

closed as off-topic by Jenny D, mdpc, freiheit, Dennis Kaarsemaker, cole Jan 4 at 0:04

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Jenny D, mdpc, freiheit, Dennis Kaarsemaker, cole
If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers

up vote 0 down vote accepted

Although we're not supposed to do product recommendation, here are my inputs about samhain. I've been asked to study the best solution out of the whole open-source market on file integrity checkers, and Samhain ended up being the best, because it is feature-rich, open-source and actively developped.

You can tune the resource impact by :

  • Limit the I/O generated by initialisation/checks SetIOLimit=1000 (kB/s)
  • Define the process priority to reduce impact : SetNiceLevel=19
  • using simplier hashing algorithm will reduce CPU impact
  • Choosing only the attributes you find meaningful in the hashing process will reduce the included data
  • Limit to the files you want to monitor only.
  • reduce the frequency of file checks

Source : Official Documentation

share|improve this answer
    
thanks I´m happy now with samhain –  t Book Jan 3 at 11:23
add comment

On some cases i use yafic, which i very simplified file integrity checker.

But i prefer OSSec (cross platform,agent), as it can monitor log files and respond accordingly.

e.g monitor the secure log file for ssh brute force attack, or web server probing and block the ip address in some cases.

yafic is not in ubuntu repos, so you will need to compile it from source.

share|improve this answer
add comment

apt-cache search inotify, for more information about inotify interface "man inotify"

share|improve this answer
2  
This answer deserves a bit more explanation of what is inotify, even it it means quoting the man page. That would be useful to people intrested in knowing more without installting stuff/having a server on hand. –  Kwaio Jan 2 at 9:48
    
@Kwaio if you don't have a server on hand, you can read the man pages of inotify online linux.die.net/man/7/inotify, some times i would like to help some body, but without so much times to explain about some thing, the man pages can help –  c4f4t0r Jan 2 at 18:33
    
In those cases, consider making it a comment, not an answer =) –  Kwaio Jan 3 at 8:20
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.