Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am searching for a way to secure my server from bad guys and the worst case scenario would be that they'd gain access to one of the users how do I receive an email on activity? I would like to get an email when someone logs in (any user, since no one should be logged in to them, except when someone is actually allowed to work on them) We have hourly backups of our servers

are there better ways to get notified that suspicous activity is going on?

share|improve this question
    
hourly backups? How much data does this thing hold and how busy is it that you can keep that kind of data stored and that kind of disk activity without impacting performance? –  Bart Silverstrim Dec 10 '09 at 12:52

3 Answers 3

up vote 1 down vote accepted

Your answer is OSSEC. It is an open source tool that monitor your logs, files and has all sort of email alerts, active responses, etc.

It is very simple to install and by default it will start sending emails on brute force attacks, web-based attacks, etc. To enable emails for logins,logouts, or anything else is just a matter of quickly editing a XML file.

Link: http://www.ossec.net

share|improve this answer

Out of experience: don't. Please. E-mail "activity" leaves the boring job (parsing) on your side, which means that after a few weeks of false positives you stop paying attention. Then when an attack happens, you don't notice it.

Also there are other attack vectors that won't involve logins: imagine what happens if somebody exploits a vulnerable service, and tricks it into executing some code.

Or if you have a web application running on that server, and somebody steals that app credentials to duplicate the data stored in a db.

Or if somebody does a "su - user" into a username that's allowed to work.

Furthermore: even if you were to know that somebody actually logged in, what would you do? Shut down the server? Login and close his or her session? The damage might be done already by the time you wake up and check your mail. And what happens when you restored the server from the backup? Do you have time to patch it?

Security is much more than an e-mail. You have to think like the bad guys to understand what they can do, how, why, and which one is the weakest link of the security chain (hint: it's usually located between keyboard and chair).

Since you mention debian, here's a link to securing debian.

share|improve this answer

Debian? In regards to ssh-login?

Write a script that monitor auth.log and e-mail activity to you?

Question is: When is someone actually allowed to work on them, who allows them and is it a predefined time interval and dates?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.