1
vote
1answer
26 views

NIDS on bridged firewall

I have a firewall (Debian Stable 7.5) which works in bridged mode. The interfaces eth0 (WAN) and eth1 (LAN) are linked with the bridge interface br0. Can I deploy a NIDS (eg. Snort) on this server? ...
2
votes
2answers
122 views

Single file changed: intrusion or corruption?

rkhunter reported a single file change on a virtual server (netstat binary). It didn't report any other warning. The change was not the result of a package upgrade (I reinstalled it and the checksum ...
2
votes
4answers
146 views

What response should be made to a continued web-app crack attempt?

I've issues with a continuous, concerted cracking attempt on a website (coded in php). The main problem is sql-injection attempts, running on a Debian server. A secondary effect of the problem is ...
1
vote
2answers
524 views

How to find security-leak after a skynet intrusion?

Some days ago, the server of a friend had an intrusion. The attack installed a new SSH daemon that let any valid account in, without providing a valid password. After login, each account automatically ...