1
vote
1answer
27 views

NIDS on bridged firewall

I have a firewall (Debian Stable 7.5) which works in bridged mode. The interfaces eth0 (WAN) and eth1 (LAN) are linked with the bridge interface br0. Can I deploy a NIDS (eg. Snort) on this server? ...
0
votes
1answer
45 views

Host says server is affected by malware, anyone knows this one ? What to do? [duplicate]

My host sent a notification that says server is infected with a malware, it doesn't seem very popular. The Symantec site about this malware shows windows machines as targets, but not CentOS. Anyone ...
0
votes
0answers
48 views

Trouble getting started with the STEALTH monitoring package

Is anyone here familiar with the Linux-based STEALTH package (for monitoring FS integrity of client systems)? I'm trying to get started with a very simple configuration, but I'm running into trouble ...
0
votes
1answer
699 views

AIDE - How to exclude whole folders?

I've recently installed AIDE on a server of mine after having a run in with hackers a week or so ago. There doesn't appear to be much documentation around for AIDE, especially on their website. I've ...
0
votes
0answers
123 views

OSSEC not sending ip block notification

In OSSEC, there is an active response script, which blocks/un-block the IP address of an intruder. i have made some modifications in the script to send an email notification using /bin/mail command, ...
2
votes
1answer
2k views

aide --init show lots of errors

I have a brand new centos 6.2 server. The first thing I did is yum -y install aide and then next I did aide --init. Below is a whole lot of errors I got.What does it means must I reinstall it? Or ...
0
votes
1answer
158 views

How can I find out what user from a specified IP is doing with my server?

Yesterday night around 2:00, I occasionally try out a snippet: netstat -ntu | tail -n +3|awk '{ print $5}' | cut -d : -f 1 | sort | uniq -c| sort -n -r | head -n 5 Then it turns out one IP is having ...
1
vote
2answers
528 views

How to find security-leak after a skynet intrusion?

Some days ago, the server of a friend had an intrusion. The attack installed a new SSH daemon that let any valid account in, without providing a valid password. After login, each account automatically ...