How to monitor suspicious activity?

Extracted from debian-user
Tip provided by Mitch Blevins
> I have a stand-alone machine, with dialup ppp connection (using diald).  I
> think someone was trying to hack me today, and I'd like advice on how to
> find out whether they succeded, and what to do about it.  I'd also appreciate
> suggestions on the easiest way to prevent, or at least monitor, such
> activity in the future.
 
 You can get the iplogger package, which will log every tcp connection made
 to your machine.  The lsof package is also useful for finding out if a
 service is running on a port on your own machine.  I believe lsof is
 kernel version dependent, so you may have to expirement some....
 
 example:
 [bash]$ lsof -i :22
 COMMAND   PID USER   FD   TYPE     DEVICE SIZE/OFF INODE NAME
 sshd    32211 root    6u  inet 0x0149ac0c      0t0   TCP *:ssh (LISTEN)
 
 Also, if you are paranoid, I would suggest getting the tripwire package.
 This will monitor your system for changed system files.

Follow-up :
| Previous | Next | Index of category | Main Index | Submit |


Appears in section(s) : security net
Tip recorded : 16-05-1999 20:10:27
HTML page last changed : 27-07-1999 20:11:38