I have auditd installed on 64-bit Ubuntu 12.04 to track down some unexpected deletes (nice discussion of auditd). This is my rule (tagging deletes with the deletes keyword): -a exit,always -F ...
I've got a Linux desktop that will be a gateway between my private network and the open internet. I'd like it to capture and store all network traffic passing through it continuously, 24/7 (until the ...
I have been searching for a while now. But i can't find a start-up and advanced sought-of checklist to understand the most important things to consider while going for dedicated hosting server for a ...
I have only port 29999 open for SSH connections. But in the log file I see entries like this: Accepted password for user1 from 22.214.171.124 port 55805 ssh2 saying that a connection was accepted ...
I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
I have multiple servers mounting a NFS shared called /opt/WHATEVER from Server X. Server X has auditd enables with rule: sudo /sbin/auditctl -w /opt/WHATEVER -p rwxa When events occur on Server X ...
Recently someone broke into one of our linux servers as a non root user. An excerpt from .bash_history: [...] perl perl set +o history set +o history set +o history passwd sdfsdf passwd exit I ...
I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago. What ...
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...