Tag Info

New answers tagged

11

From the access logs of a service (nginx, Dovecot, etc.), you cannot see whether you were affected or not. Unless you have previously captured all SSL traffic, you cannot see whether you got attacked in the past either. The pattern to match in a packet capture is very simple: A malicious Heartbeat request is sent. An overly long Heartbeat response is ...


0

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances? So, how can you do it? you need to use a log parser. So ...


4

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together. The Good News Fear not, we can make it work. ...


2

very simple: the request-method is not GET, but XGET which is not known, thus you server reports error 501 do you run tomcat/jboss or a similar app-serever? i guess, not. this looks like a simple scan from some random skiddo who tries to find vulnerable app-servers but fails with the simple task of generating valid requests; the XGET looks interesting ...


0

Yes, there are many reason why you would want to have a complete audit trail of everything done on a given server (or everything you do on any server), and auditing is just a small fraction of it. Often information that later proves critical is only ever dumped to the console (not to any log file), and having a history to go look through can be very ...


0

You can try to set the umask in the environment of the process that is creating the files. For example, if you want the permissions of new files to be -r--r--r-- (0444), you can set your umask to 222: localhost> umask 77 localhost> touch x localhost> ls -l total 0 -rw------- 1 user1 wheel 0 Mar 17 12:54 x localhost> umask 222 localhost> ...



Top 50 recent answers are included