2

I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC configuration for web application security i.e. folders,logs to monitor for intrusion detection?

Improve this question

2 Answers 2

Reset to default
1

You might want to include folders which contains your application. Should an attacker be able to exploit your server chances are they will write a file to your web root.

Improve this answer
1
  • are you suggesting to monitor /var/www/html and my application is store in /usr/local? So should I store that too? Another things how to detect if those file are robots or also some scaneer
    – biz14
    Nov 19, 2013 at 4:05
0

For intrusion detection you will definitely want to monitor your access.log and error.log files for this web app. I would look out for:

  1. Unusually high traffic. Figure out what a normal amount of traffic is based on your access.log and set a monitor to alert you if you suddenly get a much greater amount (e.g. 10 times more requests) that could indicate either a DoS attack or server probing.

  2. A large amount of POST requests. This usually indicates a SQL injection attack.

  3. Many lines in your error.log file. Again this probably indicates server probing (or something misconfigured).

Others please feel free to add/edit.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.