2

There is a OpenBSD (64bit; 5.5) server having nginx (HTTP/HTTPS) and SMTP (OpenSMTP).

Question: What are the best practices to detect suspicious activity? Are there any scripts that shows interesting activity from the logs or somewhere? Attacks, DDOS, any abnormal activity?

Example for detecting IP addresses that connected too many times: dos.awk

function max(arr, big) {
    big = 0;
    for (i in cat) {
    if (cat[i] > big) { big=cat[i]; }
    }
    return big
}

NF > 0 {
    cat[$1]++;
}
END {
    maxm = max(cat);
    for (i in cat) {
    scaled = 60 * cat[i] / maxm;
    printf "%-25.25s  [%8d]:", i, cat[i]
    for (i=0; i<scaled; i++) {
        printf "#";
    }
    printf "\n";
    }
}

How to use it:

tail -n 1000 /var/www/logs/access.log | awk -f dos.awk | sort -nrk3 | less
  • 2
    The problem with detecting attacks based on log files after the fact is that a potential attacker who manages to root the system could manipulate the logs to cover their tracks. – Jeff-Inventor ChromeOS Aug 23 '14 at 2:17
  • In the situation as you explain @Jeff-InventorChromeOS if the root is compromised does elastic.co/products/x-pack/monitoring that works with log (if I have well understood) could be compromised too? – aurelien Nov 27 '16 at 11:34
2

There are a number of ways you could approach this, but the most direct would probably be to set up an intrusion detection system, such as Snort. It monitors all traffic to the server and can warn you of suspicious activity.
https://www.snort.org/

0

I would suggest using a logging server, such as Splunk. It will take in your access logs ( or virtually any data) and index it for searches and queries. You would have the ability to search, build graphs, stats charts, etc. it's also good for driving deep into your data and find trends or anomalies. You can also create alerts so you can be notified if something's happens. There is a lot of support in the community as well, so it's easy to get your solution customized if needed. Hope this helps.

-2

For log file based attack detection be sure to give the OSSEC HIDS a try: https://ossec.github.io/

  • Whoever downvoted my answer, I'd appreciate to learn why – Peter O. Aug 2 '17 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.