Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

Linux log surfers

5 views

Skip to first unread message

Airy Harse

unread,

Nov 9, 2001, 11:33:12 AM11/9/01

Sorry I can't follow messages, deja has such a large delay at the
moment that it is impossible to track.

Heres what works for me on our production systems.

IPChains, configured using pmfirewall <-- top bit 'O Kit
logsentry
portsentry
tcpwrappers
S/Key
SSH

I write IPChains logs to /var/log/ipchains under syslog, and use
logsentry running every hour during working hours, then every four, to
scan for nasties.

You could also install snort as a real time IDS and hostsentry for
detecting login anomolies.

Quick search on google will reveal loads of log surfers, but log
sentry works for me.

You said in the original post that you use Suse 7.1, I recommend
replacing the Suse firewall with pmfirewall or mason, fewer holes and
easier to administer.

If you use email a lot, junk sendmail and install qmail, or -really-
tighten the screws on sendmail ( personal BIMA there ).

Personally, I reckon a well configured IPChains firewall is as good as
most commercial firewalls on the market and is light years ahead of
those nasty 'personal firewalls' marketed for Windows.

Have fun!

Wik

unread,

Nov 9, 2001, 12:02:01 PM11/9/01

Possibly under the influence of cosmic rays, Airy Harse
(beerandf...@yahoo.co.uk) gave forth with a sudden burst of
eloquence, thus:

> Sorry I can't follow messages, deja has such a large delay at the
> moment that it is impossible to track.

[ker-snip]

> Personally, I reckon a well configured IPChains firewall is as good as
> most commercial firewalls on the market and is light years ahead of
> those nasty 'personal firewalls' marketed for Windows.

Cheers for the advice...

> Have fun!

Oh, I will!
:-)

0 new messages