lkml.org 
[lkml]   [2011]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: kernel.org status: hints on how to check your machine for intrusion
    > Date: Sat, 01 Oct 2011 14:45:38 -0400
    > From: Steven Rostedt <rostedt@goodmis.org>
    > To: David Miller <davem@davemloft.net>
    > Cc: w@1wt.eu, greg@kroah.com, linux-kernel@vger.kernel.org
    > Subject: Re: kernel.org status: hints on how to check your machine for
    > intrusion
    >
    > On Sat, 2011-10-01 at 14:40 -0400, Steven Rostedt wrote:
    > > OK, I decided to attach the perl script anyway. It is very crude, and
    > > really needs to be cleaned up for generic use.
    > >
    >
    > I've just been pointed to:
    >
    > http://www.fail2ban.org/wiki/index.php/Main_Page
    >
    > This looks like something similar.
    >
    > You see, the reason I posted this tool is because I was sure people will
    > point me to better ones that do the same thing (and more!) ;)
    >

    The nice thing about fail2ban is that you can use it to montitor other
    ports since many bots are now doing ftp/smtp sasl/imap/imaps/pop3/pop3s
    scans to find system accounts and then use the result for an ssh login.

    As a warning though, at least on debian the SMTP SASL regex is non
    functional and I haven't had time to work out a working one so hopefully
    if someone has one it would be helpful. A fix for this is doubly important
    since the SASL package has a memory leak on failed login that they have
    known about for at least 3 years but haven't bothered fixing. A scanning
    bot can take up several gigs of memory in about an hour.

    Gerhard


    --
    Gerhard Mack

    gmack@innerfire.net

    <>< As a computer, I find your faith in technology amusing.


    \
     
     \ /
      Last update: 2011-10-03 11:59    [W:4.186 / U:0.176 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site