Skip to content

Latest commit

 

History

History
150 lines (109 loc) · 3.73 KB

logy.md

File metadata and controls

150 lines (109 loc) · 3.73 KB

Logovani

rsyslog

apt-get install rsyslog rsyslog-pgsql
$ModLoad ompgsql
$template StdPgSQLFmt,"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-pgsql%', '%timegenerated:::date-pgsql%', %iut%, '%syslogtag%')",STDSQL
$template mytemplate,"insert into SystemEvents (Message) values ('%msg%')",STDSQL
mail.* :ompgsql:database-server,database-name,database-userid,database-password;mytemplate
ERRORLOG  "|/USR/BIN/TEE -A /VAR/LOG/WWW/ERROR.LOG  | /USR/BIN/LOGGER -THTTPD -PLOCAL6.ERR"
CUSTOMLOG "|/USR/BIN/TEE -A /VAR/LOG/WWW/ACCESS.LOG | /USR/BIN/LOGGER -THTTPD -PLOCAL6.NOTICE" EXTENDED_NCSA
$UDPServerAddress 0.0.0.0
$UDPServerRun 514

$RepeatedMsgReduction on
$RepeatedMsgContainsOrigionalMsg on

if $programname == 'dovecot' and $syslogseverity <= '6' then /var/log/dovecot.log

*.* @@1.2.3.4:2010;SyslFormat
$template HourlyMailLog,"/var/log/logdir/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%_mail.log
$template SyslFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::space$ 
# Log all the mail messages in one place.
mail.*                                                  -?HourlyMailLog;SyslFormat
CustomLog "|/usr/bin/logger -t httpd -p local6.info" combined
CustomLog logs/access_log combined

if $syslogfacility-text == 'local6' and $programname == 'httpd' then /var/log/httpd-access.log

/usr/share/doc/rsyslog-pgsql

PortSentry apt-get install portsentry

service portsentry stop|start|restart

/etc/portsentry/portsentry.conf: BLOCK_UDP="1", BLOCK_TCP="1",

/etc/portsentry/ /var/log/syslog

nmap -p 1-65535 -T4 -A -v -PE -PS22,25,80 -PA21,23,80 10.228.67.X

Kontrola: grep "attackalert" /var/log/syslog grep -n DENY /etc/hosts.deny grep -n Blocked /var/lib/portsentry/portsentry.blocked.tcp grep -n Blocked /var/lib/portsentry/portsentry.history grep -n Blocked /var/lib/portsentry/portsentry.blocked.udp netstat -rn | grep "10.228.67.X" route -n | grep "10.228.67.X"

PortSentry apt-get install portsentry

service portsentry stop|start|restart

/etc/portsentry/portsentry.conf: BLOCK_UDP="1", BLOCK_TCP="1",

/etc/portsentry/ /var/log/syslog

nmap -p 1-65535 -T4 -A -v -PE -PS22,25,80 -PA21,23,80 10.228.67.X

Kontrola: grep "attackalert" /var/log/syslog grep -n DENY /etc/hosts.deny grep -n Blocked /var/lib/portsentry/portsentry.blocked.tcp grep -n Blocked /var/lib/portsentry/portsentry.history grep -n Blocked /var/lib/portsentry/portsentry.blocked.udp netstat -rn | grep "10.228.67.X" route -n | grep "10.228.67.X"

Odblokovat: • zastavit portsentry • odstranit zaznam z /etc/hosts.deny • odstranit zaznamy z portsentry.blocked.tcp, portsentry.history a portsentry.blocked.udp ○ sed -i '/10.228.67.X/d' • odstrani reject routu: ○ route del -host 10.228.67.X reject • nastartovat portsentry

RKhunter

apt-get install rkhunter

rkhunter --update rkhunter --propupd rkhunter --list rkhunter -c --enable hidden_ports

vim /etc/rkhunter.conf

MAIL-ON-WARNING="root@localhost" MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}" SCRIPTWHITELIST="/usr/sbin/adduser" ALLOWDEVFILE="/dev/.udev/rules.d/root.rules" ALLOWHIDDENDIR="/dev/.udev" ALLOWHIDDENFILE="/dev/.blkid.tab" ALLOW_SSH_ROOT_USER=yes

rkhunter -C

Cron

/etc/crontab /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /var/spool/cron/crontabs/

crontab -l crontab -e crontab -l -u jindra

15 */4 * * * /usr/bin/rkhunter --cronjob --update --quiet

Rsync poroz na lomitka na konci :) rsync -rav /opt/dir1/ /opt/backup_dir/ rsync -rai --dry-run /etc/ /opt/etc_backup_full/ rsync -a --delete --link-dest=../backup.1 /etc/ backup.0/i