How do I check if someone attempted to hack my server or not?

yetanotherfcw · #1 03-31-2006, 01:36 AM

I run RHE server, and let's say that I want to check to see if someone attempted to hack my server or not everyday. What do I need to do? What do I need to check?

Soulwatcher · #2 04-03-2006, 03:35 AM

yetanotherfcw sorry about getting back to you late on this one. Some how I over looked this post. The fist thing you would want to do is install RKHunter and CHKRootKIt. Another thing you want to do is check the bash history of root. And make sure theres nothing funny there. After you install RKHunter and CHKRootKIt run them and make sure nothing funny pops up. Also make sure you check over your daily LogWatch and look for anything funny.

yetanotherfcw · #3 04-03-2006, 03:42 AM

How difficult is it to install RKHunter and CHKRootKIt? Also should I install both?

... and is LogWatch an application?

Soulwatcher · #4 04-03-2006, 04:36 AM

They are both easy to install, I would run both. Logwatch runs daily chech the root mail folder, I bet its full. Thats where logwatch reports every night.

http://www.eth0.us/rkhunter <------rkhunter install guide

http://www.webhostgear.com/25.html <----- chkrootkit install guide

rmwebs · #5 05-07-2006, 07:40 AM

RKHunter is very easy to install... as is chkrootkit