Home / server / Questions / 92969
Accepted
Thomaschaaf
Asked: 2009-12-11 04:07:06 +0800 CST

Email on activity on server

  • 772

I am searching for a way to secure my server from bad guys and the worst case scenario would be that they'd gain access to one of the users how do I receive an email on activity? I would like to get an email when someone logs in (any user, since no one should be logged in to them, except when someone is actually allowed to work on them) We have hourly backups of our servers

are there better ways to get notified that suspicous activity is going on?

security

3 Answers

  1. Out of experience: don't. Please. E-mail "activity" leaves the boring job (parsing) on your side, which means that after a few weeks of false positives you stop paying attention. Then when an attack happens, you don't notice it.

    Also there are other attack vectors that won't involve logins: imagine what happens if somebody exploits a vulnerable service, and tricks it into executing some code.

    Or if you have a web application running on that server, and somebody steals that app credentials to duplicate the data stored in a db.

    Or if somebody does a "su - user" into a username that's allowed to work.

    Furthermore: even if you were to know that somebody actually logged in, what would you do? Shut down the server? Login and close his or her session? The damage might be done already by the time you wake up and check your mail. And what happens when you restored the server from the backup? Do you have time to patch it?

    Security is much more than an e-mail. You have to think like the bad guys to understand what they can do, how, why, and which one is the weakest link of the security chain (hint: it's usually located between keyboard and chair).

    Since you mention debian, here's a link to securing debian.

    • 1
  2. Best Answer

    Your answer is OSSEC. It is an open source tool that monitor your logs, files and has all sort of email alerts, active responses, etc.

    It is very simple to install and by default it will start sending emails on brute force attacks, web-based attacks, etc. To enable emails for logins,logouts, or anything else is just a matter of quickly editing a XML file.

    Link: http://www.ossec.net

    • 1

  3. Debian? In regards to ssh-login?

    Write a script that monitor auth.log and e-mail activity to you?

    Question is: When is someone actually allowed to work on them, who allows them and is it a predefined time interval and dates?

    • 0