topic Re: RH 8 Security and Logging in Secure OS Software for Linux

RH 8 Security and Logging

Francis Ancheta — Wed, 11 Jun 2003 03:22:41 GMT

Hi,

How can I view/set auditing features on RH 8. For Microsoft it would be easy since all you need to do is to go to Local Policy Settings. I need to know if someone is trying to hack to my system. I am planning to have a firewall and proxy installed in one of my servers using RH 8. Does anyone have a suggestion.

Re: RH 8 Security and Logging

U.SivaKumar_2 — Wed, 11 Jun 2003 05:07:42 GMT

Hi,

first thing to do is to harden your system.

Disable unwanted network services.

Run a good hardening tool like bastille-linux.

Download the rpm from,

http://www.bastille-linux.org/#get

Next thing is to get a software to periodically monitor your log files and send you alerts in case of suspicious log entries.

use logsentry tool for that,

http://www.gnu.org/directory/sysadmin/Monitor/LogSentry.html

If you need C-2 trusted system model auditing then you can use SNARE (System iNtrusion Analysis and Reporting Environment) software ( basically operates as a kernel module )

http://freshmeat.net/projects/snare/?topic_id=43%2C862%2C143%2C253

regards,
U.SivaKumar

Re: RH 8 Security and Logging

Vitaly Karasik_1 — Wed, 11 Jun 2003 10:54:55 GMT

You have a lot of resources - from RH "Security Guide" http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/security-guide/

to

http://www.linuxsecurity.com/resources/index.html

Regards,
Vitaly