Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : how to track down an attack?

[bueno]

as the title said

[daveman]

Look in your logs. If you want more details you need to provide more details as to what you are looking for.

[bueno]

where are that logs being?
then how to look into it?

step by step manual is appreciated

[Spingen]

Maybe its time to buy a couple of books on your servers operating system. If its a *nix based os, then your logs will be in /var/log/

[Eric Lim]

First, I would recommend to install some third party softwares to analize the logs files for you every early morning and send an email.

For example:

http://www.logwatch.org/
http://sourceforge.net/projects/psad/

Read their documentation and install it at your own risk.

There are several good ones but do a search on google and you'll find out more.

Do a cat /etc/syslogd.conf, all your logs will be recorded according to the configuration inside the file syslogd.conf

Read them carefully and do a search on google when it's neccesery.

Configure iptables or ipchains to access only the ports that are considered being used. Or maybe install a firewall to do that for you.

No machines are completely secured and every of them brings the chance of being compromised. Make sure all your packages are up-to-date. If you think it's neccesery, either you have to do lots of reading or hire a sys admin dedicate to taking care your server.

[bueno]

I read many books about Linux Adminstration but I did't get a specific subject about tracking hackers or such topic

[bueno]

cyberservers, Perfect

Thanks

[iago]

you can try also logcheck, thats a really great program,.. also portsentry to chech for scans, etc

logcheck checks every few minutes all your log files and if it finds something strange it will email you inmediately with the details

[Slidey]

learn about your os, work out about getting audit trails

logs wont do you any good if your attacker has had half a day of script kiddieness practice.. learn to secure your machine, as you'll find that most hackers hide their trail, through multiple other servers, and through cleaning logs, trojaning binaries etc

if you can get a copy of any trojaned binaries i'd be interested in taking a look pls..