4 ms·
I don't get why people recommend chkrootkit + failban/denyhost. I would recommend OSSEC to anyone looking for a serious host-based IDS (it does all those tools
by sucuri2 16y ago
I don't get why people recommend chkrootkit + failban/denyhost.
I would recommend OSSEC to anyone looking for a serious host-based IDS (it does all those tools do + a lot more and very light weight).
*link: http://www.ossec.net http://www.ossec.net
- dedward 16y agoI found that, while it looked great, for some reason on every install I tried (granted this was a couple of years ago, but I tried on various distributions and hardware) - the mailing engine tended to silently fail - which was fairly critical. Denyhost, while not as sophisticated by a longshot, is dead easy to install and take care of the SSH brute force issue.