3 ms·

When a server is hacked and files are copied out of the server, how do admins figure this out? I'm running an Ubuntu server and if someone was to SSH into my m

• totetsu 6y ago
  Network throughput logs? System logs and events sent to a separate log aggregator? System metric logs showing disk i/o? There is some commands in here https://www.sans.org/reading-room/whitepapers/incident/paper/33901 https://www.sans.org/reading-room/whitepapers/incident/paper...
• macklemoreshair 6y ago
  I’ve wondered this as well
• raincom 6y ago
  centralized logging of various stuff: /var/log/messages, /var/log/secure, /var/log/audit, intrusion detection systems reporting abnormal network traffic, etc. If there is no centralized logging/alerting, it is very hard to detect.
• thedracle 6y ago
  Beyond normal system logs --- you can set up auditd to track very specific things, like executables, files being written to, copied, modified. I work on endpoint protection software that goes deeper, using ebpf and a driver for older kernels to track specific syscalls, and look for things like permission escalations, forking and then doing naughty things, for instance. It's more meant for aggregating this data to a backend that then analyzes it and provides a panel that alerts security folks to unusual behavior.