Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I want to know all the people who access my server, is there a log that shows when and how the people access my server?

--EDIT--

Sorry for not providing any more details awhile ago. My server is Ubuntu 10.04 LTS running in Linode. I heard numerous scary story of hackers trying to hack a server, so I want to know where are the logs that will show me who accessed my server by ssh, or anything that can put my server in danger.

I have installed the LAMP stack in my server. That's all I have ever installed.

share|improve this question

migrated from stackoverflow.com May 21 '11 at 5:51

This question came from our site for professional and enthusiast programmers.

1  
That question textbox is pretty big. Why don't you provide more detail in it please? I'd suggest you start with the name of the server you're running and some other details that you think might help someone answer your question with more than a simple "yes". Thank you! –  jmort253 May 21 '11 at 7:35
    
sorry for not providing more details, and thank you for suggesting for more information. –  Kevin Lee May 21 '11 at 11:01
    
+1 on your question! :) Thanks for adding the extra details. –  jmort253 May 21 '11 at 19:13

2 Answers 2

up vote 7 down vote accepted

Put on a security camera next to your server if you want to see who's accessing you physical server.

Just to know that someone is sending packets to your server, you can set up IP Tables:

sudo iptables -I INPUT -j LOG
sudo iptables -I FORWARD -j LOG

This is probably not what you meant, but it logs ALL incoming packets to /var/log/kern.log, whether those are valid or not. the previous command was illustrative, do not use it in this form or you'll flood your logs causing a possible DoS

A small list of services with their logfiles:

  • SSH: each login attempt is logged to /var/log/auth.log
  • Apache: on a default installation using apt, log files are written in the directory /var/log/apache2/
  • exim: connection attempts are logged to /var/log/exim4/mainlog (but harmless messages about the queue are logged to this one too)
share|improve this answer

Sounds like you're paranoid that hackers will hack your server. As long as you aren't specifically targeted for a hack (extremely unlikely), then you can keep from being hacked by:

  1. Using strong passwords (and better yet, upgrade to public key crypto for your ssh server as well).
  2. Being aware of all the services that people can access. Disable unneeded ones (i.e. disable an ftp server if you can use sftp)
  3. Keeping everything up-to-date
  4. Evaluating non-static web pages for SQL injections, File Inclusion vulnerabilities (LFI/RFI), and other vulnerabilities.

As long as you don't leave an obvious hole for somebody to get in through, you'll be fine. Most of the "hackers" out there who hack into random webservers are looking for the low-hanging fruit.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.