2 - Raspberry PI Community Projects

of the /etc/network/interfaces file. In the following example, the script is stored under
/usr/local/etc/arrakis.fw.
auto eth0
iface eth0 inet static
address 192.168.0.1
network 192.168.0.0
netmask 255.255.255.0
broadcast 192.168.0.255
up /usr/local/etc/arrakis.fw
Example 14.1
interfaces file calling firewall script
14.3. Supervision: Prevention, Detection, Deterrence
Monitoring is an integral part of any security policy for several reasons. Among them, that the
goal of security is usually not restricted to guaranteeing data confidentiality, but it also includes
ensuring availability of the services. It is therefore imperative to check that everything works
as expected, and to detect in a timely manner any deviant behavior or change in quality of the
service(s) rendered. Monitoring activity can enable the detection of intrusion attempts and
enable a swift reaction before they cause grave consequences. This section reviews some tools
that can be used to monitor several aspects of a Debian system. As such, it completes the section
dedicated to generic system monitoring in Chapter 12, Advanced Administration (page 298).
14.3.1. Monitoring Logs with logcheck
The logcheck program monitors log files every hour by default. It sends unusual log messages
in emails to the administrator for further analysis.
The list of monitored files is stored in /etc/logcheck/logcheck.logfiles; the default values
work fine if the /etc/syslog.conf file has not been completely overhauled.
logcheck can work in one of three more or less detailed modes: paranoid, server and workstation.
The first one is very verbose, and should probably be restricted to specific servers such
as firewalls. The second (and default) mode is recommended for most servers. The last one is
designed for workstations, and is even terser (it filters out more messages).
In all three cases, logcheck should probably be customized to exclude some extra messages
(depending on installed services), unless the admin really wishes to receive hourly batches of
long uninteresting emails. Since the message selection mechanism is rather complex, /usr/
share/doc/logcheck-database/README.logcheck-database.gz is a required — if challenging
— read.
The applied rules can be split into several types:
382 The Debian Administrator's Handbook