2 - Raspberry PI Community Projects

• those that qualify a message as a cracking attempt (stored in a file in the /etc/logcheck/
cracking.d/ directory);
• those canceling such a qualification (/etc/logcheck/cracking.ignore.d/);
• those classifying a message as a security alert (/etc/logcheck/violations.d/);
• those canceling this classification (/etc/logcheck/violations.ignore.d/);
• finally, those applying to the remaining messages (considered as system events).
CAUTION
Ignoring a message
Any message tagged as a cracking aempt or a security alert (following a rule
stored in a /etc/logcheck/violations.d/myfile file) can only be ignored by
a rule in a /etc/logcheck/violations.ignore.d/myfile or /etc/logcheck/
violations.ignore.d/myfile-extension file.
A system event is always signaled unless a rule in one of the /etc/logcheck/ignore.d.
{paranoid,server,workstation}/ directories states the event should be ignored. Of course,
the only directories taken into account are those corresponding to verbosity levels equal or
greater than the selected operation mode.
TIP
Your logs as screen
background
Some administrators like seeing their log messages scroll by in real time; the
root-tail command (in the root-tail) package can be used to integrate the
logs into the background of their graphical desktop. The xconsole program
(in the x11-apps package) can also have them scrolling in a small window.
Messages are directly taken from syslogd via the /dev/xconsole named pipe.
14.3.2. Monitoring Activity
14.3.2.1. In Real Time
top is an interactive tool that displays a list of currently running processes. The default sorting
is based on the current amount of processor use and can be obtained with the P key. Other
sort orders include a sort by occupied memory (M key), by total processor time (T key) and by
process identifier (N key). The k key allows killing a process by entering its process identifier.
The r key allows renicing a process, i.e. changing its priority.
When the system seems to be overloaded, top is a great tool to see which processes are competing
for processor time or consume too much memory. In particular, it is often interesting to
check if the processes consuming resources match the real services that the machine is known
to host. An unknown process running as the www-data user should really stand out and be
investigated, since it's probably an instance of software installed and executed on the system
through a vulnerability in a web application.
top is a very flexible tool and its manual page gives details on how to customize its display and
adapt it to one's personal needs and habits.
Chapter 14 — Security
383