Hacker News new | past | comments | ask | show | jobs | submit login

I don't get why people recommend chkrootkit + failban/denyhost.

I would recommend OSSEC to anyone looking for a serious host-based IDS (it does all those tools do + a lot more and very light weight).

*link: http://www.ossec.net




I found that, while it looked great, for some reason on every install I tried (granted this was a couple of years ago, but I tried on various distributions and hardware) - the mailing engine tended to silently fail - which was fairly critical.

Denyhost, while not as sophisticated by a longshot, is dead easy to install and take care of the SSH brute force issue.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: