[ILUG] Scripts to detect break-ins

[Brian Brazil]

Over the last few weeks I've written a few scripts to detect certain
types of break-ins. These include website compromises and ssh brute
force password attacks.

There are 3 scripts:
ssh_brute_finder - check logfiles for ssh brute force attacks, and if
	they have compromised an account
long_running_apache - detects processes spawned by apache that have been
	running for too long
daemon_monitor - finds unknown daemons, as well as telling you if a
	system daemon dies

You can grab them from http://www.netsoc.tcd.ie/~bbrazil/code/brmon/
They have been tested on Debian Sarge and Solaris 8.

Brian

-- 
Website: http://www.netsoc.tcd.ie/~bbrazil