How to monitor the security of a personal VPS?

Question

I have a personal VPS for my blog and side projects. Recently I noticed something fishy is going on on my server: some bins are gone, ssh last login IPs belongs to a docker container even if it&rsquo;s me, etc. I currently have no way to confirm if my server is compromised, and if it&rsquo;s, how it&rsquo;s compromised. The only security measure I have is disallowing ssh login via password.I wonder if there are books or resources on how to:1. Monitor the security of a Linux server, e.g., successful ssh logins, files written to where shouldn&rsquo;t be any writes, etc. 2. Alert when intrusion happens. 3. Some way of telling if the current server is compromised 4. If the server is compromised, a report on what the intruder actually did.My knowledge in the server security area is pretty scant, if there are other things I should pay attention to, please let me know.

mikebos · Accepted Answer

Well for part of your question you can use rootkithunter (http://rkhunter.sourceforge.net).Google hardening should give a lot of info on best practices.

funnybeam · Answer

OSSEC is good for monitoring logs, system files, etc. as well as alerting (and blocking traffic if you want) when anything suspicious happens
Takes a bit of work to set up but is worth it and includes lots of basic checks by default
https://www.ossec.net/

How to monitor the security of a personal VPS?

Well for part of your question you can use rootkithunter (http://rkhunter.sourceforge.net).Google hardening should give a lot of info on best practices.

OSSEC is good for monitoring logs, system files, etc. as well as alerting (and blocking traffic if you want) when anything suspicious happensTakes a bit of work to set up but is worth it and includes lots of basic checks by defaulthttps://www.ossec.net/

Well for part of your question you can use rootkithunter (http://rkhunter.sourceforge.net).
Google hardening should give a lot of info on best practices.

OSSEC is good for monitoring logs, system files, etc. as well as alerting (and blocking traffic if you want) when anything suspicious happens
Takes a bit of work to set up but is worth it and includes lots of basic checks by default
https://www.ossec.net/