Ways to monitor clients?

[lcryan]

How do you guys monitor your clients content I have always been faced with this problem on how to keep tabs I trust most of my current clients had a few bad seeds but with getting bigger is alot more accounts that I need to monitor more often. I am talking about warez porn irc's all that stuff I mean you catch it when the server load spikes but any ways you guys try to prevent it?

 

[AlEast]

This is a good question. I was wondering of a list of common file extensions people might use.

 

[xion]

use "locate" in ssh

Typical Bad things to look for:
psybnc
... (directories named ... usually have buches of bad stuff in them)
cgitelnet
bd.pl
ebayisapi
websrv
r0nin
phpshell
c99shell

 

[talkwebhosts.co]

My data center tends to notify me of the bad seeds. It would be great to have a means of detecting these bad seeds before they occur, but normally you end up with them via some sort of fraud order.

 

[siteseer]

I would say monitor the new ones. Make sure existing clients know they can't violate your best practices without a freeze.

 

[marker]

I agree with siteseer, monitoring new clients for a few months will be an easy task to do rather than monitoring all.

 

[mobiuz]

Regardless the size of your member base, it is definitely good practice to check in on what your users are doing. Some like to pretend they are naturally doing the right thing. Other instances, honest clients will make an honest mistake.

If you have root access to your server and are running RedHat, I periodically check the /home directory to the server and individually check each account (even if it takes 3 weeks to get it done).

If you would like to take a quick peek at a users activity run the following command (if they are actively logged in with FTP, SSH, ect)

ps -fu theirusernamehere

So if you do ps -fu root you will be able to see all your activities, commands, processes ran for the user root. This command is also ideal for locating a users PID# in the event you need to kill their activity on the spot. Most excellent for killing inactive users.

Regularly run the "top" command or "top -c", look for things out of the ordinary. If you see the user "nobody" (Apache) running a process you are unfamiliar with investigate it.

Make a routine habit of checking your server's temp directory (usually /tmp)
You can find all sorts of valuable info there. In stereotypical cases you will find eggdrops, ect housed in the temp.

 

[imported_Gareth]

use "locate" in ssh

Typical Bad things to look for:
psybnc
... (directories named ... usually have buches of bad stuff in them)
cgitelnet
bd.pl
ebayisapi
websrv
r0nin
phpshell
c99shell

Thanks xion, works perfectly.

 

[marker]

Xion thanks for the useful hints you have provided.
Could you also specify which keyword relates to which "bad" thing? So that we can have more detailed info on bad software we have to watch for...