2013-04-28, 11:28 PM
Hi all,
I'm wondering if anyone here would be interested in a private beta for a hosted service that I'm developing.
The service basically allows you to backup and view your server logs in near real-time from a remote web interface.
The idea for this came about after my VPS got hacked by a script kiddie who managed to break in somehow and deface all the index.html files in the /var/www/ directory on the server, then install a program to erase all the logs so I couldn't find out how he got in or everything he did.
It may have been my fault for not running a proper IDS or IPS, but we think that he exploited a script I was running to gain root access. I'm not convinced that this would have flagged up on an IDS system... Anyway, it would have been a hell of a lot easier for me to clean up afterwards if I had something that was backing up the logs to a remote server whenever a change was made to them, and alerting me if they got erased.
This is what I aim to do with this service. It will allow you to view either the entire logfile, or the iterative changes made to it, and it will alert you via email if it detects anything suspicious in the logs such as a number of failed SSH logins, a non sudo user trying to use the sudo command, or the logfile itself being erased or cleared. However, this wouldn't be an IPS substitute as it would only work by analysing the logs.
I expect the final service to cost around £5-£7/month (~$7-$10) and that will provide real-time logfile backups for one server, keeping the backups for one week. Additional retention of the data will be available at an extra cost.
The private beta will run for 2 months from the date it is announced, and will be free for the duration of the beta. After that, beta testers will receive a 50% discount for life.
If you wish to be considered for the private beta when it opens, please either reply here or send me a PM. Please let me know how many servers you want to use it on, and what you consider to be the most valuable feature when you reply.
Thanks,
Joe
I'm wondering if anyone here would be interested in a private beta for a hosted service that I'm developing.
The service basically allows you to backup and view your server logs in near real-time from a remote web interface.
The idea for this came about after my VPS got hacked by a script kiddie who managed to break in somehow and deface all the index.html files in the /var/www/ directory on the server, then install a program to erase all the logs so I couldn't find out how he got in or everything he did.
It may have been my fault for not running a proper IDS or IPS, but we think that he exploited a script I was running to gain root access. I'm not convinced that this would have flagged up on an IDS system... Anyway, it would have been a hell of a lot easier for me to clean up afterwards if I had something that was backing up the logs to a remote server whenever a change was made to them, and alerting me if they got erased.
This is what I aim to do with this service. It will allow you to view either the entire logfile, or the iterative changes made to it, and it will alert you via email if it detects anything suspicious in the logs such as a number of failed SSH logins, a non sudo user trying to use the sudo command, or the logfile itself being erased or cleared. However, this wouldn't be an IPS substitute as it would only work by analysing the logs.
I expect the final service to cost around £5-£7/month (~$7-$10) and that will provide real-time logfile backups for one server, keeping the backups for one week. Additional retention of the data will be available at an extra cost.
The private beta will run for 2 months from the date it is announced, and will be free for the duration of the beta. After that, beta testers will receive a 50% discount for life.
If you wish to be considered for the private beta when it opens, please either reply here or send me a PM. Please let me know how many servers you want to use it on, and what you consider to be the most valuable feature when you reply.
Thanks,
Joe