BlueOnyx Security Package

Overview

bo-sec is a bundle of security related rpms for your BlueOnyx system. It detects all sorts of intrusions timely and notifies you by mail.

It has however no GUI and no integration into cced to simplify matters. The software is currently in beta status. While we have tested it extensively, your results may vary.

Quicklinx
BlueOnyx Homepage
BlueOnyx VPS Hosting
TeleMedia Publications
Download: PKG
$Id: blueonyx-security.html,v 1.2 2011-05-03 20:09:34 obiwan Exp $

Features

Checks for unusual open network ports every few minutes (using trojan-scan)
Scan nightly for viruses, malware, phishing, credit card files, web-shell and general web-attacks (maldetect, clamav)
Silent operation, only reports via email if there is something phishy which needs your attentions
Constantly updated with new signatures for malware, web shells and viruses
Installable as BlueOnyx PKG or Centos RPM
Licensed under a BSD license
Automatic updates and enhancements (if installed with the PKG version or from the telemedia repository)

Requirements

This script is specifically geared towards BlueOnyx servers, it won't work on any other platform. If you're running a recent version of BlueOnyx the package/script should work on all configurations. Just make sure you have at least the same amount of free space available on /home that your MySQL databases currently uses.

License

BSD

Disclaimer

This software is provided ``as is'' and any express or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall SCS TeleMedia AG be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.

Installation

Installing the PKG (recommended)

Download the latest package from here and install it in the BlueOnyx Admin GUI:

Login as user admin
Navigate to Software Updates | Third Party Software
Click Install Manually and either upload the previously downloaded PKG file or paste the URL

Once installed bo-sec will check the server on a regular base on suspicious acitivity and alert you if necessary. To receive the email alerts, make sure you either read the mail of user admin directly (i.e. POP3-client or webmail) or you have setup a forwarding under Personal Profile | Email.

Please note:

The PKG installs also the telemedia-blueonyx-repository for yum on the system so that you will automatically receive updates to the script. If you do not wish the telemedia-blueonyx-repository to be installed, use the RPM version of the script below and download updates from this page.

Installing the RPM

Installing the rpms manually is not recommended. However you install our yum repository and install the bo-sec suite with

rpm -i http://download.telemedia.ch/blueonyx/5106R/i386/RPMS/telemedia-blueonyx-repo-1-0.2.i386.rpm

You should then be able to install with yum:

yum install obx-bo-sec

Documentation

Requirements

You need about 60MB free space on the /home partition, the suite will install most of its tools into /home, but will link them to /opt.

Daily Usage

In normal situations you should not need to pay any attention to the operation of the bo-sec suite. Whenever it finds something fishy it will send an email alert to the admin user. Make sure you have the admin mailbox forwarded to you or read the mail of admin at regular intervals.

If you like to do adhoc scan, please visit the homepages of the tools included to check the exact usage:

Linux Malware Detect
Trojan-Scan
Clamav (executable name is obx-clamscan and obx-freshclam)

Clamav Interopability (eg. with Solarspeed AV-Spam)

The clamav package is called obx-clamav and does not interfere with any commercial installation.

Configuration

Currently no configuration is possible, this will change at a later release.

Feedback

We appreciate your feedback, please report any bugs, problems or wishes for enhancements through our feedbackform.

Changelog

0.1.11 [04.05.2011]

Initial public release, might contain bugs and problems.

Visit our sponsors: