Hacker News Reader

I don't get why people recommend chkrootkit + failban/denyhost.

I would recommend OSSEC to anyone looking for a serious host-based IDS (it does all those tools do + a lot more and very light weight).

*link: http://www.ossec.net

View on HN

I found that, while it looked great, for some reason on every install I tried (granted this was a couple of years ago, but I tried on various distributions and hardware) - the mailing engine tended to silently fail - which was fairly critical.

Denyhost, while not as sophisticated by a longshot, is dead easy to install and take care of the SSH brute force issue.

Reply on news.ycombinator.com