1. Wireshark
Wireshark is a sophisticated network monitoring tool and Linux packet analyzer. It allows you to easily inspect data packets in real time and even offline. The open-source, multi-platform tool inspects hundreds of protocols, with more being added regularly. The global apparatus of network and security specialists, along with developers, keep Wireshark updated. You can use either the GUI or TTY-mode TShark utility to view collected data. Many different formats are supported for capturing files, and you can also compress large files with gzip from within Wireshark. For even faster analysis, you can set up coloring rules for your packet list. And, if you want to analyze data outside of the tool, export data to CSV, PostScript, XML, and plain text.
2. ClamAV
ClamAV is one of the best open-source tools to secure your Linux server. As with any server or computer, malware and viruses are a major risk to your network and all connected devices, which is why you need a powerful antivirus engine to maintain safety. Multi-threaded scanning helps protect your Linux server in real time by searching for known threat signatures. Automatic signature updates ensure newer threats aren’t a threat to you. This tool is also multi-platform, so you can use it on your server as well as other operating systems on your network. It’s not quite as feature-rich as premium options, but it does its job well. Just make sure you’re comfortable using the command-line interface to run ClamAV. If you want a GUI, you can use ClamTK alongside ClamAV.
3. Rkhunter
Rkhunter, also known as Rootkit Hunter, is designed to sniff out local vulnerabilities, such as backdoors and rootkits, on your Linux server distro. Unlike other options on this list so far, Rkhunter focuses on securing your server from the inside out versus protecting from external threats. It looks specifically for common signs of local issues, such as incorrect permissions, hidden programs, hidden files, and more. This is a must-have for catching things that are already on your server versus scanning for potential threats from outside sources.
4. OSSEC
Both OSSEC and OSSEC+ are server intrusion detection software that are open source and completely free. All you have to do to get OSSEC+, which includes additional capabilities, is register the utility. This intrusion detection system also works well as a system information and event management solution to bring monitoring and logging into a central location. The cross-platform tool aids in meeting compliance requirements, offers real-time community-based threat sharing, machine learning, and much more. There are also a variety of free and premium plug-ins to extend capabilities, such as integrating with Cloudflare, pulling in security rules from other tools, and receiving alerts via your Slack workspace.
5. LMD
LMD, or Linux Malware Detect, is designed to detect and remove malicious activity and code. It responds to threats quickly, protecting your server. However, unlike many antivirus tools, LMD doesn’t just rely on a single database for virus signatures. The tool takes advantage of ClamAV’s existing database along with Team Cymru’s databases. It also generates signatures for any unknown malware that’s detected, making threat databases even better. You’ll need to download LMD’s installation files and documentation from GitHub, then use the maldet command to run it.
6. OpenVas
OpenVas is part of the Greenbone Community Edition, which is the free open-source version of Greenbone Enterprise Appliance. The enterprise version isn’t free but is made for enterprise security. However, the free version may be all you need. You can find the latest stable release and community guidance directly in the Greenbone Community Edition forum and on GitHub. The vulnerability assessment system (VAS) utilizes over 50,000 network vulnerability testing bases (NVTBs) to keep the tool updated. It’s able to uncover a wide range of Linux vulnerabilities and even works well on cross-platform systems. If you want to test its effectiveness, it’ll work well on virtual machines, too.
7. Nikto
Nikto performs multiple tasks, making it a great way to secure your Linux server. The web server scanner looks for dangerous files, outdated versions, various issues on over 270 server versions, server configuration problems, insecure programs, and more. There’s detailed documentation to help you uncover everything Nikto is capable of. It’s important to note that scans are designed to run as quickly as possible and a stealth mode isn’t available, so log files will be visible. However, this shouldn’t be an issue for most servers.
8. Nmap
Nmap, or network mapper, has become the go-to Linux server scanning tool. It scans for a wide range of issues, such as open ports and local security bugs, uncovers connected hosts, checks external devices, and much more. It’s a highly versatile and powerful tool that is still surprisingly free and open source. Even Hollywood has turned to Nmap, with Trinity from The Matrix Reloaded seen using the program. But, it’s even better outside of the movies, especially for monitoring highly complex networks, including multiple networks.
9. Burp Suite Community Edition
Burp Suite Community Edition is designed to test web applications. The free open source edition includes Repeater, Decoder, Sequencer, and Comparer in addition to the main Burp Proxy to intercept HTTP and HTTPS traffic. The tool audits collected data for any potential weaknesses to ensure your web applications are safe. The free version is a little more limited. With the Professional edition, you also get Burp Intruder, which allows you to create attacks to further improve server and web application security. However, it costs $399.
10. Snort
Snort is an open-source intrusion prevention system that sniffs out malicious activity on your network using a series of rules. Whenever something matches the rules, users are alerted immediately. Snort serves three main purposes: a packet sniffer, packet logger, and a full network intrusion prevention system. Detailed documentation helps you configure Snort for your specific needs. Whether you’re running a personal Linux server or complex business network, you’re free to use the tool. However, the free version comes with the community ruleset, which is only partially supported by Cisco Talos, while the premium subscriber ruleset is developed and distributed in real time by Cisco Talos.
11. Lynis
Whether you’re checking for security flaws or ensuring your system meets regulatory compliance rules, Lynis has you covered. It’s one of the best open-source tools to secure your Linux server. It works well on Linux, Unix, and macOS, and is a security auditing utility. In addition to performing security health scans, you can utilize Lynis for security audits, penetration testing, compliance testing, system hardening, and vulnerability detection. Every scan is tailored to your system, and you don’t need to install any other tools to use it.
12. REMnux
REMnux isn’t like the other tools on this list. Instead of preventing infections, it’s a Linux toolkit to aid in malware analysis. It’s included in this list because analyzing new types of malware is critical to strengthening your Linux server’s defenses. The more the community knows about what to look for in new types of malware, the easier it is to update open-source security tools to detect and prevent future infections. Ideally, you should run REMnux as a virtual machine to analyze malware without affecting your main system. Another benefit is that the toolkit offers Docker images of various malware analysis tools. This means you run them as containers versus having to install even more tools. Image Credit: TheDigitalArtist via Pixabay All screenshots by Crystal Crowder Of course, these aren’t all the tools that are available. See how SELinux works to secure your Linux server and how it compares with AppArmor. Another option is to create a honeypot to distract or even gather info on hackers targeting your server.
