Re: SSL & IDS

Roelof Temmingh wrote:

> I am working on an article-thingy, and while writing I stumbled across
> this: IDS & SSL does not work together well...wow! (this was a joke).
> Even if you put an IDS on the same platform as the webserver it would not
> work. How should this be addressed? Is it addressed in some way by the ppl on
> the IDS mailling list? I did a -=very=- quick search for SSL and IDS and didnt
> really get anything.

The problem is more general than that: *network* IDS's fail in the presence of
any kind of network crypto (host-based IDS's are unaffected). This problem is
more commonly stated as IDS's vs. VPNs. VPNs (i.e. IPSec, PPTP (blech)) make
life even harder on a network IDS than SSL does.

> I have some ideas of how one can try to solve it, but I dont want to barge
> into other ppl's territory.

I'm very interested in hearing your ideas. Particularly since I don't believe
the problem is solvable :-)

> Yeah, I know .. its prolly not the best list for the discussion.

I can't think of a strictly better list to have the discussion on. These kinds
of discussions happen on security-audit, but it is OT there, too.

Crispin

--
Crispin Cowan, Ph.D.
Chief Research Scientist, WireX Communications, Inc. http://wirex.com
Free Hardened Linux Distribution:                    http://immunix.org