Re: Test question

[Erik Fichtner <emf () servervault com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, Dec 17, 2001 at 11:30:46AM -0800, Ryan Hill wrote:
> To ignore alerts for SMTP traffic, your pass rule might look like:

pass tcp 216.136.171.252 any -> $HOME_NET 25 (msg:"ATTACK RESPONSES id check returned root"; flags:A+; content: 
"uid=0*DEFANG*(root)"; classtype:bad-unknown; sid:498; rev:2;)


Wouldn't you be better off putting the snort-users mail relay in there, just
in case a vulnerability shows up in your MTA?

Just a thought.


(signature mildly defanged.)

- -- 
Erik Fichtner
Security Administrator, ServerVault, Inc.
703-333-5900
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE8Hk7AQ7EzrewLMS0RAk97AKC3rVBmkr8UavPBMk5a5JXuUSd1RACcD+9O
IGHBPeKcVf0Dzul8rlbGIUk=
=9iTo
-----END PGP SIGNATURE-----

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users