Re: Configuring Snort as a HIDS

[Seth <sethsec () gmail com>]

Home_net -> server IP
External_net -> !$HOME_NET

What kind of services does the machine offer? You can probably eliminate
most of the .rules files and only include the ones necessary for your
specific server.

Same goes for preproccessors.  No need for the telnet_ftp preproccessor if
you are installing snort directly on a web server that will never do any
telnet or ftp.

Just know that the types of alerts you will get from snort on a single
server, are entirely different than a true HIDS.  Something like OSSEC by
Daniel Cid might be what you are really looking for.   By industry standard,
HIPS are more concerned with file integrity and system log parsing on the
actual server (ie: apache, firewall, messages, etc).  Snort, even when it is
run on a single server, is more concerned with network based attacks.

Remember also that if the server you install snort on sees alot of traffic,
snort will be stealing alot of CPU and memory away from the service you are
offering.

Regards,

Seth






On Dec 4, 2007 1:21 PM, Kaplan, Andrew H. <AHKAPLAN () partners org> wrote:

>  Hi there –
>
>
>
> I have installed the prepackaged snort application, version 2.7, on a
> server running Fedora Core 7. My plan is to run the application
>
> as a HIDS. Is there a recommended configuration that I should set up to
> accomplish this?
>
> The information transmitted in this electronic communication is intended only
> for the person or entity to whom it is addressed and may contain confidential
> and/or privileged material. Any review, retransmission, dissemination or other
> use of or taking of any action in reliance upon this information by persons or
> entities other than the intended recipient is prohibited. If you received this
> information in error, please contact the Compliance HelpLine at 800-856-1983 and
> properly dispose of this information.
>
>
>
>
> -------------------------------------------------------------------------
> SF.Net email is sponsored by: The Future of Linux Business White Paper
> from Novell.  From the desktop to the data center, Linux is going
> mainstream.  Let it simplify your IT future.
> http://altfarm.mediaplex.com/ad/ck/8857-50307-18918-4
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
SF.Net email is sponsored by: The Future of Linux Business White Paper
from Novell.  From the desktop to the data center, Linux is going
mainstream.  Let it simplify your IT future.
http://altfarm.mediaplex.com/ad/ck/8857-50307-18918-4

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users