Best Practice Question
 

This could be be answered with an opion or opion based on results... This could also be answered in a more detailed answer than I looking for. This more than likely has already been answered multiple times but I wanted to interact with the board :D If I have a web server behind a router that is forwarding all request to port 80 on my internal machine, and now I want to install an IDS and firewall solution to help protect the box, should I a) install everything on one box b) install the IDS on one box, the web and firewall on another, or c) install each on a seperate machine and put the firwall box behind the router but infront of the web server? Thanks in advance for the suggestions and thoughts. The server(s) will be slackware and the IDS will be snort, not settled on a firewall yet.

I would put the IDS and a firewall on a diff box from the http server. I would also firewall the http server.

"Defense in Depth" The idea is to limit your exposure. Don't let an exploiut specific to Snort expose your webserver. You can't completely secure anything connected to the internet - you can make it as difficult as possible.

Skye

AFAIK the decision on placement of the NIDS depends on what you want to focus on (or not): if you need an unobstructed view, place the NIDS in front of router. If you don't need to focus on everything and also trust your fw from *never* being b0rken: between router and fw, else behind the fw. Other considerations for the NIDS being a separate box could be having a really fat pipe, extreme security considerations like you need the NIDS box to be protected against compromise itself or if you need sniffing in promiscuous mode but at the same time rely on promiscuous mode detection as a sign of compromise.

Cyberskye is also right about the Single Point of Failure thing, which basically means you should separate *all* elements plus restricting servers to a separate DMZ.

If you can afford it I would go out and pick up the May issue of Linux Magazine. There is a great article on setting up snort as an IDS. It explains in depth the placement of a snort server in terms of your network architecture. Its well worth the read in my opinion.