LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-26-2003, 06:41 AM   #1
nms
LQ Newbie
 
Registered: May 2003
Location: India
Distribution: Redhat Linux
Posts: 2

Rep: Reputation: 0
snort ids implementation queries


Dear all,
I am implementing a test ids setup using snort. I want to know the following things:
1)minimum software required to install on the sensor and the management console. Is it necessary to install x-windows on sensor? any links indicating the minimum software required for this installation?
2)how to set the sniffing interface of the sensor in stealth mode?
If I don't unselect the DHCP option, won't the sniffing interface search for the DHCP server and if not found give the error? If I unselect the DHCP option, I need to manually assign an IP address to the sniffing interface, which obviously is not the stealth mode.

Reply to above queries would be highly appreciated.

Thanks and Regards
NMS
 
Old 05-26-2003, 07:59 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595
1. Snort itself only depends on libnet and libpcap AFAIK. X11 isn't a requirement for running Snort on sensors or mgmnt box.
2. Have separate sensor box, ideally have 2 interfaces connect to two different networks. One interface w/o IP address connects to the network you want to monitor, the other interface with IP address connects to the network you want to administer the box from. Bypass tools like Kudzu by manually setting up the stealth interface.
 
Old 05-27-2003, 02:33 AM   #3
nms
LQ Newbie
 
Registered: May 2003
Location: India
Distribution: Redhat Linux
Posts: 2

Original Poster
Rep: Reputation: 0
Thanks UnSpawn for you prompt reply.

Linbnet and libpcap are just the packet capturing tools snort uses. but i was talking about snort implementation in an enterprise environment, where the sensors need to communicate with the central management console. what are the minimum packages required on sensors and management console to setup an enterprise-wide snort ids. here my emphasis is on security, i.e. don't install unwanted services.

it would be helpful if you can elaborate on stealth mode configuration of the monitoring interface. here i am confused coz if you bypass the kutzu, the interface won't be detected and hence no packet capture would take place.

also, i want to know about the most popular open source management console which must be able to manage the signature database and configuration of the snort sensors. I just know about SnortCenter.

i am using Redhat 9.0 for my implementation.

any help on this would be great!

thanks and regards,
nms
 
Old 05-27-2003, 08:53 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595
I think it would be good if you speed up your knowledge by first reading the LQ FAQ: Security references, post #4.
It's got basic docs on IDS, Snort, management and stealth sniffing.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Questions regarding the use of Snort (IDS) and security nasty_daemon Linux - Security 8 09-09-2005 11:48 PM
snort fails ids mode in sarge mofungo Debian 1 05-25-2005 01:35 PM
wireless ids with snort and kismet evilchild Linux - Security 1 01-26-2005 05:03 PM
Snort/ACID as an IDS WeNdeL Linux - Security 4 09-10-2004 01:14 PM
snort (ids) not working please help!!! crealkillerI75 Slackware 5 07-18-2002 04:39 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:01 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration