I was wondering what the best way of coupling the firewall and IDS are. Then I found snort-inline.
From the page:
This is exactly what I am looking for in setting up my PoC model of my architecture.
I have been feeling the need to create something for my project instead of a cop-out best practises only type thing. I realise there is value in that.
Incidentally I just asked Jason Chan of @stake research to have a look at my paper which I based on his. I think he would have some excellent feedback.
Anyway back to the point. I am thinking of doing two things.
UPDATE 21st Sept
Thanks to Fred Avolio for pointing out here that intrusion prevention is nothing new and was called 'active security' by Network Associates back in 1999. Us newbie's need to learn.
snort_inline is basically a modified version of Snort
that accepts packets from iptables,
via
libipq, instead of libpcap. It
then uses new rule types (drop, sdrop, reject) to tell
iptables whether the packet should be dropped, rejected, modified, or
allowed
to pass based on a snort rule set. Think of this as an
Intrusion Prevention System (IPS) that uses existing Intrusion
Detection System (IDS) signatures to make decisions on packets that
traverse snort_inline.
This is exactly what I am looking for in setting up my PoC model of my architecture.
I have been feeling the need to create something for my project instead of a cop-out best practises only type thing. I realise there is value in that.
Incidentally I just asked Jason Chan of @stake research to have a look at my paper which I based on his. I think he would have some excellent feedback.
Anyway back to the point. I am thinking of doing two things.
- Create a linux distro that implements my architecture. A Knoppix style distro that would provide an example set-up.
- Reverse engineer M$ SUS so that a Unix server can be implemented. This will allow a Unix server to distribute patches to M$ machines. This would also be integrated into the distro above.
UPDATE 21st Sept
Thanks to Fred Avolio for pointing out here that intrusion prevention is nothing new and was called 'active security' by Network Associates back in 1999. Us newbie's need to learn.
Trackbacks
Trackback specific URI for this entry
No Trackbacks

