RE: Best Linux Intrusion Detection System

RE: Best Linux Intrusion Detection System

[Derick Anderson]

> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org 
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of 
> elg3ne@dap.edu.ph
> Sent: Tuesday, December 06, 2005 12:59 AM
> To: netfilter@lists.netfilter.org
> Subject: Best Linux Intrusion Detection System
> 
> Hi guys, I know this is a off topic but since Iptables is a 
> security tool, I will ask this question with regards also on security.
> 
> Here it goes.
> 1. what is the most commonly used LIDS system?
> 2. what is the best LIDS?
> 3. what is the most sophisticated LIDS?
> 4. what is the most easiest to setup?
> 5. what LIDS can you suggest on CentOS?
> 
> thanks

The Focus-IDS group (www.securityfocus.com) is a better place for such
questions. However since I replied:

1. Probably Snort (www.snort.org) but I'm not positive. Snort is a NIDS,
of course, so if you are looking for HIDS then I couldn't tell you
(Tripwire maybe).
2. Depends on what you want. Snort is an excellent NIDS, once you
understand how to use it and turn off some rules which produce tons of
false positives.
3. Sophisticated? Dresses better, more feature bloat, slicker interface?
4. I'd spend the time understanding what's going on before worrying
about how easy an IDS is to set up.
5. Don't use it, so can't.

Derick Anderson

Internet usage policy

[Ayobami Oladejo]

Hello,

I am still a newbie in Linux. I have a challenge. Curently in my 
organisation, we want to run a policy not to allow some workstations to 
access the Internet until 6 p.m of each day. We currently use Squid on a 
RedHat Linux system.
How can I do this.

Thank you.

Ayo

_________________________________________________________________
Don't just search. Find. Check out the new MSN Search! 
http://search.msn.com/

Re: Internet usage policy

[Jason Opperisano]

On Tue, May 10, 2005 at 09:40:55AM +0000, Ayobami Oladejo wrote:
> 
> Hello,
> 
> I am still a newbie in Linux. I have a challenge. Curently in my 
> organisation, we want to run a policy not to allow some workstations to 
> access the Internet until 6 p.m of each day. We currently use Squid on a 
> RedHat Linux system.
> How can I do this.

squid supports time-based ACL's:

  http://squid.visolve.com/squid/squid24s1/access_controls.htm

-j

PS - squid has its own list:
     http://www.squid-cache.org/mailing-lists.html

--
"Lois: So he just left without saying anything?
 Peter: All I asked him to do was buy some peanuts and cracker jacks.
 Brian: I don't care if he ever gets back. I wasn't being cute. I really
 hope he's dead."
        --Family Guy

Best Linux Intrusion Detection System

[elg3ne]

Hi guys, I know this is a off topic but since Iptables is a security tool, I
will ask this question with regards also on security.

Here it goes.
1. what is the most commonly used LIDS system?
2. what is the best LIDS?
3. what is the most sophisticated LIDS?
4. what is the most easiest to setup?
5. what LIDS can you suggest on CentOS?

thanks