Understanding IDS for Linux
A port scan to a service like portmap (port 111), which is known to have various exploits, would be alerted by PortSentry:
Dec 9 03:03:17 flamengo portsentry: attackalert: TCP SYN/Normal scan from host: 184.108.40.206/220.127.116.11 to TCP port: 111
Learning how to interpret log files is one of the most important things that an intrusion or security analyst must learn in order to decide what action to take in a given situation. The excerpt from the PortSentry alert above was obtained from the syslog file. This alert states that on December 9 at 03:03, the host called flamengo, which has PortSentry installed, detected an SYN-flag Normal port scan in the TCP port 111 which, in general, runs the service portmap, from host IP 18.104.22.168.
A firewall is a primary security element in a network, but it will not detect attacks on a service that is already opened, such as an attack to your DNS or web server. An IDS by itself will not solve all your problems as a security element, but if you customize it for your needs, it certainly will help alert you to strange behaviors and unauthorized attempts to your host or network. With this information, you should contact the administrator of the network in which the intrusion's IP is located and then inform them of what is going on. Being in contact with the security community is also the best way to keep up to date on new attacks and the signatures to detect them. Be aware—install an IDS!
Pedro Bueno (email@example.com) is a former data engineer from Lucent Technologies and currently is a security engineer at Open Communications Security. He also contributes at Best Linux as a volunteer, and his favorite hobby, besides soccer, is analyzing the alerts generated by Snort.
|Using Salt Stack and Vagrant for Drupal Development||May 20, 2013|
|Making Linux and Android Get Along (It's Not as Hard as It Sounds)||May 16, 2013|
|Drupal Is a Framework: Why Everyone Needs to Understand This||May 15, 2013|
|Home, My Backup Data Center||May 13, 2013|
|Non-Linux FOSS: Seashore||May 10, 2013|
|Trying to Tame the Tablet||May 08, 2013|
- Using Salt Stack and Vagrant for Drupal Development
- New Products
- What's the tweeting protocol?
- Making Linux and Android Get Along (It's Not as Hard as It Sounds)
- How's The Weather?
- Trying to Tame the Tablet
- New Products
- Red Hat's Dell Deal, Waiting for Cowpland
- SSHFS: Super Easy File Access over SSH
- Paranoid Penguin - Security Features in Ubuntu
- This is the easiest tutorial
1 hour 4 min ago
- Ahh, the Koolaid.
6 hours 43 min ago
- git-annex assistant
12 hours 43 min ago
- direct cable connection
13 hours 5 min ago
- Agreed on AirDroid. With my
13 hours 15 min ago
- I just learned this
13 hours 20 min ago
13 hours 50 min ago
- not living upto the mobile revolution
16 hours 41 min ago
- Deceptive Advertising and
17 hours 16 min ago
- Let\'s declare that you have
17 hours 17 min ago
Enter to Win an Adafruit Prototyping Pi Plate Kit for Raspberry Pi
It's Raspberry Pi month at Linux Journal. Each week in May, Adafruit will be giving away a Pi-related prize to a lucky, randomly drawn LJ reader. Winners will be announced weekly.
Fill out the fields below to enter to win this week's prize-- a Prototyping Pi Plate Kit for Raspberry Pi.
Congratulations to our winners so far:
- 5-8-13, Pi Starter Pack: Jack Davis
- 5-15-13, Pi Model B 512MB RAM: Patrick Dunn
- Next winner announced on 5-21-13!
Free Webinar: Linux Backup and Recovery
Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.
In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.