Setting up an IDS system

From: Naman Latif <naman.latif(at)inamed.com>
Date: Fri Jan 31 2003 - 12:34:19 EST

Hi,
I am in the process of setting up and IDS system using Linux\Snort in DMZ. A couple of questions regarding this

1. Is it a safe practice to have access to this system from Inside Network (for retrieving log files etc) from 1-2 Stations ? Ofcourse IDS

won't have access to inside network and be blocked by Firewall.

• What kind of services should be running on IDS Station ? Should all Web\FTp etc services be stopped ?
• How important it is to also have an IDS system monitoring the traffic on your Inside Network ? I believe it won't be a good idea to have the SAME DMZ IDS system with another NIC monitoring Inside Network Traffic ?

  Any other suggestions OR any Links that I can refer to ?

Regards \\ Naman Received on Fri Jan 31 19:05:27 2003