Re: Setting up an IDS system

1. Depending on how you set it up, I would say yes, also limit the users that can log in remotely. also concider using a remote log tool, such as remote syslogd, to avoid that need
2. none and yes. Ideally, you don't want the IDS station to be seen at all from the outside, concider using a one-way ethernet cable (recieve no-send) on the listening interface. Of course for this, you would need a second interface to connect to your network for either remote log-in or remote syslogd or whatever logging facility you're using
3. It is a good idea, I don't remember the statistic right now, but a large percentage of all attacks come from inside your network. Once again, ideally, the internal IDS shouldn't be detectable, but I see no problems running it physically on the same box on a seperate interface, provided you're using the afore-mentioned one-way ethernet cable.

Other suggestions, Nothing comes to mind, but depending on the size and topology of your network, you may want to carfully concider where you want to put internal IDSs.

On Fri, Jan 31, 2003 at 09:34:19AM -0800, Naman Latif wrote:
>
> Hi,
> I am in the process of setting up and IDS system using Linux\Snort in

-- 
Frank Barton
Starwolf.biz Systems Administrator