Depending on your interests and needs, you may also wish to enable or tune some of the Snort preprocessors that are designed to respond to various threats. IP defragmentation and TCP stream reassembly are enabled by default, to detect denial of service attacks and to support the other preprocessors. If you are being subjected to anti-NIDS attacks such as noise generators that attempt to overwhelm Snort with a flood of alert-inducing traffic, use: # snort -z est ... 1 1
to limit alerts to known, established connections only. Several preprocessors are available to defeat attempts to escape detection during attacks on specific protocols. These often take the form of path name or instruction sequence mutations, and the preprocessors work to convert the input streams into a canonical form that can be more readily recognized by the pattern matching rules. Port scans are noticed by preprocessors that watch a range of protocols over time. Finally, a variety of output plugins can direct alerts to databases, XML files, SNMP traps, a local Unix socket, or even WinPopup messages on Windows workstations, using Samba. Many of these features are experimental, or require special configuration options when Snort is installed; consult the documentation in the source distribution for details. Whenever you modify the Snort configuration or add or customize rules, use the -T option to verify that your changes are correct. This will prevent Snort from dying unexpectedly when it next restarts, e.g., at boot time. 9.26.4 See Also snort(8). The Snort home page is . The Honeynet project's web site, , contains a wealth of information about network monitoring, including Snort. See for a sample Snort configuration file. [ Team LiB ] 2 2
[ Team LiB ] Recipe 9.27 Directing System Messages to Log Files (syslog) 9.27.1 Problem You want to configure the system logger to use an organized collection of log files. 9.27.2 Solution Set up /etc/syslog.conf for local logging: /etc/syslog.conf: "docText">After you modify /etc/syslog.conf , you must send a signal to force syslogd to reread it and apply your changes. Any of these will do: # kill -HUP `pidof syslogd` or: # kill -HUP `cat /var/run/syslogd.pid` or: # /etc/init.d/syslog reload or: # service syslog reload Red Hat 9.27.3 Discussion When your kernel needs to tell you something important, will you notice? If you are investigating a potential break-in last night, will you have all of the information you need? Staying informed requires careful configuration and use of the system logger. The system logger collects messages from programs and even from the kernel. These messages are tagged with a facility that identifies the broad category of the source, e.g., mail , kern (for kernel messages), or authpriv (for security and authorization messages). In addition, a priority specifies the importance (or severity) of each message. The lowest priorities are (in ascending order) debug , info , and notice ; the highest priority is emerg , which is used when your disk drive is on fire. The complete set of facilities and priorities are
You've reached the end of your free preview.
Want to read all 566 pages?
- Spring '14
- Computer Security, Secure Shell, Tripwire