Displaying 20 results from an estimated 100 matches similar to: "intrusion detection system"
2004 Oct 19
2
new intrusion detection system
Hello to all,
I have implemented a new type of intrusion detection system for my Master
thesis. I would like to announce this information, in case anyone would be
interested in this research.
The IDS system is designed as a kernel module for FreeBSD 5.2. It is inspired
by the SpamAssassin program, which detects spam by applying a set of tests to
every email message and counting a sum of
2020 Apr 01
0
Can't block intrusion
D'Arcy Cain <darcy at VybeNetworks.com> writes:
> I have a script that checks for things like this and adds them to my
> packet filter (pf). Everything seems to work up to a point. The IP
> address gets added to my AUTOBLOCK table. The second rule, right after
> the friends whitelist, blocks any IP in that table. If I try to ping or
> traceroute to it I can't get
2020 Apr 01
0
Can't block intrusion
D'Arcy Cain <darcy at VybeNetworks.com> writes:
> Here is the first four lines from "pfctl -sr":
>
> pass in quick on bge0 from <FRIENDS> to any flags S/SA keep state
> block drop in log quick on bge0 from <ENEMIES> to any
> block drop in log quick on bge0 from <AUTOBLOCK> to any
> block drop out log quick on bge0 from any to
2020 Apr 01
0
Can't block intrusion
On 2/04/2020 5:28 AM, Mark Boyce wrote:
> On 1 Apr 2020, at 22:14, Greg Troxel <gdt at lexort.com
> <mailto:gdt at lexort.com>> wrote:
>>
>> I think you need to use tcpdump and turn up firewall debugging.
>
> sngrep is your friend …My bet is UDP vs TCP on firewall rules :-)
>
> Mark
Or the stateful entry still exists when the table entry is updated.
2020 Apr 01
0
Can't block intrusion
On 2020-04-01 16:28, Mark Boyce wrote:
> On 1 Apr 2020, at 22:14, Greg Troxel <gdt at lexort.com
> <mailto:gdt at lexort.com>> wrote:
>>
>> I think you need to use tcpdump and turn up firewall debugging.
>
> sngrep is your friend …My bet is UDP vs TCP on firewall rules :-)
block drop in log quick on bge0 from <AUTOBLOCK> to any
block drop out log quick
2020 Apr 02
0
Can't block intrusion
On 2020-04-02 08:01, Larry Moore wrote:
> I suspect you have a good understanding of pf.
Pretty good I think. As with everything I am always willing to learn more.
> Have you included in your script running 'pfctl -k <ip_address>' to kill
> any states that may exists after you update your <AUTOBLOCK> table?
I haven't yet because I want to watch the effect of
2006 Apr 25
2
firewall based antivirus/trojan blocking and intrusion detection [dnk]
Can anyone recommend an opensource package (preferably something centos 4X compatible)
that can be used on a (iptables) firewall to block virus/trojan, etc? And maybe
something for intrusion detection?
Thanks!
Dnk
2020 Apr 22
0
Recommendations on intrusion prevention/detection?
On 2020-04-22 18:45, Sami Ketola wrote:
> Actually by far the biggest source of stolen credentials is
> viruses/trojans harvesting them.
i tryed blacklist all ips that got passwords errors, but that ends in
big shorewall blrules so i turn it over to just add whitelist into
blrules where ips is known custommers that dont abuse server, that way
my shorewall got alot smaller config files
2020 Apr 22
1
Recommendations on intrusion prevention/detection?
<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div>
<br>
</div>
<blockquote type="cite">
<div>
On 22/04/2020 19:56 Benny Pedersen <
<a href="mailto:me@junc.eu">me@junc.eu</a>> wrote:
</div>
<div>
<br>
2020 Apr 22
0
Recommendations on intrusion prevention/detection?
On 2020-04-22 5:29 a.m., Johannes Rohr wrote:
> Dear all,
>
> what are the key strategies for intrusion prevention and detection with
> dovecot, apart from installing fail2ban?
> It is a pity that the IMAP protocol does not support 2 factor
> authentication, which seems to stop 90% of intrusion attempts in their
> tracks. Without it, if someone has obtained your password and
2005 Jan 08
1
OSX Intrusion Suspected, Advice Sought
JohnG <mcsjgs@cox.net> wrote:
> I run OS X 10.3.7 on a PowerMac MDD G4 on a cable broadband connection.
> I have reason to think my system has been tampered with. Security
> features in Mac OS X have been left unlocked (Preference Pane - Users)
OSX is substantially different from FreeBSD (even without netinfo)
despite having some of the same source code. I doubt you'll find
2014 Feb 08
0
Asterisk intrusion detection/prevention, georgaphic IP banning, etc. (new software)
I'm looking for some beta testers to provide feedback on an Asterisk intrusion detection & prevention program we're releasing soon.
As a quick overview, the program provides:
- banning based on geographic location of source IP (Continent, country, region, city, etc)
- detection and banning based on channels in use by a user
- detection and banning based on rate of dialing
- detection
2020 Apr 01
2
Can't block intrusion
On 2020-04-01 15:12, Greg Troxel wrote:
> D'Arcy Cain <darcy at VybeNetworks.com> writes:
> But yet, new packets from that IP address reach asterisk. It seems
> almost entirely clear to me that you have a firewall problem, not an
> asterisk problem.
This could well be but Asterisk is the only thing that continues to
communicate.
> I would test this out with a remote
2008 Aug 22
0
CentOS position on systems intrusion at Red Hat
Earlier in the day today Red Hat made an announcement [1] that there had been an
intrusion into some of their computer systems last week. In the same
announcement they mention that some of the packages for OpenSSH on RHEL-4 ( i386
and x86_64 ) as well as RHEL-5 ( x86_64 ) were signed by the intruder. In their
announcement they also clarified that they were confident that none of these,
potentially
2008 Aug 22
0
CentOS position on systems intrusion at Red Hat
Earlier in the day today Red Hat made an announcement [1] that there had been an
intrusion into some of their computer systems last week. In the same
announcement they mention that some of the packages for OpenSSH on RHEL-4 ( i386
and x86_64 ) as well as RHEL-5 ( x86_64 ) were signed by the intruder. In their
announcement they also clarified that they were confident that none of these,
potentially
2020 Apr 22
2
Recommendations on intrusion prevention/detection?
> On 22. Apr 2020, at 19.14, Michael Peddemors <michael at linuxmagic.com> wrote:
> The three most common attack vectors, (and attack volumes have never been higher) are:
>
> * Sniffed unencrypted credentials
> (Assume every home wifi router and CPE equipment are compromised ;)
> * Re-used passwords where data is exposed from another site's breach
> (Users WANT to
2007 Sep 26
4
Intrusion Detection Systems
Situation: We are providing hosting services.
I've grown tired of the various kiddie scripts/dictionary attacks on
various services. The latest has been against vsftpd, on systems that I
can't easily control vs. putting strict limits on ssh. We simply have
too many users entering from too many networks many with dynamic IP
addresses.
Enter.... thinking about LIDS or Log Based
2004 Oct 13
1
follow-up on ISA intrusion detection
Hi, I wrote a mail a few days ago concerning my setup with a front/back
firewall, shorewall being front and ISA server 2004 acting as back
firewall.
I said that ISA server is logging some "intrusion attempts" namely
requests coming from external interface to the internal network.
As this shouldn''t happen (all intrusion attempts should be stopped by
shorewall) I begun to
2020 Apr 02
2
Can't block intrusion
On 2/04/2020 6:35 AM, D'Arcy Cain wrote:
> On 2020-04-01 16:28, Mark Boyce wrote:
>> On 1 Apr 2020, at 22:14, Greg Troxel <gdt at lexort.com
>> <mailto:gdt at lexort.com>> wrote:
>>> I think you need to use tcpdump and turn up firewall debugging.
>> sngrep is your friend …My bet is UDP vs TCP on firewall rules :-)
> block drop in log quick on bge0
2020 Apr 01
2
Can't block intrusion
I am running Asterisk 16.9 on FreeBSD 12.1-RELEASE-p1. I keep seeing
lines like this in my logs.
[Apr 1 13:30:33] NOTICE[101155][C-00004526] chan_sip.c: Call from ''
(45.143.220.235:5356) to extension '2037' rejected because extension not
found in context 'unauthenticated'.
I have a script that checks for things like this and adds them to my
packet filter (pf).