similar to: [Fwd: CERT Advisory CA-2003-13 Multiple Vulnerabilities in Snort Preprocessors]

FYI Kris ----- Forwarded message from Kris Kennaway <kris@FreeBSD.org> ----- X-Original-To: kkenn@localhost Delivered-To: kkenn@localhost.obsecurity.org Delivered-To: kris@freebsd.org Delivered-To: ports-committers@freebsd.org From: Kris Kennaway <kris@FreeBSD.org> Date: Thu, 17 Apr 2003 14:45:03 -0700 (PDT) To: ports-committers@FreeBSD.org, cvs-ports@FreeBSD.org,

----- Forwarded message from Louis Kowolowski <louisk@bend.com> ----- Date: Thu, 28 Aug 2003 11:37:42 -0700 From: Louis Kowolowski <louisk@bend.com> To: freebsd-security@freebsd.org Subject: snort, postgres, bridge User-Agent: Mutt/1.5.4i I've been prowling through the FreeBSD and Snort list archives in search of information on setting up snort on a FreeBSD bridge(4) that logs

I first met this problem when our (60 students) internetgateway refused to boot its new kernel, it was a 4.7-RELEASE. Then i loaded the old kernel and went home to check if my 4.8-STABLE does likewise. And the answer was yes! Both kernels were GENERIC + these options taken from the dummynet man pages: options DUMMYNET options NMBCLUSTERS options HZ When i boot the machine

Dear all, I''m setting up a new gateway for a small network (under 30 users)Gw will host the following services:shorewalldnsproxy i''m considering installing snort.can i do so on the same exact box ? is there any security risk of doing so ? box would have 4 ISPs and two internal interfaces. Any recommendation about the optimal setup of snort and shorewall (or if you suggest

Hello all: I tried to install snort under /usr/ports/security and have some problems. with "make all", I checked every item on the menu but I got error messages: ////////////////////////////// laptop# make all ===> snort-2.8.1_1 is marked as broken: FLEXRESP2 patch file does not incorporate cleanly. *** Error code 1 Stop in /usr/ports/security/snort.

I made an atempt to run snort_inline and shorewall on the same system but I could not get snort to see the packets. Maybe someone with a little more iptables knowledge could tell me what I''m doing wrong or if its possible to have the systems setup so that it places packets that the firewall would allow into QUEUE. After setting up and starting shorewall I then issue the following

hello list, i''ve set up shorewall and snort inline on a linux box. it works, but snort only sees traffic from new connections. and this is because shorewall automatically generates rules to accept established and related connections. how can i force shorewall to queue everything, so that snort can scan the hole traffic like in IDS mode. The setup i have now is really simple, just 2 zones

Hello Folks, I have used FreeBSD-4.8-RC and apache 1.3.2x. In some days,my dmesg has shown as the lines; pid 9229 (httpd), uid 80: exited on signal 11 pid 10106 (httpd), uid 80: exited on signal 11 pid 9842 (httpd), uid 80: exited on signal 11 pid 35708 (httpd), uid 80: exited on signal 11 pid 9371 (httpd), uid 80: exited on signal 11 pid 10337 (httpd), uid 80: exited on

Plus I would like to let you know that it works like a charm. Snort can now see those packets. -----Original Message----- From: shorewall-users-bounces@lists.shorewall.net [mailto:shorewall-users-bounces@lists.shorewall.net] On Behalf Of Thibodeau, Jamie L. Sent: Wednesday, March 30, 2005 9:25 AM To: Mailing List for Shorewall Users Subject: RE: [Shorewall-users] Shorewall and an inline

Take the usual precautions when upgrading. Also note that I have changed some configuration defaults: the server no longer accepts protocol version 1 nor password authentication by default. If your ssh client does not support ssh protocol version 2 or keyboard-interactive authentication, the recommended measures are: 1) get a better client 2) get a better client (I mean it) 3) get a better

hello all! i've installed gcc-3.2 about a month ago and put "USE_GCC=3.2" into /etc/make.conf. now "make clean" for any of ports leads to smth like Apr 18 12:38:54 alc /kernel: swap_pager: out of swap space Apr 18 12:38:54 alc /kernel: swap_pager_getswapspace: failed Apr 18 12:38:54 alc /kernel: pid 219 (XFree86), uid 0, was killed: out of swap space "ps ax"

I've been prowling through the FreeBSD and Snort list archives in search of information on setting up snort on a FreeBSD bridge(4) that logs to a remote postgres box via a third interface (hme0) Snort is being started with the following command: /usr/local/bin/snort -A full -D -e -d -s -i fxp0 -c /usr /local/etc/snort.conf Where fxp0 and fxp1 are in the bridge output from sysctl:

You are awesome!!!! -----Original Message----- From: shorewall-users-bounces@lists.shorewall.net [mailto:shorewall-users-bounces@lists.shorewall.net] On Behalf Of Tom Eastep Sent: Wednesday, March 30, 2005 9:11 AM To: Mailing List for Shorewall Users Subject: Re: [Shorewall-users] Shorewall and an inline IDS (snort-inlineorhogwash) Tom Eastep wrote: > Thibodeau, Jamie L. wrote: >

Hi all, I need to monitor all traffic and block bad requests on my guest machines and also on my xen host. To accomplish this I think to install snort on my dom0 host (rhel5). Somebody have tried this? What about performance on guests?? Many thanks ... -- CL Martinez carlopmart {at} gmail {d0t} com _______________________________________________ Xen-users mailing list

Is anyone using an inline IDS like hogwash or snort-inline to drop packets in a system running shoreline? I _think_ I see how to configure it, but I''d be really interested in finding a howto or something... Thanks! Mike- -- Mornings: Evolution in action. Only the grumpy will survive. -- Please note - Due to the intense volume of spam, we have installed site-wide spam filters at

Dear Friends, I need to know, if RPM SNORT on repository DAG include option flexresp. Thanks Adriano

Question to the list, Has anyone here had experience using Shorewall (multi-isp configuration) with Snort inline? First, is this possible? Second, if anyone has done this, what documentation, if any did they use to set it up? Third, does snort have to run inline on a firewall (I''m under the impression it does)?

Hi Everyone, Can anyone confirm if a xen based domU can be used for snort setup? It is not for commercial use, rather just SOHO use. Regards, dot.yet _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users

Hi Everyone, Can anyone confirm if a xen based domU can be used for snort setup? It is not for commercial use, rather just SOHO use. Regards, dot.yet _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users

I want to use snort inline for ips and imq for bandwidth shaping When i have inserted imq module ip_queue module insertion giving error Is it possible to use both at the same time -- Failure seldom stops you. What stops you is the fear of failure. _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc