4

I want the maximum security for my linux vps. I found many tutorials round the net but it doesn't cover the Snort. Only those like portentry, logsentry, tripwire and so on.

So I'm beginning to think that Snort is not appropriate for a linux host. I think it's suitable only as a proxy/middle-man that checks traffic before passing to acutual targets.

I'd like to ask whether Snort can be installed on VPS which serves typical servers like web/mail.

Can Snort be in complict with OSSEC which I think it doesn't check the traffic but the log files only for Intrusion Detection/Anomaly?

Thank you.

Improve this question
2
  • snort would be useless if the attacker has inundator.sourceforge.net generates false positives uses the snort rules, updates via the oinkmaster
    – baj
    Jan 26, 2011 at 9:31
  • ModSecurity with IPTABLES would be better solution, as you are not passing any high bandwidth traffic snort is designed for (tap mode).
    – Andrew Smith
    Aug 17, 2012 at 20:10

4 Answers 4

Reset to default
2

Snort can be pretty memory hungry, which on a VPS may be a problem. It can run alongside ossec quite nicely - the two are both included in Ossim which correlates infosecurity events from various sources.

I'd argue that it is probably overkill for a single VPS though. If you keep all your software updated against any security releases, have good configuration settings, use tripwire and monitor logs then you're doing a really good job. And if you are protecting an entire network then I'd consider running ossim on a dedicated box.

If you're using Apache then consider mod_security to help protect potentially vulnerable scripts you are hosting. And finally be proactive in the security, scanning your box for vulnerabilities with something like Nessus.

Improve this answer
0

Snort can be configured as a HIDS (Host Intrustion Detection System).

The most important configuration that you'll need is this:

Home_net -> server.IP
External_net -> !$HOME_NET

Snort can monitor some of the host system resources with the proper signatures, however, OSSEC should fit your needs as everything with less overhead.

Improve this answer
0

I think ShoreWall doesn't use much resources like Snort. http://www.shorewall.net/

Improve this answer
0

If you want the right IDS for your VPS, you should look for an HIDS

Snort is a NIDS, it's a really good piece of software (my personal favorite IDS), but it's for other purposes, you should implement a Host Intrusion Detection System (HIDS) like OSSEC, not only is a more efficient solution, but also offers several ways to check more specific features that are more usable on Hosts (USB port, files monitoring, etc.). You'll be wasting all the power and resources of Snort, OSSEC can guard you server in a more simple way.

Improve this answer

You must log in to answer this question.