Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want the maximum security for my linux vps. I found many tutorials round the net but it doesn't cover the Snort. Only those like portentry, logsentry, tripwire and so on.

So I'm beginning to think that Snort is not appropriate for a linux host. I think it's suitable only as a proxy/middle-man that checks traffic before passing to acutual targets.

I'd like to ask whether Snort can be installed on VPS which serves typical servers like web/mail.

Can Snort be in complict with OSSEC which I think it doesn't check the traffic but the log files only for Intrusion Detection/Anomaly?

Thank you.

share|improve this question
    
ModSecurity with IPTABLES would be better solution, as you are not passing any high bandwidth traffic snort is designed for (tap mode). –  Andrew Smith Aug 17 '12 at 20:10
add comment

4 Answers 4

Snort can be pretty memory hungry, which on a VPS may be a problem. It can run alongside ossec quite nicely - the two are both included in Ossim which correlates infosecurity events from various sources.

I'd argue that it is probably overkill for a single VPS though. If you keep all your software updated against any security releases, have good configuration settings, use tripwire and monitor logs then you're doing a really good job. And if you are protecting an entire network then I'd consider running ossim on a dedicated box.

If you're using Apache then consider mod_security to help protect potentially vulnerable scripts you are hosting. And finally be proactive in the security, scanning your box for vulnerabilities with something like Nessus.

share|improve this answer
add comment

snort would be useless if the attacker has

http://inundator.sourceforge.net/

generates false positives uses the snort rules, updates via the oinkmaster

share|improve this answer
add comment

Snort can be configured as a HIDS (Host Intrustion Detection System).

The most important configuration that you'll need is this:

Home_net -> server.IP
External_net -> !$HOME_NET

Snort can monitor some of the host system resources with the proper signatures, however, OSSEC should fit your needs as everything with less overhead.

share|improve this answer
add comment

I think ShoreWall doesn't use much resources like Snort. http://www.shorewall.net/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.