Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want the maximum security for my linux vps. I found many tutorials round the net but it doesn't cover the Snort. Only those like portentry, logsentry, tripwire and so on.

So I'm beginning to think that Snort is not appropriate for a linux host. I think it's suitable only as a proxy/middle-man that checks traffic before passing to acutual targets.

I'd like to ask whether Snort can be installed on VPS which serves typical servers like web/mail.

Can Snort be in complict with OSSEC which I think it doesn't check the traffic but the log files only for Intrusion Detection/Anomaly?

Thank you.

share|improve this question
snort would be useless if the attacker has generates false positives uses the snort rules, updates via the oinkmaster – baj Jan 26 '11 at 9:31
ModSecurity with IPTABLES would be better solution, as you are not passing any high bandwidth traffic snort is designed for (tap mode). – Andrew Smith Aug 17 '12 at 20:10

Snort can be pretty memory hungry, which on a VPS may be a problem. It can run alongside ossec quite nicely - the two are both included in Ossim which correlates infosecurity events from various sources.

I'd argue that it is probably overkill for a single VPS though. If you keep all your software updated against any security releases, have good configuration settings, use tripwire and monitor logs then you're doing a really good job. And if you are protecting an entire network then I'd consider running ossim on a dedicated box.

If you're using Apache then consider mod_security to help protect potentially vulnerable scripts you are hosting. And finally be proactive in the security, scanning your box for vulnerabilities with something like Nessus.

share|improve this answer

Snort can be configured as a HIDS (Host Intrustion Detection System).

The most important configuration that you'll need is this:

Home_net -> server.IP
External_net -> !$HOME_NET

Snort can monitor some of the host system resources with the proper signatures, however, OSSEC should fit your needs as everything with less overhead.

share|improve this answer

I think ShoreWall doesn't use much resources like Snort.

share|improve this answer

If you want the right IDS for your VPS, you should look for an HIDS

Snort is a NIDS, it's a really good piece of software (my personal favorite IDS), but it's for other purposes, you should implement a Host Intrusion Detection System (HIDS) like OSSEC, not only is a more efficient solution, but also offers several ways to check more specific features that are more usable on Hosts (USB port, files monitoring, etc.). You'll be wasting all the power and resources of Snort, OSSEC can guard you server in a more simple way.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.