Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Years back we set up an IDS solution by placing a tap in front of our exterior firewall, piping all the traffic on our DS1 through an IDS box and then sending the results off to a logging server running ACiD. This was around 2005-ish. I've been asked to revamp the solution and expand on it and looking around, I see that the last release of ACiD was from 2003 and I can't seem to find anything else that seems even remotely up-to-date. While these things may be feature complete, I worry about library conflicts, etc. Can anyone give me suggestions for a Linux/OpenBSD based solution using somewhat modern tools?

Just to be clear, I know that Snort is still actively developed. I guess I'm more in the market for a modern open-source web console to consolidate the data. Of course if people have great experiences with IDS' other than Snort I'm happy to hear about it.

share|improve this question

3 Answers 3

up vote 5 down vote accepted

I think the best open source combinations are:

For NIDS: Snort with BASE for the web ui

For HIDS: OSSEC

I also use OSSEC to consolidade the NIDS data into a single place (like a SIEM OSSEC does log analysis, file integrity checking and rootkit detection).

Links: http://www.snort.org http://www.ossec.net http://base.secureideas.net/

share|improve this answer
    
Exactly what I was looking for. Thank you! –  MattC Oct 28 '09 at 16:58

OSSIM.

OSSIM consolidates all that kind of stuff. OSSEC, Snort, etc.

Open source & Free.

OSSIM has the following software components:

Arpwatch – used for MAC anomaly detection.
P0f – used for passive OS detection and OS change analysis.
Pads – used for service anomaly detection.
Nessus – used for vulnerability assessment and for cross correlation (IDS vs Security Scanner).
Snort – the IDS, also used for cross correlation with nessus.
Spade – the statistical packet anomaly detection engine. Used to gain knowledge about attacks without signatures.
Tcptrack – used for session data information which can prove useful for attack correlation.
Ntop – which builds an impressive network information database from which we can identify aberrant behavior/anomaly detection.
Nagios – fed from the host asset database, it monitors host and service availability information.
Osiris – a great HIDS.
OCS-NG – cross-platform inventory solution.
OSSEC – integrity, rootkit, registry detection, and more.

http://www.alienvault.com/community.php?section=Home

-Josh

share|improve this answer
    
This is a huge help. Thank you! –  MattC Oct 28 '09 at 16:58

You can use a open-source and free solution based on Prelude-IDS http://www.prelude-ids.com/

  • Prelude IDS is a SIM (Security Information Management) system / IDS Framework.

  • Snort can be used as NIDS

  • Prelude LML as HIDS : rulesets for SSH, Cisco PIX, Netfilter IPFW, Postfix, Sendmail...

  • Prewikka is is the official Prelude User Interface : Web GUI based on Python => https://dev.prelude-ids.com/wiki/prelude/ManualPrewikka

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.