Instrusion Detection System ?

[mike2010]

Hello, im looking to finally install an IDS on my server. Any good recommendations out there ?

Almost every google search I do on the subject, Snort comes up.

L.I.D.S seems to be another popular one.

I'd like something thats pretty basic to understand , install , and effective at the same time.

Any info is much appreciated. ( I kinda wish Plesk had an intergrated program for this )

 

[Hultenius]

Maybe OSSEC is something for you?
We use it on some servers (part of Atomic Secured Linux) and it does the job.

 

[mike2010]

Maybe OSSEC is something for you?
We use it on some servers (part of Atomic Secured Linux) and it does the job.

Thanks Hult. I didn't see any mention if it covers CentOs and Qmail though.

Was it easy to install... and does it have a decent graphical interface ?

Its either this or Snort.

 

[atomicturtle]

ASL covers CentOS/RHEL and Fedora. It has a web interface and integrates well with plesk: http://www.atomicrocketturtle.com/gallery2/main.php?g2_itemId=604

For snort, id check out base, or ossim.

 

[mike2010]

ASL covers CentOS/RHEL and Fedora. It has a web interface and integrates well with plesk: http://www.atomicrocketturtle.com/gallery2/main.php?g2_itemId=604

For snort, id check out base, or ossim.

turtle, does this have a virus checker as well ? their telling me I should install CLAM AV before the IDS...

How hard is ASL to install ? Is there a cost ?

Do you think it'll ever be intergrated into Plesk with a future update? my tech guys keep telling me how crappy Watchdog is with all the false positives.

I have the Yum repositories installed...and latest version of Plesk as well.

sorry for the million questions.

MB

 

[atomicrocketturtle]

turtle, does this have a virus checker as well ? their telling me I should install CLAM AV before the IDS...

How hard is ASL to install ? Is there a cost ?

Do you think it'll ever be intergrated into Plesk with a future update? my tech guys keep telling me how crappy Watchdog is with all the false positives.

I have the Yum repositories installed...and latest version of Plesk as well.

sorry for the million questions.

MB

Yes, it uses clamav and our clamav rules feed. Uploads over HTTP and FTP are scanned automatically.

ASL has an automated installer, it uses yum on the backend and integrates with the update system provided by the vendor. The cost is 158$/year for each server, or 299$/year for a 5 pack for virtual servers.

It integrates with plesk now, and has a process monitor. By default it watches services like apache, bind, etc. You can expand this to watch other processes as well.

 

[mike2010]

Is there a way to download it to PC first ? Is there a free trial ?

Also, I just noticed I need Zend Optimizer for another program i'm about to install.

Turtle, you know offhand if 'Yum Updates' will update that as well...once its installed & updates are needed ?

thx much

 

[atomicturtle]

We don't have a trial version yet, but we're pretty close.

for zend optimizer, we literally put out packages for 3.3.9 the other day. Once you have the atomic repo set up you can add it with:

yum install php-zend-optimizer