Database and http rules questions.

["Brei, Matt" <mbrei () medclaiminc com>]

Greetings,

 

I was wondering.  We have an office in NC and MT both will be using
Snort.  Can I have each site log to the same MySQL database and have
each site display as a different sensor?  Also, I'm not sure if snort is
the best way to go about it, but, I need to have some way of blocking
all but a few websites for most users, and allow anything for the
others.  I was thinking I could set the users that have full web access
to static IPs, block all destination port 80, and then put a pass rule
for the user's IPs that have full access and for the IP of the allowed
sites.  If there is a better way of doing this, please let me know.

 

Thank you,

 

Matt Brei

Network Administrator