Snort mailing list archives
Re: Snort start up on Multiple interface
From: Matt Kettler <mkettler () evi-inc com>
Date: Wed, 28 Apr 2004 17:23:08 -0400
At 04:40 PM 4/28/2004, Edin Dizdarevic wrote:
> You mean you don't chroot your snort instances? :) Why should I do that on an SELinux? ;)
Clearly you're not sufficiently paranoid, as a good SELinux user would chroot anyway. After all, mistakes can be made in MAC configurations :)
They'd also: use a read-only network tap make sure the kernel is compiled without loadable module support compile snort with some form of stack-overflow detector enhanced gccmake sure that snort box was not able to talk to hosts outside your network, not even for http download, no matter what user tries. (ie: firewall enforced) make sure the snort box cannot relay email through your mailserver to hosts outside your network. make sure the snort box cannot perform DNS resolution of outside zones (dig www.snort.org should fail). wrap the entire machine in 5 layers of copper foil, making sure to cover up the LEDs, monitor, and keyboard in the process disconnect the machine from all power or network connections and burry it in 6 feet of concrete with no cables coming out.
But it's all a matter of how paranoid you want to be. My real point is that it never hurts to be oversecure unless you're loosing functionality you need.
Clearly chrooting under selinux is a bit redundant, but it doesn't hurt useful functionality, and protects you from mistakes so it does add some security.
------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10gGet certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort start up on Multiple interface Brian Webster (Apr 27)
- Message not available
- Re: Snort start up on Multiple interface Matt Kettler (Apr 27)
- Re: Snort start up on Multiple interface Daniel Wittenberg (Apr 27)
- Re: Snort start up on Multiple interface Edin Dizdarevic (Apr 28)
- Re: Snort start up on Multiple interface Matt Kettler (Apr 28)
- Re: Snort start up on Multiple interface Edin Dizdarevic (Apr 28)
- Re: Snort start up on Multiple interface Matt Kettler (Apr 28)
- Re: Snort start up on Multiple interface Edin Dizdarevic (Apr 28)
- Re: Snort start up on Multiple interface Milo Velimirovic (Apr 29)
- Re: Snort start up on Multiple interface Matt Kettler (Apr 27)
- Message not available
- <Possible follow-ups>
- RE: Snort start up on Multiple interface Truax, Shawn (MBS) (Apr 27)