Text 26642, 65 rader
Skriven 2015-05-02 20:08:37 av mark lewis (1:3634/12.0)
  Kommentar till text 26630 av Sean Dennis (1:18/200)
Ärende: IDS/IPS rules was:Outpost
=================================
 On Sat, 02 May 2015, Sean Dennis wrote to mark lewis:

 ml> my application with the IDS/IPS could be used to manage the 
 ml> entries in denyhosts... it is actually used to manage iptables 
 ml> rules, though...

 SD> For me, denyhosts has worked fine.  I have SSH open because you 
 SD> can connect to MBSE that way with it (and I have some callers who 
 SD> are waiting for me to have that set up), so it's a "necessary 
 SD> evil"). If I get the time, I'll set up fail2ban but the newest 
 SD> version is overly complicated with configuration, IMNSHO.

i never did like f2b and that mainly because it has to parse the log files
whereas an IDS/IPS reads the network traffic and acts there... logging comes
later... but whatever works to keep the miscreatents out...

plus an IDS/IPS also can tell you about and block other traffic like emails
with PDFs carrying malware or hidden bots and the like... they do a whole lot
more detections at the raw packet level than anything else on the market...

 ml> NAT or not shouldn't matter if your tools are looking at the WAN side
 ml> NIC before anything is done to the packets...

 SD> Nope, I'm behind someone else's router.

shouldn't matter... it'll also keep your network safe in case their's gets
infested with something ;) 

 SD> I board and I use the house's Internet connection for now.  It's 
 SD> not ideal as the person whose router is being used is really 
 SD> particular about things.

i know how that can be :) 

 SD> Once my financial situation improves, I'll get my own separate 
 SD> connection in here and run things my way.  My BBS is completely 
 SD> inside the LAN, however, now that I think about it, I could have 
 SD> the pfsense box set up on the DMZ...

that's a good option...

 ml> no... i allow connections from everywhere until they specifically 
 ml> break one of the IDS/IPS rules... the only reason i have a white 
 ml> list

 SD> 8< snipped for brevity >8

 SD> That I can completely understand.  However, I do not use the NTP
 SD> pool (ntp.org) for the very reasons you specify. I use 
 SD> time-c.nist.gov for my NTP stuff. There's a list of time.gov 
 SD> servers at http://tf.nist.gov/tf-cgi/servers.cgi -- you can just 
 SD> use time.nist.gov if you don't mind using a "round robin" kind of 
 SD> thing...and you avoid the very problems you're having. :)

yes, i use them, too... the problem comes when they want 1st or 2nd tier
connections only... i think that was one of the things i've run into in the
past... that and that at least one of the tools i use for time sync uses one of
the older time protocols which some sites are not allowing... then there's the
dozen or more that i was using that simply disappeared or blocked my
connections... oh well... as long as the time servers on my networks can keep
good time and sync when they are configured to sync, everything is ok :) 

)\/(ark

 * Origin:  (1:3634/12)