Can Suricata be used as an effective IPS on a single server?Web server hosting infrastructure, does IPS help?What Web Server Was Used Before ApacheWhat is an effective file server setup?How can I auto-block IPs attacking my server?Low cost single-board computer as a web serverDuplicate GET request from multiple IPs - can anyone explain this?Lean but effective linux IDS / IPS / WAF?Can IPS monitor both inbound and outbound traffic?Can I use same suricata instance for both IDS (for L3,4) and IPS (for L3,L4,L7)?How can I put snort in front of nginx server
Was Dennis Ritchie being too modest in this quote about C and Pascal?
How to find if a column is referenced in a computed column?
Nails holding drywall
Restricting the options of a lookup field, based on the value of another lookup field?
Does the damage from the Absorb Elements spell apply to your next attack, or to your first attack on your next turn?
Retract an already submitted recommendation letter (written for an undergrad student)
How much of a wave function must reside inside event horizon for it to be consumed by the black hole?
Multiple options vs single option UI
What was Apollo 13's "Little Jolt" after MECO?
Which big number is bigger?
Drawing a german abacus as in the books of Adam Ries
Check if a string is entirely made of the same substring
Prove that the countable union of countable sets is also countable
Is there really no use for MD5 anymore?
A Note on N!
What *exactly* is electrical current, voltage, and resistance?
Creating a chemical industry from a medieval tech level without petroleum
Why did Rep. Omar conclude her criticism of US troops with the phrase "NotTodaySatan"?
What is the best way to deal with NPC-NPC combat?
"My boss was furious with me and I have been fired" vs. "My boss was furious with me and I was fired"
Double-nominative constructions and “von”
How to not starve gigantic beasts
My bank got bought out, am I now going to have to start filing tax returns in a different state?
How to keep bees out of canned beverages?
Can Suricata be used as an effective IPS on a single server?
Web server hosting infrastructure, does IPS help?What Web Server Was Used Before ApacheWhat is an effective file server setup?How can I auto-block IPs attacking my server?Low cost single-board computer as a web serverDuplicate GET request from multiple IPs - can anyone explain this?Lean but effective linux IDS / IPS / WAF?Can IPS monitor both inbound and outbound traffic?Can I use same suricata instance for both IDS (for L3,4) and IPS (for L3,L4,L7)?How can I put snort in front of nginx server
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I've been looking for an effective intrusion prevention system (IPS) for an Ubuntu 14.04 server, something like what Symantec or F-Prot might offer for a Windows server. I've contacted major companies which say they support products for Ubuntu and other Linux distros, but they end up being anti-virus only and do not offer any protection against known vulnerabilities.
I found documentation about Snort and Suricata combined with rule managers like PulledPork and OinkMaster, but as I got deeper into it it seemed to me that these were meant to turn a server into a dedicated hardware IPS solution for a network.
- Can Suricata be used instead on an existing web server to simply provide intrusion prevention for that server?
- Is there a sample configuration available for this scenario?
- Would doing this slow performance down such that it would be inadvisable?
ubuntu web-server snort ids ips
asked Jun 22 '17 at 17:14
Christopher HinkleChristopher Hinkle
264
add a comment |
I've been looking for an effective intrusion prevention system (IPS) for an Ubuntu 14.04 server, something like what Symantec or F-Prot might offer for a Windows server. I've contacted major companies which say they support products for Ubuntu and other Linux distros, but they end up being anti-virus only and do not offer any protection against known vulnerabilities.
I found documentation about Snort and Suricata combined with rule managers like PulledPork and OinkMaster, but as I got deeper into it it seemed to me that these were meant to turn a server into a dedicated hardware IPS solution for a network.
- Can Suricata be used instead on an existing web server to simply provide intrusion prevention for that server?
- Is there a sample configuration available for this scenario?
- Would doing this slow performance down such that it would be inadvisable?
ubuntu web-server snort ids ips
asked Jun 22 '17 at 17:14
Christopher HinkleChristopher Hinkle
264
add a comment |
I've been looking for an effective intrusion prevention system (IPS) for an Ubuntu 14.04 server, something like what Symantec or F-Prot might offer for a Windows server. I've contacted major companies which say they support products for Ubuntu and other Linux distros, but they end up being anti-virus only and do not offer any protection against known vulnerabilities.
I found documentation about Snort and Suricata combined with rule managers like PulledPork and OinkMaster, but as I got deeper into it it seemed to me that these were meant to turn a server into a dedicated hardware IPS solution for a network.
- Can Suricata be used instead on an existing web server to simply provide intrusion prevention for that server?
- Is there a sample configuration available for this scenario?
- Would doing this slow performance down such that it would be inadvisable?
ubuntu web-server snort ids ips
asked Jun 22 '17 at 17:14
Christopher HinkleChristopher Hinkle
264
I've been looking for an effective intrusion prevention system (IPS) for an Ubuntu 14.04 server, something like what Symantec or F-Prot might offer for a Windows server. I've contacted major companies which say they support products for Ubuntu and other Linux distros, but they end up being anti-virus only and do not offer any protection against known vulnerabilities.
I found documentation about Snort and Suricata combined with rule managers like PulledPork and OinkMaster, but as I got deeper into it it seemed to me that these were meant to turn a server into a dedicated hardware IPS solution for a network.
- Can Suricata be used instead on an existing web server to simply provide intrusion prevention for that server?
- Is there a sample configuration available for this scenario?
- Would doing this slow performance down such that it would be inadvisable?
ubuntu web-server snort ids ips
ubuntu web-server snort ids ips
asked Jun 22 '17 at 17:14
Christopher HinkleChristopher Hinkle
264
asked Jun 22 '17 at 17:14
Christopher HinkleChristopher Hinkle
264
edited Apr 18 at 15:13
Christopher Hinkle
asked Jun 22 '17 at 17:14
Christopher HinkleChristopher Hinkle
264
asked Jun 22 '17 at 17:14
Christopher HinkleChristopher Hinkle
264
asked Jun 22 '17 at 17:14
Christopher HinkleChristopher Hinkle
264
264
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
You can definitely use Suricata as ips on your web server, but generally it's not a good idea.
May be a host based ids is better for this kind of situation. Try to look at Ossec (https://ossec.github.io). Ossec is free and very light.
answered Jun 22 '17 at 18:22
Marco BompaniMarco Bompani
615
As you mentioned, OSSEC is HIDS. I'm looking for something that will prevent the intrusion by detecting an exploit signature and stopping it, not something that would just alert me after the fact. It doesn't seem like HIDS would allow for that intervention, would it?
– Christopher Hinkle
Jun 22 '17 at 18:35
Your point is correct, but it's better to place the ips behind the gateway and also have an hids on the most critical servers. Don't rely solely on the ips please.
– Marco Bompani
Jun 22 '17 at 18:57
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f857319%2fcan-suricata-be-used-as-an-effective-ips-on-a-single-server%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You can definitely use Suricata as ips on your web server, but generally it's not a good idea.
May be a host based ids is better for this kind of situation. Try to look at Ossec (https://ossec.github.io). Ossec is free and very light.
answered Jun 22 '17 at 18:22
Marco BompaniMarco Bompani
615
As you mentioned, OSSEC is HIDS. I'm looking for something that will prevent the intrusion by detecting an exploit signature and stopping it, not something that would just alert me after the fact. It doesn't seem like HIDS would allow for that intervention, would it?
– Christopher Hinkle
Jun 22 '17 at 18:35
Your point is correct, but it's better to place the ips behind the gateway and also have an hids on the most critical servers. Don't rely solely on the ips please.
– Marco Bompani
Jun 22 '17 at 18:57
add a comment |
You can definitely use Suricata as ips on your web server, but generally it's not a good idea.
May be a host based ids is better for this kind of situation. Try to look at Ossec (https://ossec.github.io). Ossec is free and very light.
answered Jun 22 '17 at 18:22
Marco BompaniMarco Bompani
615
As you mentioned, OSSEC is HIDS. I'm looking for something that will prevent the intrusion by detecting an exploit signature and stopping it, not something that would just alert me after the fact. It doesn't seem like HIDS would allow for that intervention, would it?
– Christopher Hinkle
Jun 22 '17 at 18:35
Your point is correct, but it's better to place the ips behind the gateway and also have an hids on the most critical servers. Don't rely solely on the ips please.
– Marco Bompani
Jun 22 '17 at 18:57
add a comment |
You can definitely use Suricata as ips on your web server, but generally it's not a good idea.
May be a host based ids is better for this kind of situation. Try to look at Ossec (https://ossec.github.io). Ossec is free and very light.
answered Jun 22 '17 at 18:22
Marco BompaniMarco Bompani
615
You can definitely use Suricata as ips on your web server, but generally it's not a good idea.
May be a host based ids is better for this kind of situation. Try to look at Ossec (https://ossec.github.io). Ossec is free and very light.
answered Jun 22 '17 at 18:22
Marco BompaniMarco Bompani
615
answered Jun 22 '17 at 18:22
Marco BompaniMarco Bompani
615
answered Jun 22 '17 at 18:22
Marco BompaniMarco Bompani
615
answered Jun 22 '17 at 18:22
Marco BompaniMarco Bompani
615
615
As you mentioned, OSSEC is HIDS. I'm looking for something that will prevent the intrusion by detecting an exploit signature and stopping it, not something that would just alert me after the fact. It doesn't seem like HIDS would allow for that intervention, would it?
– Christopher Hinkle
Jun 22 '17 at 18:35
Your point is correct, but it's better to place the ips behind the gateway and also have an hids on the most critical servers. Don't rely solely on the ips please.
– Marco Bompani
Jun 22 '17 at 18:57
add a comment |
As you mentioned, OSSEC is HIDS. I'm looking for something that will prevent the intrusion by detecting an exploit signature and stopping it, not something that would just alert me after the fact. It doesn't seem like HIDS would allow for that intervention, would it?
– Christopher Hinkle
Jun 22 '17 at 18:35
Your point is correct, but it's better to place the ips behind the gateway and also have an hids on the most critical servers. Don't rely solely on the ips please.
– Marco Bompani
Jun 22 '17 at 18:57
As you mentioned, OSSEC is HIDS. I'm looking for something that will prevent the intrusion by detecting an exploit signature and stopping it, not something that would just alert me after the fact. It doesn't seem like HIDS would allow for that intervention, would it?
– Christopher Hinkle
Jun 22 '17 at 18:35
As you mentioned, OSSEC is HIDS. I'm looking for something that will prevent the intrusion by detecting an exploit signature and stopping it, not something that would just alert me after the fact. It doesn't seem like HIDS would allow for that intervention, would it?
– Christopher Hinkle
Jun 22 '17 at 18:35
Your point is correct, but it's better to place the ips behind the gateway and also have an hids on the most critical servers. Don't rely solely on the ips please.
– Marco Bompani
Jun 22 '17 at 18:57
Your point is correct, but it's better to place the ips behind the gateway and also have an hids on the most critical servers. Don't rely solely on the ips please.
– Marco Bompani
Jun 22 '17 at 18:57
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f857319%2fcan-suricata-be-used-as-an-effective-ips-on-a-single-server%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
