Printable View
What would you guys recommend is best for intrusion detection/blocking?
Currently I uses Symantec Internet security 2002, with the anti-virus package? Could I get something better? And also is there any benefit in using multiple firewalls at the same time?
Thanks in advance
Cisco PIX firewall security series are hardware firewalls runing what are considered hardened IOS. These are hardware and not software firewalls. They have many security features not found in other units also I recommend SonicWall, Netscreen.All of them can support from 10 to thousands computers and have advanced & stong security management tools such as:
- schedule based rules, Dos protection, VPN server/client , Qos/tos management, and you are looking at a lot of money here for this kind of hardware. For the average person on one OS software is the best. And since you are using Norton , you could not have picked a better software. Right now Norton ranks number one after being tested against other software firewalls. As long as you continue to get your updates , you should be in tip top shape. BTW, many test were run on NORTON and it came out smelling like a rose on the leak test and all other test that they tested NORTON on. Right now the two top ones , are NORTON and Zone Alarm , but many are questioning that Zone Alarm is spyware because when it say click here to uninstall.. it doesn't completely . That is another story all it's own I won't get into. But stick with what you have. You made a wide choice. (BTW I am here posting as our board is getting worked on and is not up)
Adore
HDC
BTW the answer to your second question , I posted it on this other persons thread you can click here to read it.
http://www.antionline.com/showthread...hreadid=228993
Adore
Well HDC admin, I hope you're running Norton and ZA cause both of them blow chunks. really good advice, sarge.
Hey, Mahakaal, a good IDS is snort. If you want a good firewall that has some IDS capabilities ( I'm going out on a limb here and assuming you're a windows user) the might I recommend 3.
And to answer your last question, NO. It affords you no more protection. If you want more protection then a gateway box running say FreeBSD or OpenBSD w/ iptables/ipchains in between your work box and your inet connection would do well.
Another quick gateway box that's really easy to use look here.-> www.clarkconnect.org
sygate www.syagte.com
tiny www.tinysoftware.com
outpost www. agnitum.com
edit -typo
I prefer Agnitum Outpost by far to all other software firewalls for WinMachines... It needs a bit more configuration then ZoneAlarm to get working but it is much more configurable... Most firewall companies do not recommand using 2 concurrent firewalls, I have used 2 at the same time without any problem... But I think that with a configurable firewall you don't really need 2. All you have to do is block all ports that you do not use. A list of dangerous ports and their common uses can be found at http://www.iss.net/security_center/a...xploits/Ports/
I also suggest having an UPDATED antivirus running, that way if a trojan was installed via physical access to your machine, it will be discovered IF you have a the Resident scanner running. I also suggest using the updater for the AV you pick, a new trojan could be written anytime and your old definition file would be useless to locate it (unless you have heuristic scan selected and the trojan is not outstandingly different then existing trojans...)
Have fun!
IDS systems...well mostly easy to bypass but they keep the script kiddies away... I've tried ZoneAlarm but the little popup-boxes really pisses me off... it's hard to secure a box if u often install new software/games that needs access to the Net... Symantec Internet security 2002 is ok, and it should keep most morons away... (u could of course just install *nix on ur box and use some of the buildin firewall services hehe :D )
you could use a honeypot... back on track, use snort, its one of the best ids
KorpDeath,
If you could provide some evidence as to why Norton and Zone Alarm "blow chunks," I'd appreciate it. If you could direct me to some url's, thanks.
BTW, Adore seems to know a lot about network security, far above little software firewalls. Given that she's provided far more evidence to her case than yours, I'd tend to believe her, HDC admin or not.
N2N
Korp I do not use Norton or Zone Alarm. I use HARDWARE , not SOFTWARE.
A.
KorpDeath, your unsupported statement of 'blowing chunks' is really considered invalid for me. In my opinion, adore stated all her opinions firmly, unlike you.
Well adore, if you don't use software firewalls then why recommend something that you don't know works?
And as for you silentstalker, since when did you become the doer of good deeds, the righter of wrongs? Please.....
I've supported my claims in tests with software firewalls that I've conducted, if you don't like my opinion then that's fine, but I'm not going to stop recommending what I feel is the best for people who want it. If you want to debate my security then I;m all for it, but as far as I can see you haven't a leg to stand on, so I digress.
We've been over this here at AO far too many times for me to recap all that has been learned , if you don't believe me, set up a lab and then get someone who knows how to hack. It'sa that simple. I have a few scripts that crash Norton wide open, so to I have scripts for ZA. The mutex engine is not all it's cracked up to be.
Anything else?
Can't we all just get along :)
Thanks for all the good advice ALL of you have given me.
snort combined with the BerkleyDB provides an IDS reporting system surpassed by none and although it's free, it's far beyond the abilities of the average win user to set-up and configure, just like any cisco product is. even updating the pix os is far more complecated than most can handle.(like, WTF is tftp?)
---------------------
it's hard to secure a box if u often install new software/games that needs access to the Net
---------------------
tiny would make your life a lot easier. like ZA, it pops up a warning that a program is trying to access the internet, but unlike ZA, on the pop-up is an option to configure a rule 'now'. when i say a rule, im talking, what ports on what ip address etc, full complete rules, not just allow or deny. its a little more complicated than norton but alot more configurable.
I haven't tried the newest ZA, i hear its more configurable, but as adore hinted at it reports back every chance it gets. i have the impression, although i could be mistaken, their related somehow to ZDnet (Ziff and Davis) who should be shot for their privacy infringments.
tiny supports port mapping and ip masquerading (in windows mind you)
havn't tried Agnitum Outpost but you make it sound pretty good Scorp666
well, Mahakaal,
it really depends on what you are, and what you are looking for.
If you are simply a user who is concerned about their systems at home(one or plural) and are not particularly interested in technical details, then a program like Norton Internet Security, or several of the other personal firewall type applications are for you. Some are better than others, but, the best firewall for someone who doesnt want to spend a lot of time thinking about it, is a firewall that you will use, and that has passed some reasonable tests.
If an 3\/IL |-|4><0r with L33t sk1lls(and I dont mean script kiddies) targets you, there isnt really any way in the world that will abssolutley with out a doubt keep them out of your systems, expect for switching off the power.
Script kiddie types are much easier to keep out though, so almost any firewall will do for most personal uses.
IF you want to start talking about tracking folks down, or protecting critical corporate networks, then, intrusion detection, and absolutely top notch firewalls are key.
If I were to recommend a personal firewall, I would recommend Tiny Personal firewall. Because it is the best(for Windows OS's) personal software firewall with which I have worked. I would add to it a hardware device which does NAT so that external traffic doesnt even reach your computer unless you have specifically allowed it.
Intrusion detection is not really worth anything, if you are not interested enough to read the logs, and technically savvy enough to sort the wheat from the chaff. There are some which automatically message ISP about "SUSPICIOUS" traffic, which is not really suspicios at all.
If you are genuinely interested, then look at www.snort.org for intrusion detection.
If all you are interested in is a personal firewall for a windows machine, most of them will do the job for you, if you are at least reasonably carefull.
One of the things that I don't understand about this thread... the question was about intrusion detection but someone started spouting off about Cisco PIC Firewalls. In a purist's sense, they're not really the same thing at all... perhaps Mahakaal didn't quite phrase the question correctly.
But, for IDS, I like Snort (for the OpenSource Crowd) or, for an all-out awesome commercial implementation, NFR. Personally I'd stay away from ISS - you can drive caravans of trucks through it (guess that's where the host-based IDS comes in - but, the way I think, if your host-based IDS and/or honeypots trip before you N-IDS alarms, it's already too late).
I'll get tiny and definitely look up Snort/Berkely DB that you mentioned Tedob1, thanks.
And I'm a personal home user, always interested in learning more about different OS and flaws, hence my joining AO :) So no, I'm not "technically savvy" enough yet IchNiSan, but I take good advice from people who know better like yourselves. Thanks.
Or... take that 486 that's now a doorstop or about ready for a Planter Conversion, throw BSD or SmoothWall on it and configure it to be a firewall/gateway.
SmoothWall is soon releasing SmoothWall Lite, no longer under GPL, but still cool.
http://www.smoothwall.org/community/...020424.01.html
N2N
Mahakaal,
I dont think you took my meaning wrong, but I will clarify just the same.
Not being technically savvy is not a bad thing. If you are here, you are interested in securing your machine, and that benefits all of us by having one less machine on the internet which is at risk to code red, or klez, or whatever the next one is.
Wanting to keep your computer secure is a good thing, and there are lots of applications out there to do it.
Intrusion detection is another matter entirely. Most personal firewalls do a decent enough job. Are there ways to exploit them, sure, there probably are for most of them. Intrusion detection is very serious business, and not easy. There are several intrusion detection systems available from " big players " and most of them are just OK, or worse than OK. Intrusion detection is similar to virus detection, in that there are thousands of different patterns which can indicate attempted intrusions, just like there are thousands of different signatures to detect virii. Because virus detection has been a big deal for a lot longer than intrusion detection has been(from the standpoint of folks selling the product or service) virus detection is far more advanced interms of signatures than intrusion detection is.
For most users, intrusion detection is a waste of time. You could spend hours every day sending emails to [email protected] for zero gain, and still never see the truly dangerous intrusion attempts because the development of signatures to detect them is so far behind what one would typically expect for say a company selling virus detection.
I hope I didnt come accross as putting you or anyone else like you down, but the impression I got from your post(mentioning that you used Symantec Internet Security kinda tipped me off) was that you were a home user concerned with protecting your own computer. I applaud that, but dont try to get to hard core with whatever solution you use. Intrusion detection is hardcore. There are people who do nothing but analyze data from intrusion detection systems. If you are using Symantec Internet Security, or Zone Alarm, or some other personal firewall solution which gives you alerts of possible malicious activity, that is fine, but true work with intrusion detection involves in depth knowledge of network protocols, and is not for the faint of heart.
Snort(open source intrusion detection system) available from www.snort.org , is a great system, but the number of false alarms is staggering, unless you are capable of (like I said above) sorting the wheat from the chaff. Of figuring out that this alert is harmless because of that reason, and this alert is serious because of some other reason.
I was in no way trying to put someone down, just trying to point out, that intrusion detection requires a lot of knowledge and effort, and the THE BEST SECURITY SYSTEM, IS A SYSTEM THAT YOU WILL USE.
Good Luck.
IchNiSan
IchNiSan, I was being absolutely honest when I said ", but I take good advice from people who know better like yourselves." No offense was intended by me, and none was taken by me, by your ideas :)
My humble apologies for any misunderstanding.
Doesn't AO use RealSecure (ISS)?Quote:
Originally posted here by draziw
Personally I'd stay away from ISS - you can drive caravans of trucks through it
Ammo
I think that is one of the things they use, yes.Quote:
As a user of ZA I was just wondering could someone be more specific about the issues with that application that Adore was on about?
I stress you to Get Agnitum Outpost instead of TPF, in my opinion it is far better AND it has nice plugins for ActiveX control, Attachment screening and a few other interesting things
http://www.agnitum.com/products/outpost/
SilentStalker> You wanted links for zone alarm and Norton.....
Norton -> http://lists.insecure.org/firewall-w.../Apr/0077.html
ZA ------> http://www.ultraviolet.org/mail-arch...2000/0402.html
Hey Korp do you know of a good tutorial of iptables/ipchains and what is the difference between the two???
question 1: Ipchains - http://www.tldp.org/HOWTO/IPCHAINS-HOWTO.html
iptables: http://www.linuxguruz.org/iptables/h...les-HOWTO.html
question 2: As far as the difference, iptables replaces ipchains in the 2.4 linux kernel. It's setup better and it has many more features.
If you want to know more. Ask www.google.com
:thumbsup:
hmmm, I wonder why I haven't seen anyone mention TripWire when talking about IDS. I know it's a bit off subject, but I'm still curious.
Anyone here, other than me of course, have experience with TripWire's products?
El Diablo
TripWire isn't really an IDS - at least in my mind, it's in the wrong space to be considered such. Tripwire gives mechanisms by which you can detect changes in "known" parts of the filesystem and, in most people's hands, is really too complicated to be useful (and the sample configurations they give are enough to give management (and ignorant admins) the warm and fuzzies). All in all, managing and updating the thing is a pain in the butt (and even their commercial version, last I saw, doesn't really completely fix that - admitedly, it's been a while since I've let one of their sales people take me to lunch or something).
Basically the only thing tripwire does well for me is to let me know when I need to break someone's fingers - but there's really too many opportunities for misconfiguration of the thing and, thusly, it's usefulness is rather limited in my opinion. (though, on the flip side, I think it's a good idea and a worthwhile thing (as I think I've said in previous threads, actually) - that is, as long as you are ready to invest the time in to it).
I have a little Smoothwall (www.smoothwall.org) box serving as a gateway (lan to ADSL). Smoothwall features Snort for intrusion detection and acts as a firewall. There are a few boxes behing my Smoothie and one of them is a (burb) WinXP box. Since that is my main workhorse, I have Norton Internet Security 2003 (since a couple of days). So I use a double firewall and the Norton firewall has not much to do, but I like to have control over software accessing the internet, as well as the anti-virus stuff. Call me paranoid, but I like it this way.Quote:
Originally posted here by Mahakaal
Could I get something better? And also is there any benefit in using multiple firewalls at the same time?
For my situation, the double firewall is beneficial but in all honesty...the second firewall doesn't do anything 'cause Smoothie does a good job keeping the bad guys out. It also seems that my Alcatel ADSL modem does something firewall-ish. Not sure though...
Maybe my setup is a little over the top, but I still need NIS to keep banners away, privacy control and anti-virus, so it's not entirely useless. And I'm not a security expert so I follow the 'better safe than sorry' policy...