Basically i m looking for some Intrusion Detection system....
so i find snort is one of them , soi i need step by step configuration to install snort & some snort web-based monitoring tool
..like " snort report "
is there any good alternative for Intrusion Detection system ? if yes how to install them
Snort is Network Intrusion Detection System (NIDS). Snort can sniff
your network and alert you based on his rule DB if there is an attack
on your computers network. It is an opensource system that was build
from tcpdump (linux sniffer tool).
This guide can be used for installing snort.
psad: Intrusion Detection and Log Analysis with iptables psad is a
collection of three lightweight system daemons (two main daemons and
one helper daemon) that run on Linux machines and analyze iptables log
messages to detect port scans and other suspicious traffic. A typical
deployment is to run psad on the iptables firewall where it has the
fastest access to log data.
If you using 12.04LTS Server, the see How to install PSAD Intrusion Detection on Ubuntu 12.04 LTS server.
Sources:
http://nachum234.no-ip.org/security/snort/1-snort-installation-on-ubuntu-11-10-i386/
http://www.cipherdyne.org/psad/index.html
