Re: Snort / acidlab and mysql
I think that is most secure use a external box to archive IDS data and
reports. The firewall boxes normally generate a lot of megabytes of log
and are very critical parts of network, so I think that the best way to
avoid crashes and possible security issues.
It' possible create a vlan for this service if you has a switch with this
feature or create a other segment of net to services like this.
All this questions are very personal and depends of your network traffic
because if you make some scripts to manage databases and logs/reports you can mantain all working fine on the
same box ( mysql, acid, snort and netfilter ).
Bye,
M. Genaro
On Mon, 3 Nov 2003, Craig wrote:
> Hi guys
>
> Is it a perferrable to have snort and acidlab running on a firewall
> machine masquerding a network and logging to an internal server running
> apache-ssl and mysql ? I would like to setup some sort of IDS but also
> have more info on traffic in the internal network ?
>
> Thnaks
>
> ..Craig
>
>
> --
> To UNSUBSCRIBE, email to debian-isp-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
>
>
Reply to: