I'm running Apache on a server with stateful firewall where new IPv4/IPv6 ingress connections are allowed only to TCP ports 80 and 443. SSH is allowed from few trusted hosts and only certain ICMP/ICMPv6 messages and UDP destination ports 33434 - 33534(traceroute in UDP mode) are allowed from everywhere. Outgoing traffic is not firewalled. Is there a point of running IDS(for example Snort) in such environment on the server? If yes, then what does it mitigate or what additional visibility does it provide?


It depends.

If your accessible web ports are hosting an application that is pwned and has a privilege escalation exploit. You won't know. Your firewall did it's job, but your system (and network) is pwned.

If your firewall doesn't restart on system reboot the safety net of an IDS of some kind may alert you to some misbehaving.

If you don't know what 0-day exists, you may never know when they are used on your systems without the visibility.

If it's your hobby blog, not necessary. If it's an entry point into your DMZ and corporate network - maybe a bit more useful.

  • Thanks for reply! In order to have a visibility of intrusions and privilege escalations, I'm using pam_exec.so PAM module in common-session which sends an e-mail for each successful login. In addition, I have a Logcheck configured. In order to avoid a situation where firewall is not started, my systemd networking.service is configured in a way that it BindsTo= iptables/ip6tables services. However, maybe I should look into Host-based intrusion detection systems like Tripwire in order to have a visibility and understand what has been done once the intruder has already pwned the system? – Martin Jun 11 '19 at 8:35
  • 2
    No probs! It depends on what you are trying to secure / not-leak. I don't follow IDS stuff (didn't even know snort was still around!) but I remember in the monitoring systems I used to use they would check the hash of files and trigger on any changes. It's handy. Physical access is another vector. If the machine reboots you don't know what happens (usb boot disk, single user mode) and copying of sensitive data. Just depends what you're securing. It's good practice anyway. Just make sure your IDS binaries aren't tainted too! Build from src if you depend on them and review git commits. – Mylo Mylo Jun 11 '19 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.