Please give a brief description for each tool.
Add a comment
|
8 Answers
From their about page:
Originally released in 1998 by Sourcefire founder and CTO Martin Roesch, Snort is a free, open source network intrusion detection and prevention system capable of performing real-time traffic analysis and packet logging on IP networks. Initially called a “lightweight” intrusion detection technology, Snort has evolved into a mature, feature-rich IPS technology that has become the de facto standard in intrusion detection and prevention. With nearly 4 million downloads and approximately 300,000 registered users Snort, it is the most widely deployed intrusion prevention technology in the world.
-
2
Why don’t you check http://sectools.org/
Is an open source (though there's a closed source version) integrity checker that uses hashes to detect file modifications left behind by intruders.
OpenBSD has mtree(8): http://www.openbsd.org/cgi-bin/man.cgi?query=mtree It checks whether any files have changed in a given directory hierarchy.
Logcheck is a simple utility which is designed to allow a system administrator to view the logfiles which are produced upon hosts under their control.
It does this by mailing summaries of the logfiles to them, after first filtering out "normal" entries. Normal entries are entries which match one of the many included regular expression files contain in the database.
You should watch your logs as one part of a healthy security routine. It'll also help trap a lot of other (hardware, auth, load...) anomalies.
DenyHosts for SSH server.
For NIDS, Suricata and Bro are two free alternatives to snort.
Here's an interesting article discussing all three of them:
http://blog.securitymonks.com/2010/08/26/three-little-idsips-engines-build-their-open-source-solutions/
Have to mention OSSEC, which is a HIDS.
Second Look is a commercial product that is a powerful tool for intrusion detection on Linux systems. It uses memory forensics to examine the kernel and all of the running processes, and compares them with reference data (from the distribution vendor or authorized custom/third-party software). Using this integrity verification approach, it detects kernel rootkits and backdoors, injected threads and libraries, and other Linux malware running on your systems, without signatures or other a priori knowledge of the malware.
This is a complementary approach to the tools/techniques mentioned in other answers (e.g., file integrity checks with Tripwire; network-based intrusion detection with Snort, Bro, or Suricata; log analysis; etc.)
Disclaimer: I'm a developer of Second Look.
