Slashdot Mirror
An Open Source Security Triple Play
Marcus Maciel writes to tell that Linux.com's Joe Barr recently took a look at OSSEC-HIDS, an open source host intrusion detection system. From the article: "According the OOSEC-HIDS Web site, it's more than a host intrusion detection system (IDS). It's also a security event manager and a security information manager, which makes it the security equivalent of a hat trick in hockey, a triple-play in baseball, or a rare triple-double in basketball. OSSEC-HIDS runs on both Windows and Linux/Unix. You can download the latest version along with the project's PGP public key, so you can verify the download." Linux.com and Slashdot are both owned by OSTG.
Why so many sporting analogies?
NIGGA!
I'm so embarassed. I truly thought this was about physical building security with cameras and PIRs and shit.
To whom to I report to hand back my geek membership card?
Argh.
I just learned what that means! Yay Google.
While OSSEC HIDS looks like the beginnings of a good solution (aside from the name - sheesh - sounds like a sneeze) I'd like to see integration of projects like DShield.org and maybe some community-maintained updates for rootkit definitions and such. APF/BFD does this - why not OSSEC HIDS?
Gesundheit.
"It makes it the equivalent of massive hyperbole amongst rational discussion!"
Here is a list of what OSSEC can do if you are too lazy to RTFA:
- Log Analysis, with a powerful xml-based rules system
- File integrity checker
- Rootkit detection
- Active response (automatically ban hosts on critical alerts)
- Mail reporting
- Server/clients or local installation
It's GPL and runs on many *nix OS. I've tried OSSEC for a few months to monitor a few servers and I must say I'm pretty impressed with it. Its log analysis system is powerful and easy to understand. I've met a few false positives, but you can easily define your own rules to ignore some events. The project is a bit young, but development is very active. Definitely worth trying if you are interested in Unix security.
It's true that it's like a hat trick, triple-double, and that other thing, but if you don't know what any of those things are, it's also like a hole-in-three in golf, or three goals in three non-consecutive games of soccer, or to go in a non-sporting direction, three pieces of ham on a ham sandwich. But I guess the simplest way to explain it is that it does three seperate things. Three! I know it's a bit complicated, so I can explain further using many, many more analogies if need be. Just let me know.
The metaphores used in the summary indicate three *the same* things while the product in question does three *different* things.
I suspect the black hats use the same metaphors to describe success, including goooooooooooooooooal!
... How many things does it do again?
Is it anything like the ultra-rare "menage a quatre" of sexual intercourse?
A republic cannot succeed till it contains a certain body of men imbued with the principles of justice and honour.
...as in checkers?
--
Vote with all your heart, but get a healthy dosage of mass-media first. Or just don't vote at all!
You can't be ahead of the curve, if you're stuck in a loop.
It's actually quite useful, and not only from a security/intrusion standpoint; it reads the system logs and reports on errors. And the best thing about it is, it's self-learning! It will count the number of times a certain (low-level, as in "cannot find file" type) system error is encountered, and then, if it appears often enough on a regular basis it learns to ignore it. Very neat.
I just love this stuff!!! This is to me, what a good Duff is to Homer Simpson!!!
----- I have bad karma for a reason! -----
there is a proper virus that works on Mac-Intel, Windows, and Linux?
I prefer the "u" in honour as it seems to be missing these days.
Of course we all remember that PGP verification only means that the download was signed off on by the person or persons in possession of the corresponding PGP private key, not that that person is necessarily competent or trustworthy.
PGP/GPG signing is great, and necessary, but not sufficient for trust.
- jon
Ganymede, a GPL'ed metadirectory for UNIX
just saying...
From Wikipedia:
A triple-double is a basketball term, defined as an individual performance in a game in which a player accumulates double-digit totals (i.e., 10 or more) in any three of these categories: points, rebounds, assists, steals, and blocked shots.
The most common way for a player to achieve a triple-double is with points, rebounds, and assists, though on occasion elite defensive players may record 10 or more steals or blocked shots in a game.
A triple-double is seen as an indication of an excellent all-around individual performance. In the American National Basketball Association, they are rare but not unheard-of, as the top players can accumulate around 10 (out of a possible 82) in a season. It should be noted that the criteria for an assist has been relaxed over time, making triple-doubles more common in today's game than it was prior to the 1980's
Great install script... but seems to not work if I try an installation location other than /var/ossec
The rule based "xml" for identifying problems in logfiles is great.
the active response doesn't work. I've tried everything EVERYTHING. and injecting all sorts of attacks didn't even cause the firewall script to block the ip.
I searched and tried, and fiddles, and cried. Nadda.