Re: [Prelude Hybrid IDS] #232: ssh.rules does not handle IPv6 address
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#232: ssh.rules does not handle IPv6 address ---------------------------------+------------------------------------------ Reporter: [email protected] | Owner: yoann Type: defect | Status: assigned Priority: normal | Milestone: Prelude-LML 0.9.11 Component: prelude-lml | Version: 0.9 Severity: normal | Resolution: Keywords: | ---------------------------------+------------------------------------------ Comment (by [email protected]): I like the idea of having the prelude-manager nomalize the addresses because you are right I've looked through my logs and found cfengine also does this too. the only reservation I have is ([A-Fa-f\d:\.]+) should be used instead of (\S+) followed by an identical rule using (\S+) but maps to source(0).node.name because I have seen implementations in the past that use hostnames where avalable instead of addresses this way we can catch the ones that match ip addresses first and any thing that does not match an ip address can be cought by the second rule as a hostname -- Ticket URL: <https://trac.prelude-ids.org/ticket/232#comment:5> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel