Re: [Prelude Hybrid IDS] #232: ssh.rules does not handle IPv6 address
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#232: ssh.rules does not handle IPv6 address ---------------------------------+------------------------------------------ Reporter: [email protected] | Owner: yoann Type: defect | Status: assigned Priority: normal | Milestone: Prelude-LML 0.9.11 Component: prelude-lml | Version: 0.9 Severity: normal | Resolution: Keywords: | ---------------------------------+------------------------------------------ Comment (by gegomez): Replying to [comment:5 [email protected]]: > I like the idea of having the prelude-manager nomalize the addresses because you are right I've looked through my logs and found cfengine also does this too. the only reservation I have is ([A-Fa-f\d:\.]+) should be used instead of (\S+) followed by an identical rule using (\S+) but maps to source(0).node.name because I have seen implementations in the past that use hostnames where avalable instead of addresses this way we can catch the ones that match ip addresses first and any thing that does not match an ip address can be cought by the second rule as a hostname The normalize plugin for Prelude-Manager should be able to handle this, and handle it in a more consistent manner than a bunch of different rules. The more rules you make for the end-sensors, the more complex the ruleset becomes and the more difficult it is to maintain. If, instead, you let Prelude-Manager handle this, you get a more comprehensive solution that takes into account all of the sensors (including sensors that haven't even been written yet), instead of a single sensor at a time. -- Ticket URL: <https://trac.prelude-ids.org/ticket/232#comment:6> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel