Re: [sentinix-list] [ANNOUNCE] Demo Version of SENTINIX NOW Available!

See comments below... ;)

----- Original Message ----- 
From: "M. Morgan" <[email protected]>
To: "Bob Radvanovsky" <[email protected]>; "The SENTINIX Mailing List"
<[email protected]>; <[email protected]>
Sent: Friday, February 27, 2004 8:32 PM
Subject: Re: [sentinix-list] [ANNOUNCE] Demo Version of SENTINIX NOW
Available!


> Nice Bob,
>  It looks like the kiddies are having a go at the box judging by the
events logged. Did you do anything special to harden it or just removed
uneeded services and firewall it?

The distribution comes with 'iptables' loaded, but not configured on the
server.  I copied an existing configuration from another server, limiting
access to the 'demo IDS' server.  Insofar as to the reports, I try and keep
'em trimmed down from bogging the server too much.  So far, we've had ALOT
of hits against the server, and it's held up, despite the 'kiddies'
curiousities.  ;)

Like other people who believe in the Open Source Initiative, I got tired of
NOT seeing a fully-functional, working demo environment....so, I did
something about it.  If there's something that I like, and I believe in it,
I will promote it, endorse it, and spread the word about it's use.  Fact is,
there is SO MUCH 'open source' out there, that many people don't realize
just what it all can do.  In my observations, for every 1 commercial-grade
package that does <x> function, I've found close to a dozen (or more) that
not only do <x> function, but <y> and <z> on top of that.  I can see now why
Microsoft is saying what they're saying about Linux and Open Source.

The demo server is for everyone's benefit.  This is just another
distribution of something *really* good -- something that I've waited for
some time: a security distrubution package that is comprised *entirely* from
Open Source.

>  I'll be checking it regularly to watch the traffic and it would be nice
if you saved the snort logs (weekly?) and made them available as sort of a
"IDS box in the wild" (honeypot-esque?).

I have a *production* server that is monitoring EVERYTHING.  What you see on
the 'demo IDS' is filtered network traffic, just added for flavour, to get
people to notice what/how it works, looks like, etc, etc.  So far, in 5
days, I've accumulated OVER 20,000 signatured attacks against my entire
network, most of them directed towards the 'demo IDS' server....so the
kiddies rulz.

>  Anyway, good show on the box. Sentinix is a great distro as well.

I agree...whole heartedly.

Bob Radvanovsky [UNIXWORKS]
[email protected]