What intrusion prevention systems exist for ubuntu, and then through iptables it’s not really possible to foresee everything? Snort as I know only notifies, but does not block.

    6 answers 6

    In the desktop version I prefer the Arno-iptables-firewall script: http://unixteam.ru/content/obzor-arno-iptables-firewall-nastroyka-faervola-cherez-skript-arno-iptables By the way, I started using it from ADSL times and then he stayed.

      fail2ban - analysis of logs and ban of those who fell under the template

      • not very useful - jack-out

      However strange it may seem to you, the simplest and most reliable protection against invasions is:

      1. properly configured firewall
      2. restriction policy
      3. regular security updates

      Iptables complicated. For a variety of tasks, it’s enough to do without the UFW:

      UFW : https://wiki.404.city/ufw

      See current connections. Allow the necessary and block ufw everything else. Put the necessary rights to the files, run dubious programs in the sandbox. Set up regular updates.

      In addition to the firewall, other popular intrusion prevention systems are SELinux and AppArmor. SELinux and AppArmor are effective, but take a long time to configure (when used on a desktop).

      SELlinux: ru.wikipedia.org/wiki/SELinux

      AppArmor : ru.wikipedia.org/wiki/AppArmor

        Snort and similar intrusion prevention systems are designed to protect networks rather than individual hosts, and certainly not to protect the desktop. These are not analogues of products like Kaspersky Internet Security (: This is a little about something else.

        As far as I understand you want to protect your workstation from attacks from the network. In the case of most GNU / Linux distributions, it’s enough to "not shoot yourself in the foot." Unfortunately, there are a great many ways to shoot yourself in the foot and it is impossible to warn everyone.

          Look at the SmoothSec project | Intrusion detection made simple.

          SmoothSec 3.2, distribution for quick IDS / IPS deployment

          • there are just pre-installed components snort - jack-out
          • snort there as one of the components. - huffman
          1. Configure the Firewall and set its zone for new networks by default.
          2. Switch SELinux to "enforcing" mode and the type of protection in "mls". Configure restrictions for processes. Use SELinux.
          3. Set up and use auditd to audit the file system.
          4. Configure and use fail2ban / sshguard to limit the number of unauthorized access attempts.
          5. Use best-practice when configuring daemons.
          6. USE SELINUX!