Re: ssh and ids

[Gary Flynn <flynngn () jmu edu>]

Runion Mark A FGA DOIM WEBMASTER(ctr) wrote:

> Lets suppose the attacker is mildly sophisticated, and after making the
> initial assault
One chance to trip the IDS

> roots the box
Another chance to trip the IDS (or host integrity checking)

> and installs a secure backdoor or two
Another chance to trip the IDS.

> .  Is
> there any IDS capable of isolating data it cannot read, except to monitor
> authorized port usage of a system or group of systems?
The Juniper/Netscreen IDP comes with a feature called Profiler
that you can set to discover and alert on new port or host
appearances. You set it to discover whats normal, then turn on
alerting.


---------------------------------------------------------------------------

---------------------------------------------------------------------------