Re: SSL traffic

[Frank Meerkoetter <frank () betaversion net>]

On Sat, Apr 10, 2004 at 01:22:55PM -0700, Frank Dobb wrote:
Hi,

> Can snort - when acting as a host based IDS detect
> malicious HTTP requests over SSL? The platfoms I need

No Snort can't do this. Snort gets a copy of every paket read of the wire. 
If the payload is encrypted you're out of luck. The decryption is done
at a higher level (SSL -> application level).

> to potect are IIS/Win system and also Apache/Linux and
> Win enviroment. 
>
> If Snort can not do this - what is the recommended
> HIDS for this kind of config. (pref opensource)

For the Apache webserver mod_security should do the trick
(http://www.modsecurity.org). They also have a perl script which can
transform snort signatures to rules usable by mod_security.

HTH Frank
-- 
mixed emotions:
        Watching a bus-load of lawyers plunge off a cliff.
        With five empty seats.


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users