Re: Multiple Sensors/Distributed Snort Config.

[Andreas Östling <andreaso () it su se>]

On Thursday 13 July 2006 19:17, Dan Brummer wrote:
> I'm  planning to put multiple sensors on my enterprise network
> and have all of these feed to a central database server.  From
> my research I understand the best way to do this is have each
> remote sensor send its Snort output using MySQL.  Is this the best
> way of doing this?  

That's fine, just make sure you don't use database output from Snort 
directly. Use unified output and then some tool like Barnyard to do the 
database stuff. Why and how is explained in the docs and misc install 
guides.


> What about the rules and and making sure they're shared and
> up-to-date on all the sensors?  

If you're comfortable with some simple scripting, it's pretty much 
trivial to setup Oinkmaster in a distributed environment to manage the 
configs and rules. The Oinkmaster FAQ may give some tips:
http://oinkmaster.cvs.sourceforge.net/oinkmaster/oinkmaster/FAQ?view=markup

You may also want to check out the other tools at 
http://www.snort.org/dl/contrib/


> Do I need to be running snort on the
> central database server if all it's doing is receiving sensor outputs
> and displaying reports using ACID or BASE?

No need to run Snort there unless you use the same box as a sensor 
(which you shouldn't). Don't even think about running ACID, it was 
abandoned about 50 years ago.

/Andreas



-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users