Security

Snortsam and Portscanning Detection

This Post Originally From Snort-users by Frank

Q

: How can i use the snort portscan2 preprocessor with snortsam?

A

:it doesn't matter what version of Snort you are using, 1.9.x, 2.0.x, or 2.1.x. Alerts from the portscan preprocessor (or any other preprocessor such as ARP spoof) are not recognized by Snortsam. It only reacts to alerts generated by packets detected with rules.

That said, port scans can be detected. However, you will have to create your own rules for that. There are two ways (and a combined way) of doing this.

a) Create rules that fire when you can packets going to unused IP

GPG encryption keys Under Linux

This is a quick overview that details the creation process of a GPG public and private key under Linux.

I had to go through that procedure yesterday, and I will share it here.

First, a GPG key is a piece of data used to encrypt or decrypt messages. In order to encrypt a message, you need the recipient's public key. To decrypt a message, you need the passphrase stored in the key, and the private key. That way, messages containing sensitive data sent to one recipient, can only be decrypted by that recipient who has the private GPG key, with the use of a passphrase.

Here are the main commands in order to create GPG keys:

Syndicate content