Re: [gentoo-hardened] Prelude Hybrid IDS

[Michael Boman]

On Sat, 2003-06-14 at 03:30, Daniel Struck wrote:
> Hello,
>
> I was just surfing around and found an interesting IDS:
>
> Prelude Hybrid IDS
> (http://www.prelude-ids.org/)
>
> "Prelude is a new innovative Hybrid Intrusion Detection system designed to be very modular, distributed, rock solid and fast."
>
> Interesting facts about this IDS:
>
> "
> we try to retrieve the "stimuli" and responses eventually associated to attacks at network level or at system level
> ...
> Centralizing, Archiving, and Normalizing logs in a secure way
> ...
> in practice we have as many sensors as possible (Prelude-NIDS, Centralized Syslogs, ...) deployed on the network which send their alerts to Security Managers.
> ...
> Counter-measure agents are generic agents run on the machines which must react in case of an attack.
> ...
> Libsafe is a preloadable library (through LD_PRELOAD directive or using an entry in /etc/ld.so.conf) which protect a program against the exploitation of vulnerabilities like buffer-overflows of bogus format string.
> "
>
>
> So, I would be interested:
>
> - Are there any efforts made to adapt Prelude-IDS to gentoo, maybe in relation with gentoo-hardened?

I have ebuilds submitted to bug.gentoo.org and even better and updated
ones in my local CVS repository (keep forgetting to submit them).

> - Is anyone already using Prelude-IDS on gentoo?

Yes, and I am already doing that.

Thanks for the interest, I will update my bugs now... ;)

(search for bugs submitted by michael [at] ayeka [dot] dyndns [dot] org
to get them, or bug me privately ;) )

Best regards
 Michael Boman

-- 
Michael Boman
Security Architect, SecureCiRT Pte Ltd
http://www.securecirt.com