Re: Minimum Configuration / Hardening

[Benjamin J. Weiss]

You can actually go two routes for a good snort box in an untrusted zone.   1) Bastille, which has been mentioned before, or   2) Don't give the box an IP address.  I don't know the specifics, but I've seen in CERT lists that you can put the NIC in promiscuous mode without an IP.  The box will still receive all of the packets on the wire, but it won't be able to reply and the black hats won't be able to see the box.  You'll have to do everything from the console, but you'll have a truly hack-proof box.   Ben ----- Original Message ----- From: Rich Lichvar To: Red Hat List (E-mail) Sent: Wednesday, June 25, 2003 11:14 AM Subject: Minimum Configuration / Hardening Thinking of using a Linux 9.0 box running Snort for detection in the Untrusted Zone of our network (i.e., before the firewall). I would like to know the absolute minimum configuration (package/software) and a suggested hardening script that could be used for this.   Richard L. Lichvar Director, Operations Knowledge Resource Center, Inc. Phone: 703-848-2100 x228 Fax: 703-848-4747 Mobile: 571-221-3430