TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Plesse refer to 54 - 67 in the Real Secure Getting Stardard Guide for
configuring the stealth nic interface.
One can detect the presence of an ISS RealSecure 3.2.1, 3.2 if the default
ports for the Daemon Port 2998 and Detector Port 901 are not changed to
some other port.
On page 66 of the Real Secure Getting Standard Guide indicates an
administrator can change the default Daemon Port and Detector Port, but the
default ports are as stated above.
You can now make your own conclusions to what was stated at SANS. One
should always follow recommended NT Security hardening guidelines
recommended by either Microsoft or as in this case ISS
/m
At 12:16 PM 7/25/00 -0400, [EMAIL PROTECTED] wrote:
>TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
>[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
>----------------------------------------------------------------------------
>
>If your NE is running in stealth mode, is there any possibility that the
>box could be compromised? ISS says that if there is no IP bound to the NIC
>then an intruder should not be able to detect its presence.
>At a SANS conference, I heard otherwise, so what's the real deal on this
>issue?? Our network people think that since the box is in promiscous
>mode, then it is not necessary to harden the box. I think it is important
>to hardent the box,
>but I need some valid reasons as to why this should be done. Anyone have
>any ideas that I could present to them (besides the risk of internal
>attacks to the IDS).
>
>Thanks again,
>Mark
