Re: Advice on using intrusion detection

2020-11-24 Thread Aaron Mason
On Sun, Nov 22, 2020 at 1:14 AM Nick Holland wrote: > > On 2020-11-20 17:15, Erik Lauritsen wrote: > > Is it recommended to run some kind of intrusion detection on an > > OpenBSD router/firewall? > > > > I suspect that any kind of system like Snort or Suricata will give a > > lot of false

Re: Advice on using intrusion detection

2020-11-22 Thread Peter Nicolai Mathias Hansteen
> 22. nov. 2020 kl. 02:02 skrev Predrag Punosevac : > OpenBSD is all about prevention and exploit mitigation. Code simplicity, > correctness, and code audit are all examples of intrusion prevention > methods. They don't sound very sexy :-) If you are super new to OpenBSD > Peter just gave a

Re: Advice on using intrusion detection

2020-11-21 Thread Predrag Punosevac
On 2020-11-20 17:15, Erik Lauritsen wrote: > Is it recommended to run some kind of intrusion detection on an > OpenBSD router/firewall? > What do you mean by "some kind of intrusion detection" (IDS). At the risk of sounding patronizing I would start by clarifying terminology. I got confused by

Re: Advice on using intrusion detection

2020-11-21 Thread Nick Holland
On 2020-11-20 17:15, Erik Lauritsen wrote: > Is it recommended to run some kind of intrusion detection on an > OpenBSD router/firewall? > > I suspect that any kind of system like Snort or Suricata will give a > lot of false positives? MY philosophy is it is much easier to keep 'em out than to