Cybersecurity — IPS

What are IDS/IPS?

• IDS: Detects threats (passive)
• IPS: Prevents threats (active)

Snort (IDS/IPS)

# Install
sudo apt install snort

# Run in detection mode
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0

# Run in IPS mode
sudo snort -c /etc/snort/snort.conf -i eth0 --daq afpacket -Q

Snort rules

# Detect port scan
alert tcp any any -> $HOME_NET any (msg:"Port Scan"; flags:S; threshold:type both, track by_src, count 5, seconds 60;)

# Detect SQL injection
alert http any any -> $HOME_NET any (msg:"SQL Injection"; content:"SELECT"; nocase; content:"FROM"; nocase;)

Suricata

# Install
sudo apt install suricata

# Update rules
sudo suricata-update

# Run
sudo suricata -c /etc/suricata/suricata.yaml -i eth0

Analysis

# View alerts
tail -f /var/log/suricata/eve.json

# Statistics
suricatasc -c stats

Best practices

1. Tune rules to reduce false positives
2. Update signatures regularly
3. Monitor alerts
4. Integrate with SIEM

Mini Practice

1. Install Snort
2. Write custom rules
3. Detect attacks
4. Analyze alerts

Up Next

Continue with VPN - Secure connections.