SURFcert IDS Development Homepage

1a: Bootable USB - [Building]

ktrippelvitz — 2012-09-27T14:03:27+02:00

1a: Bootable USB The other option of creating a SURFids sensor is by making a bootable USB stick function as a SURFids sensor. These USB sticks can be deployed throughout your network on any machine that will boot from USB. This page will describe how you can create the USB image that will be used for creating a USB sensor. This image can be used to create any number of USB sticks (ie, the image is only created once). First we need to get the necessary files from the SURFids repository:

Honeypot ports - [Honeypot ports]

ktrippelvitz — 2012-07-26T17:19:33+02:00

Honeypot ports Port Amun Nepenthes Dionaea 21 ftpd ftp 25 imail 42 wins wins 69 …

Installing Kippo - [Other configuration]

ktrippelvitz — 2012-07-26T15:07:44+02:00

BETA BETA BETA BETA NOTE : Kippo support in SURFids is still in beta phase. This document is mainly intended for people that want to help testing Kippo along with SURFids. Installation cd /opt/ svn checkout http://kippo.googlecode.com/svn/trunk/ kippo

Contact - [Developers]

ktrippelvitz — 2012-07-25T11:14:53+02:00

Project leader Rogier.Spoor[at]surfnet[dot]nl Developers Kees Trippelvitz - Kees.Trippelvitz[at]surfnet[dot]nl IRC SURFnet IDS: #surfnetids irc.freenode.net Nepenthes: #nepenthes irc.freenode.net

1: Installation - [Debian Squeeze]

ktrippelvitz — 2012-07-06T15:11:07+02:00

1: Installation First you need to add the SURFids key to your local key chain: wget -q http://repo.ids.surfnet.nl/key.pub -O- | sudo apt-key add - Then create a file /etc/apt/sources.list.d/surfids.list with the content: deb http://repo.ids.surfnet.nl/surfnetids/ lenny main

1a: Installing Ethernet module

ktrippelvitz — 2012-01-10T15:18:47+02:00

1a: Installing Ethernet module The detectarp.pl script uses various perl libraries. These libraries are not always available as standard Debian packages. To enable ARP detection we will somehow need to install these libraries. Here is how it works: What is needed? The list of needed libraries is:

FAQ - [Dionaea FAQ]

ktrippelvitz — 2011-12-22T17:44:25+02:00

FAQ Tunnel server FAQ T01: I have a sensor that keeps starting and reseting it's connection. Certificate is not yet valid. SERVER: /var/log/daemon.log Mar 28 15:38:02 localhost openvpn[31788]: Connection reset, inetd/xinetd exit [-1] SENSOR: /var/log/daemon.log

Global

ktrippelvitz — 2011-12-14T13:48:12+02:00

[http://ids.surfnet.nl/] Global * SURFcert IDS * Global * Tunnel server * Sensor * Logging server * SURFids Demo * Downloadable Demo Files * Screenshots * SURFids packages * Subversion * SURFids Trac * Miscellaneous * Manual latest_docs index kb index

SURFcert IDS

ktrippelvitz — 2011-12-06T11:59:58+02:00

Welcome to the SURFcert IDS Development homepage. SURFcert IDS (previously SURFids) is an open source Distributed Intrusion Detection System based on passive sensors. The goal is to provide an early warning system which lets system administrators correlate known and unknown exploits to attacks directed towards their networks.

SURFcert IDS

ktrippelvitz — 2010-03-22T16:24:38+02:00

SURFcert IDS

ktrippelvitz — 2010-03-22T15:18:57+02:00

SURFcert IDS

ktrippelvitz — 2010-03-22T13:10:04+02:00

SURFcert IDS

ktrippelvitz — 2010-03-22T12:54:18+02:00

SURFcert IDS

ktrippelvitz — 2010-03-22T12:54:01+02:00