no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
— | ids [2022/10/13 09:11] (current) – created - external edit 127.0.0.1 | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ===== Intrusion Detection System ===== | ||
+ | ==== What does an IDS do? ==== | ||
+ | |||
+ | An Intrusion Detection System monitors a network, detecting malicious activity and blocking the bad attempts for a fixed period of time. | ||
+ | |||
+ | ==== How much does this cost? Who built the platform? ==== | ||
+ | |||
+ | Our IDS platform is included at no additional cost and protects our locations as a whole. | ||
+ | |||
+ | The platform itself was built in-house over the years. | ||
+ | |||
+ | ==== What does it protect against? ==== | ||
+ | |||
+ | The current revision of our platform best effort monitors for the following network wide activities: | ||
+ | |||
+ | ^ The ' | ||
+ | ^ Activity ^ Port ^ Note ^ | ||
+ | ^ Daemons, etc ^^^ | ||
+ | | SSH account brute forcing | 22 | Common. 20+ blocks a day | | ||
+ | | FTP account brute forcing | 21 | Not very common. 1 - 5 blocks a day | | ||
+ | | NetBIOS exploits (Windows) | 445 | "God dammit Gates!" | ||
+ | | Mail Server brute forces | 25, 110 | Fairly common. 5+ a day | | ||
+ | ^ Abused protocols ^^^ | ||
+ | | NTP Amplification | 123 | Extremely common | | ||
+ | | DNS Amplification | 53 | Extremely common | | ||
+ | |||
+ | Remember, this is is a best effort platform. Our IDS does not monitor for directed attacks (read: someone decides they want to brute you directly). We always recommend you change your SSH port when possible and **always** keep your applications up-to-date. | ||
+ | ==== Can I be excluded from the IDS? ==== | ||
+ | |||
+ | No. | ||
+ | |||
+ | Previously we used to allow users to opt-out but after countless people getting compromised after requesting such, we've revised this policy. | ||
+ | ==== Does the IDS protect from bot spam? ==== | ||
+ | |||
+ | Kind of. As of right now our IDS monitors for HTTP connections which will stop some bot spam. | ||
+ | |||
+ | We're currently considering importing [[http:// | ||
+ | |||
+ | ==== Does this IDS sniff my traffic? ==== | ||
+ | |||
+ | For the most part, **no**. | ||
+ | |||
+ | Our IDS works off of a cluster of traps set-up throughout our deployments. When one of them is tripped | ||
+ | by exploit scanners, the offending IP is nullrouted for a set amount of time. | ||
+ | |||
+ | For NTP & DNS amplification, | ||
+ | before they ever get to your virtual server. | ||
+ | |||
+ | Here's a thread with more information about NTP/DNS amplification attacks at [[https:// |