Installing IDS

• Configuring Portsentry

• As with Snort, Portsentry improperly configured

• can do more damage then good.

• Always add yourself to the ignore file without this you can effectively DoS yourself.

• Always make sure the different hosts in your network are in your ignore file.

• Always keep an eye on you /etc/hosts.deny because a lot of the time it is a false alarm and a legit person is now blocked.

Notes: