C

H A P T E R

7

Miscellaneous Tools

t this point you have built your completely working Snort system

A

with database backend and web based user interface. This chapter

introduces a few useful tools that you can use with this system to make

management simple and to enhance the capabilities of your system. You

will also learn how to make your system secure. These components are

briefly introduced below.

IDS Manager is a Microsoft Windows based GUI tool to manage Snort

rules and the Snort configuration file 

snort.conf

. Using this tool, you

can carry out different tasks like:

Downloading the current configuration file 

snort.conf

 and rules from

an operational Snort sensor.

Modifying the configuration file and rules.

Uploading the modified configuration to the sensor.

Using IDS Manager, you can manage multiple Snort sensors. The only

catch is that it uses SSH server, which must be running on the Snort sensor.

SnortSam is another tool that can integrate Snort with firewalls. Using this

package with Snort, you can modify firewall configuration. The useful 

ness of this technique is still debatable as it may open up the firewall for

denial of service (DoS) attacks.

209