[8.161][BUG][DUPE] IPS exception and blocking

Hi All

Whilst running a audit test I've noticed that the IPS exception I had didn't actually work and moreover I couldn't see the "expected" action in the logs

2011:03:24-12:57:55 *** ulogd[5225]: id="2102" severity="info" sys="SecureNet" sub="ips" name="portscan detected" action="portscan" fwrule="60017" initf="ppp0" srcip="69.28.227.215" dstip="81.153.173.93" proto="6" length="40" tos="0x00" prec="0x00" ttl="51" srcport="58231" dstport="443" tcpflags="SYN"

2011:03:24-12:57:55 ** ulogd[5225]: id="2102" severity="info" sys="SecureNet" sub="ips" name="portscan detected" action="portscan" fwrule="60017" initf="ppp0" srcip="69.28.227.215" dstip="81.153.173.93" proto="6" length="40" tos="0x00" prec="0x00" ttl="51" srcport="44668" dstport="993" tcpflags="SYN"

and as far as the action is concerned

2011:03:24-12:37:15 **** snort[14171]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="" reason="(smtp) Attempted specific command buffer overflow: AUTH, 379 chars" group="0" srcip="69.28.227.215" dstip="81.153.173.93" proto="6" srcport="60148" dstport="25" sid="0" class="Attempted Administrator Privilege Gain" priority="1"  generator="124" msgid="1"

Thanks

0 Astaro Beta Bot over 14 years ago

Astaro Beta Report
--------------------------------
Version: 8.161
Type: BUG
State: DUPE
Reporter: wingman
Contributor: 
MantisID: 
Target version: 
Fixed in version: 
--------------------------------

0 kbr over 14 years ago

Sorry, but i cannot accept any new reports against IPS until we fixed this one.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 14 years ago

Oh, and one more thing, because it is similar to what we've been talking about in this thread:

regarding the snort message, i said

This message is example for additional information that the snort daemon writes to the logs, just to make sure. You can simply ignore this message, as long as you do not experience any "real" problems. If there were any real problems, this warning might give us a hint where to look, but if there are no problems, this is just informational.

You can find out if this such an additional message by taking a look at the [FONT="Courier New"]sid[/FONT]. If it says [FONT="Courier New"]sid="0" [/FONT], then this message falls into that category.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 14 years ago

Oh, and regarding the fact that you didn't get a notification: that's the basically the same issue we talked about today here.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel