This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Turning off a particular IDS Event

Hi all,

I'm getting this random IDS alarm:

MYSQL yaSSL SSLv2 Client Hello Message Challenge Buffer Overflow attempt

It's between my OpenFire server in the DMZ and our centralised DB server inside our network (port 3389).

There doesn't seem to be anywhere in Intrusion Protection -> Advanced -> Performance tuning to add a DMZ host of this type (ie. the OpenFire one). Or should I add the SQL server in there?

The IDS exceptions seem to be way too general. How can I say "between these two hosts turn off this SNORT IDS rule"?

TIA,

James

This thread was automatically locked due to age.

Parents

0 BAlfson over 15 years ago

Hey, James,

I think there's a feature request you can vote for that suggests that kind of granular exceptions in IPS, but I don't think you can do it today. Did you already add the SQL server in 'Performance Tuning'?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 James Bourne over 15 years ago in reply to BAlfson

Yes I added it today. Hopefully it will quiesce the error message. I'll vote though!
Cancel
Vote Up 0 Vote Down

Cancel
0 James Bourne over 15 years ago in reply to James Bourne

Also this exception is meaningless. The SNORT URL yields a 404:

http://www.snort.org/pub-bin/sigs.cgi?sid=13713

I tried adding the mySQL server box to the performance rules and am still getting the same error. does anyone know what it actually means? Googling yields little.
Cancel
Vote Up 0 Vote Down

Cancel
0 James Bourne over 15 years ago in reply to James Bourne

Also all the SNORT URLs are incorrect here:

Astaro IPS Rules

But I did find detail of the issue via CVE.
Cancel
Vote Up 0 Vote Down

Cancel
0 Richard Hughes over 14 years ago in reply to James Bourne

From nowhere, I seem to be inundated by these messages from clients using the SSL VPN client - I can't seem to pin it down to anything in particular.

Any suggestions?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Richard Hughes over 14 years ago in reply to James Bourne

From nowhere, I seem to be inundated by these messages from clients using the SSL VPN client - I can't seem to pin it down to anything in particular.

Any suggestions?
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data