IDS Sensor (User Guide)

POPPIX - Userguide

Topics

• System description
• Policy Requirements
• System Requirements
• Sources
• Updating

System description

POPPIX is a Sensor for the eCSIRT.net Sensor Network based on a recent Knoppix distribution.

Policy Requirements

In order to join the eCSIRT.net Sensor Network you need to sign these documents:

• Code of Conduct
• Policy for the IDS Sensor Network

For further details, forms, etc. please contact us directly at ecsirt@ecsirt.net

System Requirements

• i386 compatible with
  • a bootable CD-ROM device
  • USB Support
  • (no floppy drive is needed)
• direct internet access via TCP/IP (NAT will not work)
• n+1 IP addresses, with n > 0 (n to be attacked, 1 to communicate with the time-server, to log incident-data etc.) All addresses must be routable.
• 1 USB stick (aka USB pen drive, USB flash hard drive)

Sources

In order to run a Sensor the following items are required:

• The ISO-image for the bootable CD.
• A personalized image to be put on the USB stick.

Updating

The POPPIX-CDROM itself cannot be updated automatically. The following components, however, can be updated: Snort signatures, Argus policies, Honeyd identities and the configuration software. Please note that POPPIX only pulls its updates and is not reachable from the Internet.

eCSIRT.net The European Computer Security Incident Response Team Network News | Sitemap | Imprint | Privacy Statement | Contact | Top Last changed: March 09, 2006 / TD Copyright © 2002-2006 by PRESECURE Consulting GmbH, Germany

Signed with PGP!