Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically i m looking for some Intrusion Detection system....

so i find snort is one of them , soi i need step by step configuration to install snort & some snort web-based monitoring tool " snort report "

is there any good alternative for Intrusion Detection system ? if yes how to install them

share|improve this question
I'm assuming 12.04 Server? – Mitch Jun 15 '12 at 11:45
yes............. – One Zero Jun 15 '12 at 11:52
up vote 4 down vote accepted

Snort is Network Intrusion Detection System (NIDS). Snort can sniff your network and alert you based on his rule DB if there is an attack on your computers network. It is an opensource system that was build from tcpdump (linux sniffer tool).

This guide can be used for installing snort.

psad: Intrusion Detection and Log Analysis with iptables psad is a collection of three lightweight system daemons (two main daemons and one helper daemon) that run on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic. A typical deployment is to run psad on the iptables firewall where it has the fastest access to log data.

If you using 12.04LTS Server, the see How to install PSAD Intrusion Detection on Ubuntu 12.04 LTS server.


share|improve this answer

You could take a look at fail2ban, which is directly contained in the repos (so you can simply "sudo apt-get install fail2ban"). I use it for years now, and it kept a lot of hackers out of my server by blocking them. Fail2ban works by parsing log files for specified patterns (it ships with a good sample config), and then blocking the attackers IP -- e.g. if a hacker made 5 failed attempts to login via ssh (even to different accounts), you can have his IP blocked for a specified length of time (e.g. 30min). There are examples shipped for different services, just take a look at the homepage for additional information.

Edit: Notifications are also possible (send a mail if something was detected).

share|improve this answer

To answer your question, a step-by-step configuration:,_with_Barnyard2,_Pulledpork,_and_Aanval

Also see this one, but the above worked better for me. Don't expect anything to work the first time though:

share|improve this answer
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Izzy Feb 17 '15 at 20:11
I agree @Izzy. The page is so long though, I couldn't think of a practical way to answer other than copy/pasting all 50ish pages on the URL. That would have been a formatting nightmare! :) – 00fruX Feb 18 '15 at 1:12
Well, you might at least rawly point out what it includes (maybe with some Wikipedia links to those products – I've only found Aanval there) plus a few words – I mean, Snort is widely known, the others I've not even heard of before), if it requires 5 years IT studies to deal with... So one knows at least what to expect and, if the page disappears one day, has some idea what to google for ;) – Izzy Feb 18 '15 at 8:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.