Changeset 1653

Show
Ignore:
Timestamp:
11/12/06 12:54:42 (2 years ago)
Author:
mbr
Message:

added variables from snort.conf (such as EXTERNAL_NET and HTTP_SERVERS) to support the new signature interface

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • psad/branches/sigdevel/psad.conf

    r1648 r1653  
    4545### the FORWARD chain).  If there is only one network interface on 
    4646### the box, then just set this variable to "NOT_USED". 
    47  
    48 ### HOME_NET                192.168.10.4/24; 
    49 ### HOME_NET                10.1.1.0/24, 192.168.10.4/24; 
    50 ### HOME_NET                NOT_USED;  ### only one interface on box 
    51 HOME_NET                    _CHANGEME_; 
     47HOME_NET                    any; 
     48EXTERNAL_NET                any; 
     49 
     50### List of servers.  Fwsnort supports the same variable resolution as 
     51#### Snort. 
     52HTTP_SERVERS                $HOME_NET; 
     53SMTP_SERVERS                $HOME_NET; 
     54DNS_SERVERS                 $HOME_NET; 
     55SQL_SERVERS                 $HOME_NET; 
     56TELNET_SERVERS              $HOME_NET; 
     57 
     58#### AOL AIM server nets 
     59AIM_SERVERS                 [64.12.24.0/24, 64.12.25.0/24, 64.12.26.14/24, 64.12.28.0/24, 64.12.29.0/24, 64.12.161.0/24, 64.12.163.0/24, 205.188.5.0/24, 205.188.9.0/24]; 
     60 
     61### Configurable port numbers 
     62HTTP_PORTS                  80; 
     63SHELLCODE_PORTS             !80; 
     64ORACLE_PORTS                1521; 
    5265 
    5366### Firewall message search strings.  NOTE: the FW_MSG_SEARCH variable