IPS and IDS Tools for Network Admin

Snort IPS is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Combining the benefits of signature, protocol and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide. With millions of downloads and over 250,000 registered users, Snort has become the de facto standard for IPS.

Sguil (pronounced sgweel) is built by network security analysts for network security analysts. Sguil’s main component is an intuitive GUI that provides access to realtime events, session data, and raw packet captures.

SQueRT was created to make most of the data from Sguil accessible via a web browser. While most analysts shun the idea of this, it is especially useful for some people (management, techs) that do not require the real-time event handling and analytical aspects (complexity) of the TCL/TK Sguil client. SQueRT is simply meant to provide a quick overview for non-analysts so that they can address certain obvious problem areas; for example policy violations.

SnoGE is a Snort unified reporting tool, it processes your unified files (that’s Snort’s output format), and represents them as place-marks on Google Earth. It can operate in a few modes, Real-time, refresh, and one-time.

Super Easy Firewall and Gateway System from Untangle

Untangle delivers an integrated family of applications that simplify and consolidate the network and security products that businesses need at the network gateway. All Untangle apps are:

• Pre-configured to work right away
• Downloadable for rapid deployment
• Guaranteed to be integrated and run seamlessly on the Untangle Gateway Platform

Some features included in open source editions :

• Virtual-Pipelining Technology
• Simple app install & uninstall
• Customized Debian OS
• Common GUI for all apps
• Logging & Reporting
• Automatic software upgrades
• Automatic signature updates
• Foreign language packs
• Adv.networking features
• Open Source & Free

UnTangle

Zimbra with Multiple Domains on Single Server

Zimbra mail server can handle multiple domain using it aliasing feature. To add a new domain alias we can use the following Zimbra command line provisioning tool.

zmprov cd foobar.com zimbraDomainType alias

We have to setup a mail catch to forward all incoming email with new domain alias to existing email domain.

zmprov md foobar.com zimbraMailCatchAllAddress @foobar.com zimbraMailCatchAllForwardingAddress @foo.com

We can verify now by sending to existing email with new domain alias.

Ubuntu 4GB Ram Limitation and Solution

Option # 1: Use 64 bit Ubuntu Linux 64 bit Linux kernel will take care of 4G or more memory. Just grab latest 64 bit version and install it.

Option #2: Install PAE enabled kernel

Open terminal and type the following command:

sudo apt-get update 

sudo sudo apt-get install linux-headers-server linux-image-server linux-server 

sudo reboot

To check and verify increment of the memory by using following command.

free -m

Drawing on TPanel Canvas by Exposing Protected Method

1. Create a descendant class.type

TMyPanel = class(TPanel)

1. Draw a ellipse on Panel Canvas.

TMyPanel(Form1.Panel1).Bitmap.Canvas.Ellipse( x, y, ellipse_size,ellipse_size);

Note : The Canvas property is Protected in TPanel and cannot be access from outside.

Alternative advanced method.

type
  TSizablePanel = class(TPanel)
  private
    FDragOrigin: TPoint;
    FSizeRect: TRect;
  protected
    procedure Paint; override;
    procedure MouseDown(Button: TMouseButton; Shift: TShiftState;
      X, Y: Integer); override;
    procedure MouseMove(Shift: TShiftState; X, Y: Integer); override;
    procedure MouseUp(Button: TMouseButton; Shift: TShiftState;
      X, Y: Integer); override;
  end;

procedure TSizeablePanel.Paint;
begin
  inherited;
  // Draw a sizing grip on the Canvas property
  // There's a size-grip glyph in the Marlett font,
  // so try the Canvas.TextOut method in combination
  // with the Canvas.Font property.
end;

procedure TSizeablePanel.MouseDown;
begin
  if (Button = mbLeft) and (Shift = []) 
      and PtInRect(FSizeRect, Point(X, Y)) then begin
    FDragOrigin := Point(X, Y);
    // Need to capture mouse events even if the mouse
    // leaves the control. See also: ReleaseCapture.
    SetCapture(Handle);
  end else inherited;
end;