Koozali.org: home of the SME Server

Obsolete Releases => SME 7.x Contribs => Topic started by: alejandro on October 13, 2006, 12:11:15 AM

Title: SNORT suggestions needed(COMMUNITY MISC BAD-SSL tcp detect)
Post by: alejandro on October 13, 2006, 12:11:15 AM

I'm receiving this for an IP addres I trust and this ip has to have acces to my ssmtp server.
i'm thinking disabling this rule (don't know how anyway) but I'm not sure if it could be a potential security hole
so any suggestion about the meaning of this alert and /or how to disable to let this ip get mail from my server
Thanks in advance
A

Title: SNORT suggestions needed(COMMUNITY MISC BAD-SSL tcp detect)
Post by: JonB on October 13, 2006, 04:13:02 AM

This question is better placed on the SNORT forums however it appears that that rule produces a lot of false positives and the recommendation is to disable that signature.

Title: SNORT suggestions needed(COMMUNITY MISC BAD-SSL tcp detect)
Post by: alejandro on October 17, 2006, 03:46:42 AM

Quote from: "JonB"

This question is better placed on the SNORT forums....

As you can read at main forum description:
 
    SME 7.x Contribs
"Discussions related to development and use of addons for SME Server. Discuss user-contributed rpms, howto's and scripts here. "

I assume this is the right place.
I'm asking for help about using snort-base-oinkmaster (a user contrib pkg) inside SME 7....

Quote from: "JonB"

... however it appears that that rule produces a lot of false positives and the recommendation is to disable that signature.

I also assume you know the answer,  so.... Could you (or anyone else) tell me how to disable this specific signature in a safe way inside sme 7 ?
 (i've searched forums read snort and oinkmaster docs.etc .)

many thanks in advance again