Ethical Hacker Community Forums

(http://www.ethicalhacker.net/images/stories/columns/richm/diy_ids/ossec_logo.jpg)
 (http://www.ossec.net/)The best offense is a good defense.  This is a very famous phrase most often attributed to football, but it can be applied to many areas of life especially information security.  Diligent patching is a must, but even when done religiously (in conjunction with faithful anti-virus updates), vulnerabilities still exist.  There has never been more of a need for an Intrusion Detection System (IDS) than right now.  Attackers are more skilled and the tools they use more elaborate. We simply can't be everywhere at once and need IDS to be the eyes in the back of our head.

There are many great products out there, but as an introduction to IDS, I wanted to focus on OSSEC-HIDS (http://www.ossec.net/). OSSEC-HIDS is a great application to get your feet wet and open up the more advanced concepts of intrusion detection.  OSSEC agents will run on virtually all OSes including Solaris, OS X, Linux and Windows (2000 and XP).  The server itself is Linux based.  The configuration is fairly straightforward as outlined below.  This is a very basic introduction and should be considered a jumping off point.