Hello,To all

Ok now that i have snort installed should i
also install iptables do i need it

great weekend to all

Thank you

It depends
Snort is a signature based IDS (Intrusion Detection System), while IPTables is a Firewall.
An IDS alerts you in case there is an attack (it has some limited blocking like tcp reset or so). And a firewall is used to permit or block the access to some ip's, ports, protocls etc.
As a rule of thunmb you need a cascaded security solution with a firewall as the first layer of defence succeeded by an IDS (IDP).
Also see the following link for more information:
http://www.juniper.net/solutions/lit.../fw_idp_wp.pdf

Well, I find it hard to phrase it, but here goes

snort is only a IDS (intrusion DETECTION system)
opposed by iptables which are a firewall - meant to keep out people

I personally would install iptables as I am a very mistrusting person
and also use iptables to add a second layer of security on my applications

On client installations I often use 2 net tabs before and behind the firewall to have snort show me how well the firewall is and what has been stopped.

I hope this helps

PS there is a thread here about the necessity of a firewall
http://www.linuxquestions.org/questi...threadid=99496

If you want to block based on the snort alerts try snortsam
snortsam

Actually, snort is not just an IDS. It also does tcpdump-style packet logging, packet sniffing, IDS, and iptables-inline packet checking. My understanding is that it doesn't interfere with a firewall, if one is running on the system, though not all modes may be friendly with a firewall.. I don't know for certain on that point.

Dogit:

If you want to use inline mode , you'll need iptables setup and running, also ip_queue, which is how iptables passes packets on to snort. I think the most common way to use it is IDS mode, which doesn't require iptables or any other firewall.

The docs over at snort.org are pretty good.

are you putting iptables on the same machine as snort or are you planning on using snort behind a firewall to view attacks that made it through the firewall???

Also just to point it out you can use snort to create firewall rules dynamically when being attacked via iptables, however this can lead to a DOS attack if the attacker knows whats going on and uses it to his advantage, also care must be used becuase false positives could lead you to blocking legit traffic