[Snort-users] Database and http rules questions.

Brei, Matt mbrei at ...8727...
Fri Jul 18 09:55:12 EDT 2003


Greetings,

 

I was wondering.  We have an office in NC and MT both will be using
Snort.  Can I have each site log to the same MySQL database and have
each site display as a different sensor?  Also, I'm not sure if snort is
the best way to go about it, but, I need to have some way of blocking
all but a few websites for most users, and allow anything for the
others.  I was thinking I could set the users that have full web access
to static IPs, block all destination port 80, and then put a pass rule
for the user's IPs that have full access and for the IP of the allowed
sites.  If there is a better way of doing this, please let me know.

 

Thank you,

 

Matt Brei

Network Administrator

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030718/a3479be8/attachment.html>


More information about the Snort-users mailing list