topic Re: Re: Blocking intrusion detection. in Operating System - OpenVMS

Re: Blocking intrusion detection.

Jan van den Ende — Mon, 16 Feb 2004 05:05:55 GMT

oct 1 2003 Anwar-Ul-Haq started the "Blocking Intrusion Detection .. " stream.
Oct 3 John Gillings posted an answer with a little script.
I only entered the forum end december, and when I read this stream it immediately suggested the solution for a problem we have had since our desktop environment started using Citrix.
It is really quite simple, you just need to be smart enough to think it up (which we were not) or have it pointed out.
The real winner is the partial wildcard in "DELETE/INTRUSION some_substring_* ".

Because I think both Anwar (for formulating the question) and John (for the blinding pointer) well deserve points, I ask them to reply to this, just so I may award them.

Jan

Re: Re: Blocking intrusion detection.

John Gillings — Wed, 18 Feb 2004 16:42:30 GMT

Jan,
Just be careful you don't mask any real intrusions! Maybe log any intrusions you delete somewhere?

Re: Re: Blocking intrusion detection.

Jan van den Ende — Thu, 19 Feb 2004 02:16:58 GMT

John:
of course! (we also have a policy that users who err too often often are singled out, and receive some extra instruction, so we need the info anyway)

jpe

Re: Re: Blocking intrusion detection.

Mobeen_1 — Fri, 27 Feb 2004 03:23:49 GMT

Jan,
To be precise its supposed to be

DELETE/INTRU

rgds
Mobeen

Re: Re: Blocking intrusion detection.

Jan van den Ende — Mon, 08 Mar 2004 03:25:50 GMT

Mobeen,

sorry, but that _MAY_ be the case if the user logs in from a terminal, but in our case _several_ users ( up to 60 in peak hours) use _the_same_ source (a Citrix server) to login from.
The DELETE/INTRUSION should specify EXACTLY (including case sensitivity) what the SOURCE field in SHOW INTRUSION gives.
And my real winner in this was the wildcard possibility!

Thanks for reacting anyway!

Jan

Re: Re: Blocking intrusion detection.

Uwe Zessin — Mon, 08 Mar 2004 03:35:37 GMT

Mobeen,

if you like to see some other examples for the source you can see them with:

$ help delete/intrusion_record examples

Re: Re: Blocking intrusion detection.

Mobeen_1 — Mon, 08 Mar 2004 03:48:02 GMT

Jan,
Agreed :))

rgds
Mobeen