Re: Blocking intrusion detection.

[Jan van den Ende]

oct 1 2003 Anwar-Ul-Haq started the "Blocking Intrusion Detection .. " stream.
Oct 3 John Gillings posted an answer with a little script.
I only entered the forum end december, and when I read this stream it immediately suggested the solution for a problem we have had since our desktop environment started using Citrix.
It is really quite simple, you just need to be smart enough to think it up (which we were not) or have it pointed out.
The real winner is the partial wildcard in "DELETE/INTRUSION some_substring_* ".

Because I think both Anwar (for formulating the question) and John (for the blinding pointer) well deserve points, I ask them to reply to this, just so I may award them.

Jan

[John Gillings · Accepted solution]

Jan,
Just be careful you don't mask any real intrusions! Maybe log any intrusions you delete somewhere?

[Jan van den Ende]

John:
of course! (we also have a policy that users who err too often often are singled out, and receive some extra instruction, so we need the info anyway)

jpe

[Mobeen_1]

Jan,
To be precise its supposed to be

DELETE/INTRU

rgds
Mobeen

[Jan van den Ende]

Mobeen,

sorry, but that _MAY_ be the case if the user logs in from a terminal, but in our case _several_ users ( up to 60 in peak hours) use _the_same_ source (a Citrix server) to login from.
The DELETE/INTRUSION should specify EXACTLY (including case sensitivity) what the SOURCE field in SHOW INTRUSION gives.
And my real winner in this was the wildcard possibility!

Thanks for reacting anyway!

Jan

[Uwe Zessin]

Mobeen,

if you like to see some other examples for the source you can see them with:

$ help delete/intrusion_record examples

[Mobeen_1]

Jan,
Agreed :))

rgds
Mobeen