Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using Ubuntu and am wondering if installing Snort on my host can make me more vulnerable?

share|improve this question
    
As Graham Hill suggested in his answer, can you please add the role of this server? What software will run on it, etc. –  A.L Aug 12 at 2:21
    
it is not server, it is home desktop. for personal use. just wondering what kind of solution can be for protecting my home computers, for lonely protection i would use PSAD. but i wanted to protect my LAN,and mostly want to learn about IDS. –  user53427 Aug 12 at 5:16
    
Are the devices behind a firewall? –  A.L Aug 12 at 9:47
    
You can also always experiment on a virtual machine. –  brbtsl Aug 12 at 13:32
    
@user53427 Is your desktop or some services (SSH, web server, FTP, etc.) accessible from Internet? Do you use a router which share the Internet connection? –  A.L Aug 13 at 17:59

2 Answers 2

Any software you install on your machine that takes input from other machines you do not control makes you more vulnerable.

You must balance the additional risk you add by installing Snort against the costs of any treatment for that risk you might implement and the benefits of installing it.

We can't do that for you because we don't know your threat model or why you want to install Snort.

share|improve this answer

Yes. But with the latest and greatest version, perhaps not so much that I would worry about it in your case.

You can always google 'snort vulnerabilities' and note that most really bad known exploits relate to old versions. That is a pattern you'll see often.

For protecting your home computer:

  1. Backup
  2. Update your software
  3. Close down all services you do not use
  4. Anti-virus software with latest virus definitions
  5. Hardware based/stand alone 'stateful' firewall with packet inspection

Not necessary in that order..

Snort is great, but depending on your background it's possible you should start somewhere else. And definitely use third-party software vs Snort.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.