This tutorial explains how to set up PHPIDS on a web server with Apache2 and PHP5. PHPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web application.

In our first two installments on intrusion detection (see Resources), we got as far as setting up a Snort sensor on our network. Now it's time to set it up to automatically collect new rulesets, and set up BASE (Basic Analysis and Security Engine) to present all that data in a nice digestible way with graphs and sorting tools.

This tutorial describes how to install and configure Snort intrusion detection system (IDS), ACIDBASE (Basic Analysis and Security Engine), MySQL, and Apache2 on Ubuntu 9.04 using packages from Ubuntu’s Synaptic Package Manager. Snort will assist you in monitoring your network and alert you about possible threats.

In this tutorial I will describe how to install and configure Snort (an intrusion detection system (IDS)) from source, BASE (Basic Analysis and Security Engine), MySQL, and Apache2 on Ubuntu 7.10 (Gutsy Gibbon). Snort will assist you in monitoring your network and alert you about possible threats.

This tutorial is based on another howto written by DevilMan, however I didn't like the idea of manually compiling every package or the use of a GUI to get the software installed. This howto will work on a Gutsy Server or Gutsy desktop. With that said some of this howto is a direct copy from the original.

It’s a myth that any system that you connect to the internet is ’safe’. No matter how vigilant you are, there are always risks out there and so having some way of detecting that something bad has happened is a vital part of any security strategy.

This article shows how to install and configure ModSecurity (version 2) for use with Apache2 on a Debian Etch system. ModSecurity is an Apache module that provides intrusion detection and prevention for web applications. It aims at shielding web applications from known and unknown attacks, such as SQL injection attacks, cross-site scripting, path traversal attacks, etc.

Ninja is a privilege escalation detection  and  prevention system for GNU/Linux hosts.

AIDE (Advanced Intrusion Detection Enviornment) is a tool to check the file integrity. It is an opensource substitute for TRIPWIRE. It allows to take snapshots of all the major configuration files, binaries as well as libraries stats. It helps to find which binaries have been changed in case of compromisation of the system.