Public Key Detection
-
Can pfSense through suricata/snort/squid or other means, detect and block public keys? I attached an example of Sality Botnets Public RSA keys
-
Abuse.ch has an IDS feed. I don't think the pkg has an option to auto-download this feed, but you could manually add them.
https://sslbl.abuse.ch/blacklist/sslblacklist.rules
-
Thanks for the quick reply!
If there is one on this forum, can you point me in the direction of a write up on where to add the custom Suricata rules in pfSense? Is it as simple as something like this (attached)? or do I need to figure how to make a separate rules list (attached)?
EDIT
Found this post and got what I needed. https://forum.pfsense.org/index.php?topic=91438.0
Thanks again bcan!
