Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Public Key Detection

    IDS/IPS
    2
    3
    490
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      TSubs
      last edited by

      Can pfSense through suricata/snort/squid or other means, detect and block public keys? I attached an example of Sality Botnets Public RSA keys

      1x 2.3.3-RELEASE-p1 (amd64) VM running on esxi 6.5

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        Abuse.ch has an IDS feed. I don't think the pkg has an option to auto-download this feed, but you could manually add them.

        https://sslbl.abuse.ch/blacklist/sslblacklist.rules

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • T
          TSubs
          last edited by

          Thanks for the quick reply!

          If there is one on this forum, can you point me in the direction of a write up on where to add the custom Suricata rules in pfSense? Is it as simple as something like this (attached)? or do I need to figure how to make a separate rules list (attached)?

          EDIT
          Found this post and got what I needed. https://forum.pfsense.org/index.php?topic=91438.0
          Thanks again bcan!




          1x 2.3.3-RELEASE-p1 (amd64) VM running on esxi 6.5

          1 Reply Last reply Reply Quote 0
          • First post
            Last post