SYSTEM WARNING: 'date_default_timezone_get(): It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone 'UTC' for now, but please set date.timezone to select your timezone.' in '/usr/share/mantis/www/core.php' line 264

Please see now our new Bugtracker system: JIRA

Anonymous | Login

2021-12-06 20:39 UTC

View Issue Details [ Jump to Notes ]				[ Issue History ] [ Print ]
ID	Project	Category	View Status	Date Submitted	Last Update
0003850	Endian Firewall	Intrusion Prevention	public	2011-06-03 10:06	2011-08-19 14:11
Reporter	ardit-endian
Assigned To
Priority	normal	Severity	major	Reproducibility	always
Status	feedback	Resolution	open
Platform		OS		OS Version
Product Version	2.4
Target Version		Fixed in Version
Summary	0003850: SNORT isn't blocking RDP
Description	Going to : Services => Intrusion Prevention, editing auto/emerging-policy.rules (Search with RDP) and setting drop for all this three rules, just as shown in the screenshot, the RDP works without problem, instead of dropping the RDP requests and responses. On outgoing the rule for my IP is set to Allow with IPS.
Additional Information	2.4 full up to date mini. NOTE: didn't check if the packets were really hitting SNORT chain or not.
Tags	purple
Attached Files	rdp-drop.png [^] (41,283 bytes) 2011-06-03 10:10
resolvedclosed

Relationships

Relationships

Notes
(0006872) luca-endian (developer) 2011-07-01 12:51	> NOTE: didn't check if the packets were really hitting SNORT chain or not. If you want to drop RDP protocol you must get the traffic to RDP port pass through snort. In this case why not just close the port? :) The real use would be to force all the traffic (any destination port) through snort and then snort should be able to detect RDP protocol even if the port is not the default one. By default not all the traffic (outgoing or incoming) is passing through snort that's probably the reason why it seems not to work.
(0007326) tiagoaviz (reporter) 2011-08-19 14:11	My idea of use would be to prevent people on my network from acessing RDP servers on alternate ports without my consent. In my case, all outbound traffic is going through snort.

Notes

Issue History
Date Modified	Username	Field	Change
2011-06-03 10:06	ardit-endian	New Issue
2011-06-03 10:07	ardit-endian	Summary	SNORT is blocking RDP => SNORT isn't blocking RDP
2011-06-03 10:09	ardit-endian	Tag Attached: purple
2011-06-03 10:10	ardit-endian	Additional Information Updated
2011-06-03 10:10	ardit-endian	File Added: rdp-drop.png
2011-07-01 12:51	luca-endian	Note Added: 0006872
2011-07-01 12:51	luca-endian	Note View State: 6872: public
2011-07-01 12:52	luca-endian	Status	new => feedback
2011-08-19 14:11	tiagoaviz	Note Added: 0007326

Issue History

Copyright © 2005-2008 Endian, SRL. All rights reserved.

---

Copyright © 2000 - 2012 MantisBT Group