Simply put, your small-to-medium business intranet is only as strong as its weakest point. In-depth defense is the only adequate approach to security. One compromised system on an intranet is all it takes for trojans, such as key-loggers, to be planted and used to scalp passwords and access even more systems. An in-depth defense requires both host and network auditing and detection, in addition to basic host and network perimeter security. Because any security can be defeated, it is essential to be alerted when it has been. There is no greater business liability than an intranet that has become unknowingly compromised.

IPCop is an ideal, low-budget solution for intranets that require comprehensive network security. On the surface, IPCop is an integrated Web interface with a formidable assortment of security tools. Inside, IPCop is actually a scaled-down Linux distribution outfitted and optimized to serve as a firewall. IPCop consists of several core components:

1. Linux Netfilter -- Stateful packet inspection (firewall) with NAT/PAT and full logging capabilities

2. Snort -- The community standard for real-time network IDS

3. Squid -- The community standard for Internet proxy

4. FreeS/WAN IPSec support, including instant inter-office VPNs, as well as pass-through

5. Various LAN services, including internal DHCP, external Dynamic DNS registration, etc.

6. Web-based configuration and administration

7. Built in self-patching/updating capabilities

8. Backup and restore of IPCop configuration

The purpose of IPCop is to bring these critical security applications into a complete security solution with a convenient Web interface.

Stateful packet inspection makes IPCop practically an "install and forget" firewall from the standpoint of desktop compatibility for outgoing connections. Of course, allowing any outgoing connection is not recommended, as compromised systems can "phone home". Like any advanced, stateful firewall, IPCop can limit outgoing connections as well as incoming. Such configuration does increase support costs because legitimate outgoing access must be tested for and enabled. IPCop provides a place to store custom rules and include them in backup and restore mechanisms so they are not lost during upgrades.

Read more at SysAdmin