程式扎記: [文章收集] Snort : Installing Snort on CentOS

標籤

2014年9月26日 星期五

[文章收集] Snort : Installing Snort on CentOS

Source From Here 
Preface 
Snort is a powerful intrusion prevention/detection system. This is a three part series going through the installation of Snort, the auto updating of rule sets via Pulledpork, configuration of Barnyard2 which will process Snort’s output, and the installation of a web front end gui called Snorby to help analyze those alerts. 

The configuration I have outlined will run Snort as an IDS thus only gathering information on traffic it can see. Snort is open source and is a product of Sourcefire. For $2.7 Billion, Sourcefire was acquired by Cisco in 2013

We will be going over the installation of Snort version 2.9.6.2 on CentOS 6.5 Minimal. Prior to installing Snort it is important to have accurate time configured. Check the current date with the command: 
# date
Tue Jul 15 08:42:28 PDT
# yum install -y ntpdate
# ntpdate 0.us.pool.ntp.org // 根據所在挑選最近的 time server.

Install Dependencies 
We’re going to install some dependencies which will be needed going forward. Since we are also using CentOS minimal we will need to install a few applications. 
# yum install -y wget gcc flex bison zlib zlib-devel libpcap libpcap-devel pcre pcre-devel tcpdump mysql mysql-server mysql-devel git libtool curl man

Now let’s create a temporary directory to store some files we will be downloading. 
# mkdir tmp && cd tmp

Next we need to install more dependencies. 
# wget http://pkgs.repoforge.org/libdnet/libdnet-1.11-1.1.el3.rf.x86_64.rpm
# wget http://pkgs.repoforge.org/libdnet/libdnet-devel-1.11-1.1.el3.rf.x86_64.rpm

Use the rpm command to install the dependencies we just downloaded. 
# rpm -i libdnet-1.11-1.1.el3.rf.x86_64.rpm 
# rpm -i libdnet-devel-1.11-1.1.el3.rf.x86_64.rpm
...
# rpm -qa | grep libdnet
libdnet-1.11-1.2.el6.rf.x86_64
libdnet-devel-1.11-1.2.el6.rf.x86_64

Install Snort 
I’m downloading the rpm files from Snort.org 
# yum install -y https://www.snort.org/downloads/snort/daq-2.0.2-1.centos6.x86_64.rpm
# yum install -y https://www.snort.org/downloads/snort/snort-2.9.6.2-1.centos6.x86_64.rpm

I recommend signing up on Snort.org to get the registered rules. You’ll receive something called an Oinkcode. The oinkcode acts as an api key for downloading rule packets from URLs provided by snort. Download and extract the Community Rules: 
# wget https://www.snort.org/downloads/community/community-rules.tar.gz
# tar -xvf community.tar.gz -C /etc/snort/rules

Download the registered rules. Be aware of which file you need. It depends on which version of Snort you’re running. In this case, I am running 2.9.6.2 so I am looking for the snort rules which contain the numbers 2962
# wget https://www.snort.org/downloads/registered/snortru...e=xxxxxxxxxxxxxxxxxxxxxxxxxxxx
# tar -xvf snortrules-snapshot-2962.tar.gz -C /etc/snort/rules

Paste your oincode after the = sign. Or you can download the xxx-2962.tar.gz directly from here. (Snort download

Modify the ownership of the Snort directories. 
# cd /etc/snort
# chown -R snort:snort *


Locate and Modify the snort.conf file 
# cd /etc/snort
# vi snort.conf // 編輯 snort configuration

There are many changes to make here. You can download an example of my snort.conf file and modify it to your environment. Some of the values are as follows. Just search for them in your configuration file: 
  1. ...  
  2. var RULE_PATH /etc/snort/rules  
  3. ipvar HOME_NET any #or set to a network such as 172.21.0.0/16  
  4. ipvar EXTERNAL_NET !$HOME_NET  
  5. var SO_RULE_PATH /etc/snort/rules/so_rules  
  6. var PREPROC_RULE_PATH /etc/snort/rules/preproc_rules  
  7. var WHITE_LIST_PATH /etc/snort/rules  
  8. var BLACK_LIST_PATH /etc/snort/rules  
  9. ...  
My working snort.conf file. I’ve disabled most of the rules except one. This was only to get a simple test going. 

Modify the Output string under Step 6 of the snort.conf file: 
  1. output unified2: filename snort.log, limit 128  
Test Snort 
Use this command to run Snort in test mode. It will tell you if there is anything wrong with running Snort. 
# snort -T -i <interface-name> -u snort -g snort -c /etc/snort/snort.conf
...
Snort successfully validated the configuration!
Snort exiting

* -T is the self-test mode switch.
* -i tells Snort what interface to use to gather traffic. You need to specific the interface you’re using right after.
* -u sets the user that will run the process.
* -g sets the group that will run the process.
* -c sets the configuration file to use.

Modify /etc/sysconfig/snort which holds variables for the startup file: 
* Change the interface which Snort is using to the interface you will use on your server to sniff traffic.
* Comment out ALERTMODE and BINARY_LOG. If you don’t do this your alerts will not write to the MySQL database in a later setup.

Here is an example of my /etc/sysconfig/snort file. 

Viewing Logs 
If the self-test runs successfully you can run Snort without the -T switch and replace it with a -D, for daemon. It will run Snort in the background. Once Snort is running and sniffing traffic, it should output to /var/log/snort

The snort.log file will be in Unified2 format which means you can’t open it in Wireshark. Anything Snort thinks is bad will trigger an alert. All alerts go into a file called alert within /var/log/snort/. For now, you have Snort running and dumping logs into a directory. Next up in this series I will discuss auto updating your Snort rule sets usingPulledpork

FAQ 
If you get this error: 
snort: error while loading shared libraries: libdnet.1: cannot open shared object file: No such file or directory

Type in the following commands: 
# /sbin/ldconfig
# updatedb

If you get this error: 
ERROR: c:\Snort\etc\snort.conf(511) => Unable to open address file C:\Snort\rules\white_list.rules, Error: No such file or directory

Probably answer: 
The whitelist and blacklist files are required by the reputation preprocessor. Snort's default installation doesnt create the list files, but it is up to you to create them.

If you dont want to use the reputation processor, just comment it out or remove it from your configuration file


Supplement 
What is an oinkcode? 
Oinkcodes are unique keys associated to your user account. The oinkcode acts as an api key for downloading rule packages with the urls listed below...

Protect your network with Snort 
Wiki of installation guide for CentOS 6.3 
Installing PulledPork and Barnyard2 for Snort

沒有留言:

張貼留言

網誌存檔

關於我自己

我的相片
Where there is a will, there is a way!