Source From Here
Preface
The purpose of this post is to provide guidance to Snort users who would like to try out Snort 2.9.7.0 and the OpenAppID features that it comes with. It is not intended to guide the reader through setting up Snort from scratch, there are plenty of docs on how to set up Snort at http://www.snort.org/docs.
Snort
Before we can download the latest Snort source code and compile it, we have a new prerequisite to fulfill before we can compile Snort. You'll need to install Luajit, which is used to define application detectors with the new OpenAppID.
Step #1, Prep the system.
You’ll need to download the following files from snort.org download page:
Step #2, Install Snort requirements
On my Ubuntu system this was as easy as the following command.
If you Linux is CentOS distribution, you can refer to CentOS LuaJIT Installation instructions
Libdnet-1.11 and LuaJIT were compiled and used so we were running the same versions as those who were developing OpenAppID. Besides that, we still have a few packages to compile and install:
Step #3 Building Snort with OpenAppID support.
Now we’re all set to download and install the RC (Release candidate) version of Snort. At the time this was written that was 2.9.7.0 rc (snort-2.9.7.0_rc.tar.gz). Grab the latest source from snort.org’s Download Snort page. Then we can extract and build.
Note the new flag on the configure command. We are adding that switch to enable OpenAppID.
Step #4 Configure Snort without OpenAppID enabled
Before we jump into the new capabilities of OpenAppID, it’s best to make sure the foundations are functioning. Snort needs some configuration files and directories to be made. (Using sudo if necessary)
A set of configuration files are included in the snort tarball. These can be copied into your /etc/snort/ directory.
The last thing to do is to add some of the VRT supplied rules to enable snort to detect ‘bad’ stuff. We’ve untarred unto a temp directory called ‘crules’, the name has no meaning.
The next step is to configure the /etc/snort/snort.conf file. They key changes made to get Snort working were:
To test Snort’s config the -T option can be used. If Snort has any problems with configuration, it will let you know.
If you encounter problem look like:
You can try below approach:
Application Detector Package
Step #5 Enabling OpenAppID in Snort.
The next step is to download the Application Detector Package. This entirely new content contains what is at the heart of the OpenAppID feature. You can download it from the Download Snort page on snort.org (currently: snort-openappid.tar.gz).
Once that is unpacked you will see an odp directory. Here you will see the appMapping.data file, which includes metadata about the application detectors. A simple way to explore what application detectors are included in this first release is to examine the second column of this file. If you’d like to see the list, try the following command.
You will also see the libs subdirectory, which contains the Lua libraries needed to run application detection. The port and lua subdirectories contain the applications detectors themselves. The port detectors are simple YAML files to patch port and application. The lua directory contains the bulk of the detectors. These lua scripts perform far more powerful detection.
Configure snort.conf
There are several changes to make in our snort.conf file. We must add the preprocessor command for OpenAppID and configure the output command.
Additionally, I suggest commenting out the following line.
Preface
The purpose of this post is to provide guidance to Snort users who would like to try out Snort 2.9.7.0 and the OpenAppID features that it comes with. It is not intended to guide the reader through setting up Snort from scratch, there are plenty of docs on how to set up Snort at http://www.snort.org/docs.
Snort
Before we can download the latest Snort source code and compile it, we have a new prerequisite to fulfill before we can compile Snort. You'll need to install Luajit, which is used to define application detectors with the new OpenAppID.
Step #1, Prep the system.
You’ll need to download the following files from snort.org download page:
Step #2, Install Snort requirements
On my Ubuntu system this was as easy as the following command.
If you Linux is CentOS distribution, you can refer to CentOS LuaJIT Installation instructions
Libdnet-1.11 and LuaJIT were compiled and used so we were running the same versions as those who were developing OpenAppID. Besides that, we still have a few packages to compile and install:
Step #3 Building Snort with OpenAppID support.
Now we’re all set to download and install the RC (Release candidate) version of Snort. At the time this was written that was 2.9.7.0 rc (snort-2.9.7.0_rc.tar.gz). Grab the latest source from snort.org’s Download Snort page. Then we can extract and build.
Note the new flag on the configure command. We are adding that switch to enable OpenAppID.
Step #4 Configure Snort without OpenAppID enabled
Before we jump into the new capabilities of OpenAppID, it’s best to make sure the foundations are functioning. Snort needs some configuration files and directories to be made. (Using sudo if necessary)
A set of configuration files are included in the snort tarball. These can be copied into your /etc/snort/ directory.
The last thing to do is to add some of the VRT supplied rules to enable snort to detect ‘bad’ stuff. We’ve untarred unto a temp directory called ‘crules’, the name has no meaning.
The next step is to configure the /etc/snort/snort.conf file. They key changes made to get Snort working were:
To test Snort’s config the -T option can be used. If Snort has any problems with configuration, it will let you know.
If you encounter problem look like:
You can try below approach:
Application Detector Package
Step #5 Enabling OpenAppID in Snort.
The next step is to download the Application Detector Package. This entirely new content contains what is at the heart of the OpenAppID feature. You can download it from the Download Snort page on snort.org (currently: snort-openappid.tar.gz).
Once that is unpacked you will see an odp directory. Here you will see the appMapping.data file, which includes metadata about the application detectors. A simple way to explore what application detectors are included in this first release is to examine the second column of this file. If you’d like to see the list, try the following command.
You will also see the libs subdirectory, which contains the Lua libraries needed to run application detection. The port and lua subdirectories contain the applications detectors themselves. The port detectors are simple YAML files to patch port and application. The lua directory contains the bulk of the detectors. These lua scripts perform far more powerful detection.
Configure snort.conf
There are several changes to make in our snort.conf file. We must add the preprocessor command for OpenAppID and configure the output command.
Additionally, I suggest commenting out the following line.
- # path to dynamic rules libraries
- #dynamicdetection directory /usr/local/lib/snort_dynamicrules <---comment class="keyword" nbsp="" span="" style="background-color: inherit; border: none; color: #006699; font-weight: bold; margin: 0px; padding: 0px;">this line
Configure OpenAppID Preprocessor
Our next step is to add the configuration for the OpenAppID preprocessor to the snort.conf file. Find the lines for the reputation preprocessor. This should be followed by commented text for “Step 6.” Just after the reputation preprocessor and before Step 6 we will add another preprocessor setting.
- ...
- preprocessor reputation: \
- memcap 500, \
- priority whitelist, \
- nested_ip inner, \
- whitelist $WHITE_LIST_PATH/white_list.rules, \
- blacklist $BLACK_LIST_PATH/black_list.rules
- preprocessor appid : app_stats_filename appstats-unified.log, app_stats_period 60, app_detector_dir /usr/local/lib/openappid
Configure Output
The final step in configuring our snort.conf file will be to change the output command. Everyone should be using the Unified2 output module already, but there is a new command to add new the new event field for the application in use. Look into Step 6 find the lines explaining the unified2 output type. In that section add the following line.
- ###################################################
- # Step #6: Configure output plugins
- # For more information, see Snort Manual, Configuring Snort - Output Modules
- ###################################################
- ...
- output unified2: filename snort.log, limit 128, appid_event_types
- ...
Now let’s fire up Snort.
Where eth? is which ever interface you will be monitoring with (e.g. eth0). To start Snort, the following command was used.
If there aren't any errors you will see the final line output by Snort indicating a successful startup, as “Commencing packet processing.” If you examine the output above that you will see a new section for AppID Configuration. This will include the configuration given to the preprocessor for reference.
To test the new deployment, fire up a web browser to test out application detection. For my test I used Chrome to visit cnn.com.
If you are still examining the console output of the Snort process you will see something to the effect of “Opening /var/log/snort/appstats-u2.log.xxxxxx for output.” Ending the Snort process will also write what data has not yet been output.
Examining Application Statistics
When you downloaded the Snort package, it included a tools subdirectory. In here you will find a couple of programs for changing the unified2 binary format to readable text. In this case we will use the u2openappid program to print the application statistics that Snort is collecting for us.
From this you can see a number of entries. In this case the above were generated from my visit to cnn.com. You can see that they share the same statTime. OpenAppID identifies the client application (Chrome), DNS request, protocol (http), and web app (cnn.com). The rest of the entries are other web apps embedded within CNN’s web page. To further illustrate the data we can get form OpenAppID, here is the output from when I instead use Firefox to visit Netflix.
Supplement
* Youtube - OpenAppID Install
* CentOS LuaJIT Installation instructions
沒有留言:
張貼留言