Snort IDS installation
- 1 Requirements
- 2 Sources
- 3 SNORT installation
- 4 Configure rules and update
- 5 Run SNORT
- 6 Managing rules
- Database server (MySQL). See MySQL server
- Ubuntu-FR Snort: http://doc.ubuntu-fr.org/snort
- Ubuntu-FR Snort-inline [IPS]: http://doc.ubuntu-fr.org/snort_inline
You need to add a new MySQL database and user for snort.
apt-get install snort snort-doc snort-rules-default snort-common snort-common-libraries oinkmaster apt-get install libcrypt-ssleay-perl liblwp-protocol-https-perl
During the installation you will be ask for the $HOME_NET.
- If plan to protect a network, use the Network IP@/Submask
- For a single computer put IP@/32. Do that for servers that are hosted somewhere on the cloud (OVH, TripNet, ...).
- Interface: eth0
- set the IP@ of your server
- Do NOT enable promiscuous mode
- No custom options
- (optional) daily reports by email
!! Note that settings are set in Debian configuration, the .conf is SNORT global configuration !!
Know your version of snort
you should see something like that:
,,_ -*> Snort! <*- o" )~ Version 220.127.116.11 GRE (Build 47) '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using libpcap version 1.5.3 Using PCRE version: 8.31 2012-07-06 Using ZLIB version: 1.2.8
Configure rules and update
Get a SNORT account: https://www.snort.org
Each SNORT account has an OINKCODE, that is required to get the updates.
Oinkmaster is THE reference tool to get the rules updates. However, that's a pain to configure. :'(
Instead of that, the community as created Pulled Pork: that's a script that does the configuration for you.
PulledPork required specifics files & folders:
mkdir -p /etc/snort/rules/iplists touch /etc/snort/rules/iplists/default.blacklist chmod 777 /etc/snort/rules/iplists/default.blacklist
Get Pulled Pork
Get the latest version of Pulled Pork: https://code.google.com/p/pulledpork/downloads/list
cd /tmp && wget https://pulledpork.googlecode.com/files/pulledpork-0.7.0.tar.gz
Unzip the archive and open it
tar xvf pulledpork-0.7.0.tar.gz cd pulledpork-0.7.0
Copy configuration files to the /etc/snort + start script (pulledpork.pl) to the /usr/local/bin/ directory.
cp pulledpork.pl /usr/local/bin/pulledpork.pl chmod 755 /usr/local/bin/pulledpork.pl cp etc/* /etc/snort/
Edit PulledPork configuration
Set / adjust the following settings:
## Set your OinkCode ## Lines 19,21,24,26 replace <oinkcode> by your own. rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|<oinkcode> rule_url=https://s3.amazonaws.com/snort-org/www/rules/community/|community-rules.tar.gz|Community rule_url=http://labs.snort.org/feeds/ip-filter.blf|IPBLACKLIST|open rule_url=https://www.snort.org/reg-rules/|opensource.gz|<oinkcode> ## Line 72 (default = /usr/local/etc/snort/rules/snort.rules) rule_path=/etc/snort/rules/snort.rules ## Line 87 (default = /usr/local/etc/snort/rules/local.rules) local_rules=/etc/snort/rules/local.rules ## Line 90 (default = /usr/local/etc/snort/sid-msg.map) sid_msg=/etc/snort/sid-msg.map ## Line 110 (default = /usr/local/lib/snort_dynamicrules/) sorule_path=/usr/lib/snort_dynamicrules/ ## Line 113 (default = /usr/local/bin/snort) snort_path=/usr/sbin/snort ## Line 117 (default = /usr/local/etc/snort/snort.conf) config_path=/etc/snort/snort.conf ## Line 120 uncomment and adjust (default = /usr/local/etc/snort/rules/so_rules.rules) sostub_path=/etc/snort/rules/so_rules.rules ## Line 131 distro=Ubuntu-14.04 ## Line 139 (default = /usr/local/etc/snort/rules/iplists/default.blacklist) black_list=/etc/snort/rules/iplists/default.blacklist ## Line 148 (default = /usr/local/etc/snort/rules/iplists) IPRVersion=/etc/snort/rules/iplists ## Line 190 uncomment the snort_version line ###### # Put your right version like 18.104.22.168 # You can check what are the available versions on https://www.snort.org/downloads/#rule- # Usually there is no 22.214.171.124 but 126.96.36.199, 188.8.131.52,... instead ### snort_version=184.108.40.206
Execute Pulled Pork
pulledpork.pl -c /etc/snort/pulledpork.conf
You should see something like:
http://code.google.com/p/pulledpork/ _____ ____ `----,\ ) `--==\\ / PulledPork v0.7.0 - Swine Flu! `--==\\/ .-~~~~-.Y|\\_ Copyright (C) 2009-2013 JJ Cummings @_/ / 66\_ email@example.com | \ \ _(") \ /-| ||'--' Rules give me wings! \_\ \_\\ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... Fly Piggy Fly!
You can check that SNORT is working with your rules by launching it. See #Run SNORT
Get rules periodically
The best way to get rules periodically is to setup a cronjob.
Create an entry in crontab to automate the process of keeping the Snort rules up to date.
0 2 * * * pulledpork.pl -c /etc/snort/pulledpork.conf -H -v >> /var/log/pulledpork 2>&1 #Update Snort Rules
This is how you can start SNORT manually:
snort -c /etc/snort/snort.conf
if OK you should see:
... 4150 Snort rules read 3476 detection rules 0 decoder rules 0 preprocessor rules 3476 Option Chains linked into 271 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ ... --== Initialization Complete ==--
'Ctrl + C' to exit.
If there's some errors, then you can check the /var/log/syslog
.. You might have to comment some rules, depending on your configuration...
All the rules are not enable by default. According to your own policy, you might want to enable / disable some specifics rules.
Have a look to your configuration file
Cf STEP 7 (~ line 555).
Don't forget to restart SNORT !
service snort restart