Snort

`/etc/acid_conf.php` · var

# poldek -i snort acid
# mysql -u mysql -p
Enter password:
mysql> create database snort_log;
Query OK, 1 row affected (0.01 sec)
mysql> create database snort_archive;
Query OK, 1 row affected (0.01 sec)
mysql> quit
# gzip -d /usr/share/doc/snort-{wersja}/create_mysql.gz
# mysql -D snort_log -u mysql -p < \
    /usr/share/doc/snort-{wersja}/create_mysql
# gzip -d /usr/share/doc/acid-{wersja}/create_acid_tbls_mysql.sql.gz
# mysql -D snort_log -u mysql -p < \
    /usr/share/doc/acid-{wersja}/create_acid_tbls_mysql.sql

# mysql -D snort_archive -u mysql -p < \
    /usr/share/doc/snort-{wersja}/create_mysql
# mysql -D snort_archive -u mysql -p < \
    /usr/share/doc/acid-{wersja}/create_acid_tbls_mysql.sql
/etc/acid_conf.php
[...]
/* Alert DB connection parameters */
[...]
$alert_dbname   = "snort_log";
$alert_host     = "localhost";
$alert_port     = "3306";
$alert_user     = "login";
$alert_password = "haslo";

/* Archive DB connection parameters */
$archive_dbname   = "snort_archive";
$archive_host     = "localhost";
$archive_port     = "3306";
$archive_user     = "login.;
$archive_password = "haslo";
[...]
snort.conf
include: ścieżka_do_pliku/nazwa
.rules
classification.config
config classification: web-application-attack,Web Application Attack,1
reference.config
config reference: bugtraq http://www.securityfocus.com/bid/
threshold.conf
unicode.map
/etc/snort
/etc/snort/rules
# Adres sieci lokalnej
var HOME_NET [192.168.1.0/24,192.168.2.0/24]
# Adres sieci zewnetrznej
var EXTERNAL_NET !$HOME_NET
# Lista adresow serwerow znajdujacych sie w strefie chronionej
var DNS_SERVERS $HOME_NET
var SMTP_SERVERS $HOME_NET
var HTTP_SERVERS $HOME_NET
var SQL_SERVERS $HOME_NET
var TELNET_SERVERS $HOME_NET
var SNMP_SERVERS $HOME_NET
# Lista portow
var HTTP_PORTS 80
var SHELLCODE_PORTS !80
var ORACLE_PORTS 1521
# Lista serwerow czat, komunikatorow
var AIM_SERVERS [64.12.24.0/24,64.12.25.0/24,64.12.26.14/24,64.12.28.0/24,]
# Scieżka do katalogu z regulami atakow
var RULE_PATH /etc/snort/rules
config
# wybor interfejsu do nasłuchu (jeden demon Snorta moze 
# obslugiwac tylko jeden interfejs sieciowy) 
config interface: eth0
# detect_state_problems . zwraca alarm przy pokrywaniu sie fragmentow.
preprocessor frag2: detect_state_problems
# disable_evasion_alerts - brak alarmow przy nakladaniu sie 
#pakietow TCP, detect_scans - detektor prob cichego skanowania,
# detect_state_problems - detektor nienaturalnego zachowania
# pakietow.
preprocessor stream4: disable_evasion_alerts \
    detect_scans detect_state_problems
# both - skladanie sesji TCP w obu kierunkach pomiedzy 
# klientem i serwerem,
# ports - lista portow, na ktorych ma dzialac reasemblacja.
preprocessor stream4_reassemble: both ports [ 21 25 80 143 110 ]
# iis_unicode_map - wskazuje plik z kodowaniem unicode i wybiera standardowe.
preprocessor http_inspect: global is_unicode_map unicode.map 1252
# profile - wybor profilu ustawien dla serwerow typu iis, apacze i all.
preprocessor http_inspect_server: server adres_IP_serwera_MS_IIS \
	profile iis \
	ports { 80 }
preprocessor http_inspect_server: server adres_IP_serwera_Apache \
	profile apache \
	ports { 80 }
# alert_fragments . wlacza alarm, przy fragmentowaniu pakietow RPC,
# Domyślne porty: 111 i 32771.
preprocessor rpc_decode: 111 32771 alert_fragments
preprocessor bo
preprocessor telnet_decode
preprocessor arpspoof
preprocessor arpspoof_detect_host: adresy_IP \
    przypisane_do_nich_adresy_MAC
# console . wyswietlanie statystyk na ekranie,
# flow i events . statystyki badanego ruchu i ilosci dopasowanych
# regul,
# time . aktualizacja danych co 10s.
preprocessor perfmonitor: console flow events time 10
# stats_interval . zapisywanie statystyk, 0 - wylaczone,
# hash . wybor metody mieszania.
preprocessor flow: stats_interval 0 hash 2
# server-watchnet . adresy IP, na ktorych flow bedzie
# prowadzic badania,
# server-learning-time . czas utrzymania punktow dla danego adresu IP,
# server-scanner-limit . ilosc zapytan decydujacych o przyznaniu
# statusu
#                        skanowania z danego adresu,
# src-ignore-net, dst-ignore-net . lista ignorowanych adresow docelowych
#                                  i zrodlowych.
preprocessor flow-portscan: \
	server-watchnet [xxx.xxx.xxx.xxx/xx] \
	server-learning-time 14400 \
	server-scanner-limit 10 \
	src-ignore-net [xxx.xxx.xxx.xxx/xx, xxx.xxx.xxx.xxx/xx] \
	dst-ignore-net [xxx.xxx.xxx.xxx/xx]
snort.conf
output database: alert, mysql, user=login password=haslo \ 
dbname=snort_log host=127.0.0.1
ruletype czerwony_alarm
 {
	type log
	# zapis do demona syslogd, lokalnie
	output alert_syslog: LOG_ALER
 }
# Przykladowa regula:
czerwony_alarm $HOME_NET any -> $HOME_NET 6667 (msg:"Internal \
    IRC Server";)
classification.config, reference.config, 
		threshold.conf
include classification.config
include reference.config

include $RULE_PATH/bad-traffic.rules
include $RULE_PATH/exploit.rules
include $RULE_PATH/telnet.rules
include $RULE_PATH/rpc.rules
include $RULE_PATH/dos.rules
(...)
# dodatkowy zestaw regul Bleeding Snort - 
# http://www.bleedingsnort.com
include $RULE_PATH/bleeding.rules
include threshold.conf
/usr/local/bin
/etc
# wget --passive-ftp \
ftp://ftp.it.su.se/pub/users/andreas/oinkmaster/oinkmaster-1.0.tar.gz
# tar -zxvpf oinkmaster-1.0.tar.gz
# cp oinkmaster-1.0/oinkmaster.pl /usr/local/bin/
# cp oinkmaster-1.0/oinkmaster.conf /etc/
# /usr/local/bin/oinkmaster.pl -o /etc/snort/rules/
# /usr/local/bin/oinkmaster.pl -o /etc/snort/rules/ -q -u \
http://www.bleedingsnort.com/bleeding.rules.tar.gz
/etc/cron.daily
uprules
# touch /etc/cron.daily/uprules
# chmod 700 /etc/cron.daily/uprules
TMP=`mktemp /tmp/oinkmaster.XXXXXXXX` &&
(/usr/local/bin/oinkmaster.pl -o /etc/snort/rules/ \
    -q > $TMP 2>&1;
if [ -s $TMP ]; then mail -s "Update Snort Rules" root@twoja_domena < $TMP; fi;
rm $TMP)

# dodatkowy zestaw regul Bleeding Snort - http://www.bleedingsnort.com
TMP=`mktemp /tmp/oinkmaster.XXXXXXXX` &&
(/usr/local/bin/oinkmaster.pl -o /etc/snort/rules/ -q -u \
http://www.bleedingsnort.com/bleeding.rules.tar.gz > $TMP 2>&1;
if [ -s $TMP ]; then mail -s "Update Bleeding Rules" \
    root@twoja_domena < $TMP; fi; rm $TMP)

/etc/rc.d/init.d/snort restart
-v
-d
-e
snort -ved
-l
-b
-ved
snort -b -l ./log
-r
snort -r /var/log/snort/snort.log
snort -vde src port www
snort -vde not ( src net 192.168.1 and dst port 80)
-F
snort -r snort.log -F plik_z_bdf
-c
-D
snort -d -D -c snort.conf
-h
log tcp any any -> 192.168.1.0/24 110
snort.conf
log tcp $EXTERNAL_NET -> $HOME_NET 110
alert tcp any any <> $HOME_NET 23
log tcp $EXTERNAL_NET -> $HOME_NET 110 \
    ("msg: Proba polaczenia z pop3";)
alert tcp any any -> 192.168.1.0/24 80 (content: "/cgi-bin/phf"; \
    msg: "PHF probe!";)
content
activate tcp any any -> $HOME_NET 143 (flags: PA; content: \
"|E8C0FFFFFF|bin|;activates: 1; msg: "IMAP buffer overflow!";)
dynamic tcp any any -> $HOME_NET 143 (activated_by: 1; count: 50;)
activates
activated_by
activate
dynamic
resp
react
resp
react

Snort - Sieciowy System Wykrywania Włamań

Wymagania

Instalacja Snorta i ACID

Konfiguracja Snorta

Aktualizacja reguł

Instalacja Oinkmaster

Architektura Snorta

Tryby pracy

Preprocesory

Moduł sygnatur

Ciekawe projekty