Snort IDS installation

Requirements

• Database server (MySQL). See MySQL server

Sources

• Ubuntu-FR Snort: http://doc.ubuntu-fr.org/snort
• Ubuntu-FR Snort-inline [IPS]: http://doc.ubuntu-fr.org/snort_inline

SNORT installation

Requirements

You need to add a new MySQL database and user for snort.

hint: you can use PHPMyAdmin or MySQL workbench to do so!

Installation

Packages

apt-get install snort snort-doc snort-rules-default snort-common snort-common-libraries oinkmaster
apt-get install libcrypt-ssleay-perl liblwp-protocol-https-perl

During the installation you will be ask for the $HOME_NET.

• If plan to protect a network, use the Network IP@/Submask
• For a single computer put IP@/32. Do that for servers that are hosted somewhere on the cloud (OVH, TripNet, ...).

Basic configuration

Interactive way

dpkg-reconfigure snort

• Boot
• Interface: eth0
• set the IP@ of your server
• Do NOT enable promiscuous mode
• No custom options
• (optional) daily reports by email

Manual way

Set attributes:

vim /etc/snort/snort.debian.conf

!! Note that settings are set in Debian configuration, the .conf is SNORT global configuration !!

DEBIAN_SNORT_HOME_NET="IP@/submask"

Know your version of snort

snort -V

you should see something like that:

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.6.0 GRE (Build 47)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
           Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using libpcap version 1.5.3
           Using PCRE version: 8.31 2012-07-06
           Using ZLIB version: 1.2.8

Configure rules and update

SNORT account

Get a SNORT account: https://www.snort.org

Each SNORT account has an OINKCODE, that is required to get the updates.

Oinkmaster

Oinkmaster is THE reference tool to get the rules updates. However, that's a pain to configure. :'(

Instead of that, the community as created "Pulled Pork": that's a script that does the configuration for you.

Pulled Pork

Preparation

PulledPork required specifics files & folders:

mkdir -p /etc/snort/rules/iplists
touch /etc/snort/rules/iplists/default.blacklist
chmod 777 /etc/snort/rules/iplists/default.blacklist

Get Pulled Pork

Get the latest version of Pulled Pork: https://code.google.com/p/pulledpork/downloads/list

cd /tmp && wget https://pulledpork.googlecode.com/files/pulledpork-0.7.0.tar.gz

Installation

Unzip the archive and open it

tar xvf pulledpork-0.7.0.tar.gz
cd pulledpork-0.7.0

Copy configuration files to the /etc/snort + start script (pulledpork.pl) to the /usr/local/bin/ directory.

cp pulledpork.pl /usr/local/bin/pulledpork.pl
chmod 755 /usr/local/bin/pulledpork.pl
cp etc/* /etc/snort/

Configuration

Edit PulledPork configuration

vim /etc/snort/pulledpork.conf

Set / adjust the following settings:

## Set your OinkCode
## Lines 19,21,24,26 replace <oinkcode> by your own.
rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|<oinkcode>
rule_url=https://s3.amazonaws.com/snort-org/www/rules/community/|community-rules.tar.gz|Community
rule_url=http://labs.snort.org/feeds/ip-filter.blf|IPBLACKLIST|open
rule_url=https://www.snort.org/reg-rules/|opensource.gz|<oinkcode>

## Line 72 (default = /usr/local/etc/snort/rules/snort.rules)
rule_path=/etc/snort/rules/snort.rules

## Line 87 (default = /usr/local/etc/snort/rules/local.rules)
local_rules=/etc/snort/rules/local.rules

## Line 90 (default = /usr/local/etc/snort/sid-msg.map)
sid_msg=/etc/snort/sid-msg.map

## Line 110 (default = /usr/local/lib/snort_dynamicrules/)
sorule_path=/usr/lib/snort_dynamicrules/

## Line 113 (default = /usr/local/bin/snort)
snort_path=/usr/sbin/snort

## Line 117 (default = /usr/local/etc/snort/snort.conf)
config_path=/etc/snort/snort.conf

## Line 120 uncomment and adjust (default = /usr/local/etc/snort/rules/so_rules.rules) 
sostub_path=/etc/snort/rules/so_rules.rules

## Line 131
distro=Ubuntu-14.04

## Line 139 (default = /usr/local/etc/snort/rules/iplists/default.blacklist)
black_list=/etc/snort/rules/iplists/default.blacklist

## Line 148 (default = /usr/local/etc/snort/rules/iplists)
IPRVersion=/etc/snort/rules/iplists

## Line 190 uncomment the snort_version line
######
# Put your right version like 2.9.6.0
# You can check what are the available versions on https://www.snort.org/downloads/#rule-
# Usually there is no 2.9.6.0 but 2.9.6.1, 2.9.6.2,... instead
###
snort_version=2.9.6.1

Get rules

Execute Pulled Pork

pulledpork.pl -c /etc/snort/pulledpork.conf

You should see something like:

    http://code.google.com/p/pulledpork/
      _____ ____
     `----,\    )
      `--==\\  /    PulledPork v0.7.0 - Swine Flu!
       `--==\\/
     .-~~~~-.Y|\\_  Copyright (C) 2009-2013 JJ Cummings
  @_/        /  66\_  cummingsj@gmail.com
    |    \   \   _(")
     \   /-| ||'--'  Rules give me wings!
      \_\  \_\\
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

...

Fly Piggy Fly!

Test snort

You can check that SNORT is working with your rules by launching it. See #Run SNORT

Get rules periodically

The best way to get rules periodically is to setup a cronjob.

Create an entry in crontab to automate the process of keeping the Snort rules up to date.

0 2 * * * pulledpork.pl -c /etc/snort/pulledpork.conf -H -v >> /var/log/pulledpork 2>&1 #Update Snort Rules

Run SNORT

This is how you can start SNORT manually:

snort -c /etc/snort/snort.conf

if OK you should see:

...

4150 Snort rules read
    3476 detection rules
    0 decoder rules
    0 preprocessor rules
3476 Option Chains linked into 271 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

...

        --== Initialization Complete ==--

'Ctrl + C' to exit.

If there's some errors, then you can check the /var/log/syslog

.. You might have to comment some rules, depending on your configuration...

Managing rules

All the rules are not enable by default. According to your own policy, you might want to enable / disable some specifics rules.

Have a look to your configuration file

vim /etc/snort/snort.conf

Cf STEP 7 (~ line 555).