Snort-IPS-入侵防御系统安装及部署小记

sudo apt-get update && sudo apt-get dist-upgrade -y
sudo dpkg-reconfigure tzdata
mkdir ~/snort_src
cd ~/snort_src
sudo apt-get install -y build-essential autotools-dev libdumbnet-dev \
libluajit-5.1-dev libpcap-dev zlib1g-dev pkg-config libhwloc-dev \
cmake
sudo apt-get install -y liblzma-dev openssl libssl-dev cpputest \
libsqlite3-dev uuid-dev
sudo apt-get install -y asciidoc dblatex source-highlight w3m
sudo apt-get install -y libtool git autoconf
sudo apt-get install -y bison flex libcmocka-dev
sudo apt-get install -y libnetfilter-queue-dev libmnl-dev
cd ~/snort_src
#直接从github下载较慢，已转存至gitee
wget https://gitee.com/deng_wenyi/snort3-ubuntu-install-source-code/repository/archive/master.zip
apt install unzip
unzip master.zip
mv snort3-ubuntu-install-source-code/libsafec-08112019.0-gad76c7.tar.gz ./
tar -xzvf libsafec-08112019.0-gad76c7.tar.gz
cd libsafec-08112019.0-gad76c7/
./configure
make
sudo make install
cd ~/snort_src/
mv snort3-ubuntu-install-source-code/pcre-8.43.tar.gz ./
tar -xzvf pcre-8.43.tar.gz
cd pcre-8.43
./configure
make
sudo make install
sudo apt-get install -y libunwind-dev
cd ~/snort_src
mv snort3-ubuntu-install-source-code/gperftools-2.7.90.tar.gz ./
tar xzvf gperftools-2.7.90.tar.gz
cd gperftools-2.7.90
./configure
make
sudo make install
cd ~/snort_src
mv snort3-ubuntu-install-source-code/ragel-6.10.tar.gz ./
tar -xzvf ragel-6.10.tar.gz
cd ragel-6.10
./configure
make
sudo make install
cd ~/snort_src
#boost库比较大（约120M），见百度网盘下载；或使用原链接下载
#链接: https://pan.baidu.com/s/1GOM1KXJDjBMsElGw7q3fRg  密码: e4av
#--来自百度网盘超级会员V4的分享
wget https://dl.bintray.com/boostorg/release/1.72.0/source/boost_1_72_0.tar.gz
tar -xvzf boost_1_72_0.tar.gz
cd ~/snort_src
mv snort3-ubuntu-install-source-code/hyperscan-5.2.1.tar.gz ./
tar -xvzf hyperscan-5.2.1.tar.gz
mkdir ~/snort_src/hyperscan-5.2.1-build
cd hyperscan-5.2.1-build/
cmake -DCMAKE_INSTALL_PREFIX=/usr/local -DBOOST_ROOT=~/snort_src/boost_1_72_0/ ../hyperscan-5.2.1
make
sudo make install
cd ~/snort_src/hyperscan-5.2.1-build/
./bin/unit-hyperscan
cd ~/snort_src
mv snort3-ubuntu-install-source-code/flatbuffers-v1.12.0.tar.gz ./
tar -xzvf flatbuffers-v1.12.0.tar.gz
mkdir flatbuffers-build
cd flatbuffers-build
cmake ../flatbuffers-1.12.0
make
sudo make install
cd ~/snort_src
git clone https://gitee.com/deng_wenyi/snort3-libdaq.git
cd snort3-libdaq
./bootstrap
./configure
make
sudo make install
sudo ldconfig
cd ~/snort_src
git clone https://gitee.com/deng_wenyi/snortadmin-snort3.git
cd snortadmin-snort3/
./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc
cd build
make
sudo make install
/usr/local/bin/snort -V
root@UbuntuServer:~/snort_src/snortadmin-snort3/build# /usr/local/bin/snort -V

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.0.3 (Build 5)
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.0
           Using LuaJIT version 2.0.4
           Using OpenSSL 1.0.2g  1 Mar 2016
           Using libpcap version 1.7.4
           Using PCRE version 8.43 2019-02-23
           Using ZLIB version 1.2.8
           Using FlatBuffers 1.12.0
           Using Hyperscan version 5.2.1 2020-12-13
           Using LZMA version 5.1.0alpha
snort -c /usr/local/etc/snort/snort.lua
Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting
sudo ethtool -k ens3 | grep receive-offload
generic-receive-offload: on
large-receive-offload: off [fixed]
sudo vi /lib/systemd/system/ethtool.service
[Unit]
Description=Ethtool Configration for Network Interface

[Service]
Requires=network.target
Type=oneshot
ExecStart=/sbin/ethtool -K ens3 gro off
ExecStart=/sbin/ethtool -K ens3 lro off

[Install]
WantedBy=multi-user.target
sudo systemctl enable ethtool
sudo service ethtool start
sudo ethtool -k ens3 | grep receive-offload
generic-receive-offload: off
large-receive-offload: off [fixed]
cd ~/snort_src/
wget https://snort.org/downloads/openappid/15607
mv 15607 15607.tar.gz
tar -xzvf 15607.tar.gz
sudo cp -R odp /usr/local/lib/
sudo vi /usr/local/etc/snort/snort.lua
appid =
{

    −− appid requires this to use appids in rules
    app_detector_dir = '/usr/local/lib',
 }
snort -c /usr/local/etc/snort/snort.lua --warn-all
...
Finished /usr/local/etc/snort/snort.lua:
WARNING: appid: no lua detectors found in directory '/usr/local/lib/custom/lua/*'
--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 1 warnings).
o")~ Snort exiting
sudo mkdir /usr/local/etc/rules
sudo touch /usr/local/etc/rules/local.rules
sudo vi /usr/local/etc/rules/local.rules
alert tcp any any -> any any ( msg:"Facebook Detected"; appids:"Facebook";sid:10000001; )
alert icmp any any -> any any (msg:"ICMP Traffic Detected";sid:10000002;)
snort -c /usr/local/etc/snort/snort.lua \
-R /usr/local/etc/rules/local.rules
sudo snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules \
-i eth0 -A alert_fast -s 65535 -k none
Commencing packet processing
++ [0] eth0
wget facebook.com
05/30−21:26:48.482231 [**] [1:10000001:0] "Facebook Detected" [**] [Priority: 0] [AppID: Facebook] {TCP} 10.10.10.170:59632 −>
    185.60.216.35:80
05/30−21:26:48.506197 [**] [1:10000001:0] "Facebook Detected" [**] [Priority: 0] [AppID: Facebook] {TCP} 185.60.216.35:80 −>
    10.10.10.170:59632
...
sudo mkdir /var/log/snort
appid =
{

    app_detector_dir = '/usr/local/lib',
    log_stats = true,
}
sudo snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules \
-i eth0 -A alert_fast -s 65535 -k none -l /var/log/snort
sudo chmod a+r /var/log/snort/appid_stats.log
noah@snort3:~/snort_src$ cat /var/log/snort/appid_stats.log
1549218716,DNS,1576,1778
1549218716,Facebook,8727,630912
1549218716,OpenSSH,19523,2344
1549218716,SSH,19523,23445
1549218716,HTTPS,8727,630912
1549218716,SSL client,8727,630912
1549218716,ICMP,392,392
1549218716,__unknown,11028,139100
sudo mkdir /usr/local/etc/rules
sudo mkdir /usr/local/etc/builtin_rules

sudo mkdir /usr/local/etc/so_rules
sudo mkdir /usr/local/etc/lists
cd ~/snort_src/

#在此提供了注册规则集的下载地址，但仍希望您去官方下载，因为它有可能会失效
wget https://www.snort.org/rules/snortrules-snapshot-3034.tar.gz?oinkcode=0e0795beeba6b8bd7c1d5b2727e48ad7a9202eb6 -O snortrules-snapshot-3034.tar.gz 

mkdir snortrules-3034
tar -xvzf snortrules-snapshot-3034.tar.gz -C ./snortrules-3034
cd snortrules-3034

#复制单个规则文件
sudo cp ./rules/*.rules /usr/local/etc/rules/

#复制内建规则文件
sudo cp ./builtins/builtins.rules /usr/local/etc/builtin_rules/

#复制新的配置文件(我们将覆盖当前的配置)。
sudo cp ./etc/* /usr/local/etc/snort/
sudo vi /usr/local/etc/snort/snort.lua
HOME_NET = '10.0.0.0/24'
rules = [[

        include $RULE_PATH/snort3-app-detect.rules
        include $RULE_PATH/snort3-browser-chrome.rules
        include $RULE_PATH/snort3-browser-firefox.rules
        include $RULE_PATH/snort3-browser-ie.rules
        ...
snort -c /usr/local/etc/snort/snort.lua
Finished /usr/local/etc/snort/snort.lua:
Loading ips.rules:
FATAL: ips.rules:3 undefined variable name: RULE_PATH.
Fatal Error, Quitting..
...

--------------------------------------------------
rule counts
total rules loaded: 12581
text rules: 12581
option chains: 12581
chain headers: 458
--------------------------------------------------

(lines ommited from output)...

Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
除非指定了–warn-*，否则不会发出警告。-warn-all 启用所有警告，而 –
pedantic会使这些警告致命
sudo vi /usr/local/etc/snort/snort.lua
include $BUILTIN_RULE_PATH/builtins.rules
ips =
{
-- use this to enable decoder and inspector alerts
enable_builtin_rules = true,

-- use include for rules files; be sure to set your path
-- note that rules files can include other rules files
--include = 'snort3-community.rules',

-- The following include syntax is only valid for ...
-- RULE_PATH is typically set in snort_defaults.lua
rules = [[
include $BUILTIN_RULE_PATH/builtins.rules

include $RULE_PATH/snort3-app-detect.rules
include $RULE_PATH/snort3-browser-chrome.rules

}
snort -c /usr/local/etc/snort/snort.lua
Loading ips.rules:
Loading ../builtin_rules/builtins.rules:
Finished ../builtin_rules/builtins.rules:
Loading ../rules/snort3-app-detect.rules:
...

--------------------------------------------------
rule counts
total rules loaded: 13106
duplicate rules: 448
text rules: 12581
builtin rules: 525
option chains: 13106
chain headers: 458
--------------------------------------------------
snort -c /usr/local/etc/snort/snort.lua \
-R /usr/local/etc/rules/local.rules
Finished ips.rules:
Loading rule args:
Loading /usr/local/etc/rules/local.rules:
Finished /usr/local/etc/rules/local.rules:
Finished rule args:
--------------------------------------------------
rule counts
total rules loaded: 13108
appid =
{
    app_detector_dir = '/usr/local/lib',
    log_stats = true,
}
sudo snort -c /usr/local/etc/snort/snort.lua \
-R /usr/local/etc/rules/local.rules \
-i eth0 -A alert_fast -s 65535 -k none -l /var/log/snort
cd ~
mkdir pcaps
cd pcaps

wget https://download.netresec.com/pcap/maccdc-2012/maccdc2012_00000.pcap.gz
gunzip maccdc2012_00000.pcap.gz

wget https://download.netresec.com/pcap/maccdc-2012/maccdc2012_00001.pcap.gz
gunzip maccdc2012_00001.pcap.gz
snort -c /usr/local/etc/snort/snort.lua \
-r ~/pcaps/maccdc2012_00000.pcap -A alert_fast -s 65535 -k none
snort -c /usr/local/etc/snort/snort.lua --pcap-filter \*.pcap \
--pcap-dir ~/pcaps -A alert_fast -s 65535 -k none
1 --------------------------------------------------
2 Module Statistics
3 --------------------------------------------------
4 detection
5 analyzed: 8635943
6 hard_evals: 554185
7 raw_searches: 177185
8 cooked_searches: 306618
9 pkt_searches: 483803
10 alt_searches: 39
11 key_searches: 77449
12 header_searches: 221406
13 body_searches: 768
14 file_searches: 71801
15 total_alerts: 42392
16 logged: 42392
17 --------------------------------------------------
18
19 ...
20
21 --------------------------------------------------
22 Summary Statistics
23 --------------------------------------------------
24 timing
25 runtime: 00:03:41
26 seconds: 221.654928
27 pkts/sec: 39076
28 Mbits/sec: 32
alert_csv =
{
file = true,
}
sudo snort -c /usr/local/etc/snort/snort.lua -r ~/pcaps/maccdc2012_00000.pcap \
-s 65535 -k none -l /var/log/snort -q -m 0x1b
noah@snort3:~$ wc -l /var/log/snort/alert_csv.txt
42299 /var/log/snort/alert_csv.txt
sudo vi /usr/local/etc/snort/snort.lua
--alert_csv =
--{
--file = true,
--}

alert_json =
{
file = true,
limit = 10,
fields = 'seconds action class b64_data dir dst_addr \
dst_ap dst_port eth_dst eth_len eth_src eth_type gid icmp_code \
icmp_id icmp_seq icmp_type iface ip_id ip_len msg mpls pkt_gen \
pkt_len pkt_num priority proto rev rule service sid src_addr \
src_ap src_port target tcp_ack tcp_flags tcp_len tcp_seq \
tcp_win tos ttl udp_len vlan timestamp',
}
sudo snort -c /usr/local/etc/snort/snort.lua --pcap-filter \*.pcap \
--pcap-dir ~/pcaps -l /var/log/snort -s 65535 -k none -m 0x1b
noah@snort3:~$ ls -lh /var/log/snort
total 59M
-rw-r--r-- 1 root root 4.4M Apr 26 17:26 alert_csv.txt
-rw-r--r-- 1 root root 4.1M Apr 26 17:38 alert_json.txt
-rw-r--r-- 1 root root 10M Apr 26 17:33 alert_json.txt.1587915232
-rw-r--r-- 1 root root 10M Apr 26 17:34 alert_json.txt.1587915252
-rw-r--r-- 1 root root 10M Apr 26 17:35 alert_json.txt.1587915314
-rw-r--r-- 1 root root 10M Apr 26 17:36 alert_json.txt.1587915397
-rw-r--r-- 1 root root 10M Apr 26 17:37 alert_json.txt.1587915473
-rw-r--r-- 1 root root 37K Apr 26 17:38 appid_stats.log
sudo groupadd snort
sudo useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort
sudo rm /var/log/snort/*
sudo chmod -R 5775 /var/log/snort
sudo chown -R snort:snort /var/log/snort
 sudo vi /lib/systemd/system/snort3.service
[Unit]
Description=Snort3 NIDS Daemon
After=syslog.target network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 \
-k none -l /var/log/snort -D -u snort -g snort -i eth0 -m 0x1b

[Install]
WantedBy=multi-user.target
sudo systemctl enable snort3
sudo service snort3 start
service snort3 status
noah@snort3:~/pcaps$ service snort3 status
* snort3.service - Snort3 NIDS Daemon
Loaded: loaded (/lib/systemd/system/snort3.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2018-12-11 16:48:44 EST; 2min 57s ago
sudo journalctl -u snort3.service
 sudo dpkg -i splunk-8.*.deb
sudo /opt/splunk/bin/splunk start --answer-yes --accept-license
sudo /opt/splunk/bin/splunk stop
sudo /opt/splunk/bin/splunk enable boot-start -systemd-managed 1
sudo service Splunkd start
sudo mkdir /opt/splunk/etc/apps/TA_Snort3_json/local
sudo touch /opt/splunk/etc/apps/TA_Snort3_json/local/inputs.conf
sudo vi /opt/splunk/etc/apps/TA_Snort3_json/local/inputs.conf
[monitor:///var/log/snort/*alert_json.txt*]
sourcetype = snort3:alert:json
sudo service Splunkd restart
sourcetype="snort3:alert:json"
sourcetype="snort3:alert:json"
| table _time src_ap dst_ap msg
sourcetype="snort3:alert:json"
| stats count by dest
sourcetype="snort3:alert:json"
| iplocation src_addr
| stats count by Country
| geom geo_countries featureIdField="Country"

文件夹名称	目的
rules	注册规则集中的所有基本规则文件
builtin_rules	包含内置规则的引用和信息的规则文件
so_rules	这些是编译后的规则。Snort 3还没有这些功能，但很快就会实现
lists	白名单和黑名单。我们在本指南中没有设置这些

标志	解释
sudo snort	这是我们正在调用的snort二进制文件。
-c /usr/local/etc/snort/snort.lua	这是snort.lua配置文件。
r ~/pcaps/maccdc2012_00000.pcap	pcap文件的路径。
-A alert_fast	使用alert_fast插件输出到控制台。
-s 65535	设置snaplen，使Snort不会截断或丢弃过大的包。
-k none	忽略错误的校验和，否则snort将丢弃带有错误校验和的包，它们不会被计算。

标志	解释
sudo snort	这是snort二进制程序
-c /usr/local/etc/snort/snort.lua	这是snort.lua配置文件
–pcap-filter *.pcap	这告诉snort如何识别位于pcap-dir中的pcap文件。
–pcap-dir ~/pcaps	这将告诉Snort pcap文件所在的目录。
-A alert_fast	使用alert_fast输出插件输出到控制台。
-s 65535	设置snaplen，使Snort不会截断或丢弃过大的包。
-k none	忽略错误的校验和，否则snort将丢弃带有错误校验和的包，它们将不会被计算。

新标志	解释
-l /var/log/snort	应该保存输出文件(本例中为csv文件)的文件夹。
-q	安静模式，不显示横幅和状态报告
-m 0x1b	这将写入文件的umask设置为033。

标志	解释
/usr/local/bin/snort	这是到snort二进制文件的路径。这里我们不使用sudo，因为脚本将以提升(root)权限启动。
-c /usr/local/etc/snort/snort.lua	这是snort.lua的配置文件。
-s 65535	设置snaplen，使Snort不会截断和删除超大的包。
-k none	忽略错误的校验和，否则snort将丢弃带有错误校验和的包，它们不会被计算。
-l /var/log/snort	文件夹的路径，Snort将存储它输出的所有日志文件。
-D	作为守护进程运行
-u snort	在启动之后(以及在执行任何需要提升特权的操作之后)，切换到以“snort”用户的身份运行。
-g snort	启动之后，作为“snort”组运行。
-i eth0	要监听的接口。
-m 0x1b	文件权限的Umask为033。

Ubuntu 18和20上的Snort 3.0.1

内容

介绍

安装Snort

配置网卡

安装OpenApplD

安装Snort规则集

启用内置规则

将PCAP文件传递到Snort，并将警报输出到.csv

JSON警报输出插件

Snort启动脚本

Splunk

安装Splunk:

配置Splunk:

使用Splunk

清理您的安装

结论

注意：已省略附录ABCD。原手册在Snort官网。

翻译不当，多多包含。

公告