Snort+Barnyard+MySQL+Base+RRD-Snort

Index:-

1> Snort

a> install and configure snort.
b> configure snort to give binary output.

2> Barnyard

a> install and configure barnyard.
b> run two instences of barnyard to get output in local as well as remort machine.

3> Mysql

a> install and configure mysql.
b> install mysql on both local as well as remote machine.
c> configure remote mysql to get data from more than 1 machine.

4> Base

a> install and configure base on the remort machine.
b> configure it to generate report of data got from several machines.

5> RRD-Snort

a> install and configure rrd-snort.
b> configure rrd to generate graph of mysql-snort data.

Snort

To start witth install snort depending on the machine you are running.
1> tar -xvzf snort*.tar.gz
2> rpm -ivh snort*.rpm
3> *.deb

mkdir /var/log/snort  ----------> for snort to log snort.log files.

Configure snort.conf.
Edit these lines of your snort.conf file.

var HOME_NET (your ip)

var RULE_PATH (TO THE DIR. WHERE YOU HAVE YOUR RULES FILES)


# unified: Snort unified binary format alerting and logging

output alert_unified: filename snort.alert, limit 128
output log_unified: filename snort.log, limit 128

Starting snort.

snort -c /etc/snort/snort.conf -i eth0 -l /var/log/snort

-c -----> for snort to look into this configuration file.
-i -----> for snort to look into the packages comming from this intrphase.
-l ----> for snort to log the alert file into this dir.

Barnyard

To start with barnyard install barnyard .
Comile it either with mysql or get a pre compiled rpm or deb package(compiled with mysql).

1> tar -xvzf barnyard*.tar.gz

cp barnyard.conf to 2 places  ---------> to run 2 instences of barnyard.

Configure barnyard.conf.
Edit these lines in barnyard.conf file to give data to mysql on local machine

output alert_acid_db: mysql, sensor_id 1, database snort, server localhost, user root, password root
output log_acid_db: mysql, database snort, server localhost, user root, password root

Edit second barnyard.conf file to give data to mysql on remote machine.

output alert_acid_db: mysql, sensor_id 1, database snort, server remorthost, user root, password root
output log_acid_db: mysql, database snort, server remotehost, user root, password root

Starting barnyard.

barnyard -c /etc/snort/barnyard.conf -g /etc/snort/gen-msg.map -s /etc/snort/sid-msg.map -d /var/log/snort -f snort.log -w /var/log/snort/barnyard.waldo

-c -----> for barnyard to look into this configuration file.
-g -----> for barnyard to look into this gen.map file.
-s -----> for barnyard to look into this sid.map file.
-d -----> for barnyard to look into dir. for the alert files logged by snort.
-f -----> for barnyard to look for files with name starting with.
-w -----> for barnyard to log the temp. dta into the file.

Mysql

Install mysql using apropriate package.

Configure mysql. (on both machines)

1> mysql -u root -p
2> create database snort;
3> grant all on snort.* to ***@***** identified by 'password'
4> quit;

zcat (make_mysql file) | mysql -u root -p snort

1> mysql -u root -p
2> use snort;
3> show tables;
4> quit;

(FOR REMOTE MACHINE)
you can make more than 1 database as required

1> either to get data in a single database from diff. machines.
2> or to get dat from diff. machines into diff. databases.

Base

To make base working first install php, adodb, apache, libapache-mod-php, php-pear. php-mysql, php-gd, libphp-adodb.(look for compatible versions for your machine)

Install base using appropriate version.

Configure base_conf.php.

cp base_conf.php.dist base_conf.php

Edit these lines in your base_conf.php file.

$BASE_urlpath = '/base';  (path where apache server look for files  ex. ->http://localhost/base)

$DBlib_path = '/var/www/adodb5'; (path to adodb libraries)

$alert_dbname   = 'snort';
$alert_host     = 'localhost';
$alert_port     = '';
$alert_user     = 'mysql-snort-user';
$alert_password = 'mysql-snort-password';

Running base.

go to a browser----->

and type the ip of your system.

There after you can see diff. files to choose from---> click on the base.

RRD-Snort

To get rrd-snort working first install rrdtool.

Then get rd-snort.pl file.

always run rrd-snort in the dir where you want it to place the resulting graph.

run rrd-snort.

perl rrd-snort.pl -H hostip -u (mysql-snort-user) -p(snort-user-password)                                                         

Snort Basics

To start with you can get snort from www.snort.org.

In the first part of our discussion we will configure snort on an ubuntu machine.
And in the later blogs we will procede towards others like Redhat or Deb.

The main problem which one faces in installing snort is meeting dependences.

So to solve this i think we should start first.
start with ----->
tar -xvzf snort-2.8.1.tar.gz
cd snort-2.8.1
./configure -------------------> (for IDS)
./configure --enable-inline -------------------> (for IPS)

You can add --enable-mysql to any one of them to push your snort alerts to mysql database.

Generally you wont find any error while configuring IDS.

So hoping your IDS does not gave you a trouble we end it here and even if it gives they wont be different from IPS, that means you can refer to them if you find one(trouble).

To start snort with IDS first get rules
(that too you can get from www.snort.org).
Untar then at /etc/snort/ DIR.
now
cp snort-2.8.1/* /etc/snort/
this makes it convenient as you(and your system) get all files at one place reducing the chances of error.

mkdir /var/log/snort ----------> for snort to log its alert files.

Now make some changes to your snort.conf file lying in /etc/snort DIR.

var HOME_NET localhost ---------->this should be valid ip of your system.

var RULE_PATH /etc/snort/rules


Now initiate snort:>

snort -c /etc/snort/snort.conf -i eth0 -l /var/log/snort

You can also put -A console to get alerts on screen or put -D to run snort in deamon mode.


Now its time we should be concentrating on IPS with or without mysql.

Start with trying to compile snort by--------------->
tar snort-2.8.1.tar.gz
cd snort-2.8.1
./configure --enable-inline --enable-mysql

at this you are likely to get an error i.e.
libipq.h not found
This can be eliminated by
copy libipq.h to /usr/include/
And if incase u don't have libipq.h file
then do-------------->
apt-cache search libipq.h
And install the package which provides you the file
apt-get install *


Other errors include errors like----------->
libpcap not found
same is to deal with these kids of errors.

But to do it with --enable-mysql you have to get some prerequisites.

• Libpcap0.8-dev
• libmysqlclient15-dev
• mysql-client-5.0
• mysql-server-5.0

After this i don't think it will give you any kind of trouble.

To get snort-inline working you have to get iptables up
And add rules to iptables in such a way that packets stand in a queue.
Such as--------->
iptables -A INPUT -p tcp -j QUEUE
iptables -A INPUT -p icmp -j QUEUE
iptables -A INPUT -p udp -j QUEUE

You can do this for any chain of iptables, depending upon what kind of work you want from your snort to perform.

To initiate snort-inline just use-------------------->
snort -QC /etc/snort/snort.conf -i eth0 -l /var/log/snort

You can also put -A console to get alerts on screen or put -D to run snort in deamon mode.