4/13/2006
Eric Low

Snort is the leading Open Source IDS, providing valuable logs of malicious activity across your firewall.

First, download and extract Snort. You must also have libpcap and libpcre, so install those if needed.

Now, install Snort. I used the following commands:

Then, create a directory called /etc/snort. Copy all files from the archive's etc directory to this directory. When you do start Snort, it will look for all of these configuration files, in the same directory that snort.conf is located in. So keep them together! Edit the configuration file, /etc/snort/snort.conf, to reflect your network setup. This file is very well commented, so it should be pretty straightforward. In the conf file, I set my rules files path to /etc/snort/rules (var RULE_PATH /etc/snort/rules), so I created that directory for it to use.

In order to download any of the recent rulesets, you will have to register at the Snort site. Once you have the account set up, go to the download rules page and download "Sourcefire VRT Certified Rules - The Official Snort Rules (registered user release)." These are labeled, "VRT Certified Rules for Snort CURRENT." I then extracted this archive into my /etc/snort directory. The archive contains two directories, doc and rules, so extracting to /etc/snort put my rules in the /etc/snort/rules directory as I specified in my snort.conf file.

Logging options can be defined either in snort.conf or at the command line, although there are less options available at the command line. For both security and convenience, we are logging in two places. The first is on a remote logserver (through syslog), so that we can analyze the logs with snortsnarf and serve them on an HTTP server for easy viewing. To do this, add the following line to snort.conf:

Note that the LOG_PID option is important for SnortSnarf to work correctly.

The second method of logging is in ascii files in the /var/log/snort directory, which is the default. You must create this directory. This also produces packet dumps of any packets that triggered alerts. These are stored in subdirectories, named according to their source IP address, off of /var/log/snort. To turn this option on, add the following line to snort.conf:

Keep in mind that this slows down snort considerably, and could actually cause some packets to be missed. If this becomes a problem, use "alert_fast" instead, which doesn't print all of the packet headers.

Snort can now be run by typing snort -D -d -e -i bridge -c /etc/snort.conf, in which the "-c" flag tells it where to find the configuration file. The "-D" option tells it to run as a daemon (background process), the "-d" option tells it to display the packet data (not just the headers), while "-e" tells it to also log the data link layer headers. To make it log to syslog, run with the "-s" option as well. There is also an implied switch, "-A full" that tells it to log in a more detailed format (the -s option, however, may override this and set it to "-A fast"). This should be started upon bootup at the end of the rc.local script file.

For some reason, when I left off the -i option for our bridge interface (which made it default to our external interface, eth0), it seemed to cause a lot of problems with false alarms - something to do with the interface not having an IP address, it seems. These were false alarms coming from our firewall IP to external that should have been ignored. Once I added the interface, which does have the IP, these went away.

=============================================================================================
=============================================================================================

Installing Snort, for use with Base

I heavily referenced this document for the following procedures.

First, Base requires Snort to use a database for its logging. If it is not already, install MySQL, and compile it to run with OpenSSL. I did not investigate this, but I'm assuming that you actually have to compile it to do this, rather than installing an RPM. I also set it to build without libgcc and zlib. I downloaded the source package (it's way down at the bottom of the downloads page, surrounded by big warnings), then extracted it and then installed it with the following commands:

------------------------------------

Because I had originally compiled Snort (version 2.4.4) without MySQL support, I had to recompile it (actually, I had to compile it against OpenSSL as well). To ensure I had a clean copy, I removed the old directory that I compiled Snort from and unarchived a new copy. I then recompiled and installed it with the following commands:

Note that I had to stick that LDFLAGS environment variable in there to avoid a "ld: cannot find -lmysqlclient" error that I kept getting (although I can't remember if it was while I was running configure or actually compiling with make). This was due to the fact that I had kept the mysql-client rpm on there, and compiled the mysql server package seperately - so libraries were in two different locations (mysql-client libraries were in /usr/lib/mysql while mysql libraries were in /usr/include/mysql).

In fact, when I finally did try starting snort with mysql support, I got the following error: snort: error while loading shared libraries: libmysqlclient.so.15: cannot open shared object file: no such file or directory. To fix this, I added a line to /etc/ld.so.conf that read /usr/lib/mysql and then ran ldconfig. Snort stopped complaining and started running.

------------------------------------

Before I could run MySQL, I had to set up an unprivileged user:

I then copied a default config file to the /etc directory for the MySQL daemon to use by typing cp support-files/my-small.cnf /etc/my.cnf. I modified this file, uncommenting all of the lines regarding InnoDB, since I definitely wanted to use InnoDB tables. I then changed the following lines to make the MySQL daemon always start with my newly created user:

MySQL also needs a default table named mysql installed to start. I created this by running the following script:

I tried starting mysqld with its output sent to the screen, so I could see what was going on:

It looked good, so I changed the password for MySQL's root user (this password is blank by default), as well as deleted any anonymous accounts:

Check to make sure that the root user does not exist in any other host context as well! Type SELECT Host,User FROM mysql.user; and change the password for any other root user as well!

Now, I created the database for Snort:

The appropriate tables for snort must then be created; Snort provides a script to do this with the following command (run from my unarchived snort directory):

The snort user must also be added, and permissions set for its database and tables:

I then copied the included startup script to my startup script directory (note that I am on SuSE and therefore all the scripts are in /etc/rc.d/ rather than /etc/rc.d/init.d/):

Next, I modified my /etc/snort/snort.conf file to output both log and alert data to MySQL:

I also created a Snort user, using the same commands that I used to create the mysqld user, and made sure the config files were only readable or writeable by this user:

The rest of the instructions for configuring Snort, getting rules, etc. are in my section up above, installing plain old Snort.

------------------------------------

PHP will require the gd libraries (and be compiled with them) once you want to start adding image extensions, so I had to install those first. I downloaded the source (version 2.0.33), unarchived it, and installed it with the following commands:

------------------------------------

Now, I had to install PHP. I downloaded and unarchived the source code (version 5.1.2), then installed it with the following commands:

I'm not entirely sure why I used the --prefix=/usr/local/php rather than my usual --prefix=/usr option... I figured there must've been a pretty good reason why the author of the previous document didn't simply use /usr/local, so... I followed suit!

Once PHP was installed, I had to put a php.ini file in place. PHP looks for this file in the following locations, in order:

I took one of the default ini files and copied it /etc/php.ini, hoping for the best (other docs have mentioned copying it to the /usr/local/php/lib/php.ini for a similar install to mine). As it turned out, both /etc/php.ini or /usr/local/php/lib/php.ini worked for me. So take your pick!:

I also added the following line to that file:

You may also need to useapxs to add the libphp5.so modules to Apache. I did not have to do so in my installation, because for some reason, "LoadModule php5_module modules/libphp5.so" was already in my httpd.conf file (I don't know if it was always there or what, but I never added it). Anyhow, if you have to do so, run the following commands (I *think*):

------------------------------------

BASE also requires ADOdb for talking to MySQL on the backend. Installation is simple - I simply downloaded it (version 4.80) and extracted them to a directory that Apache can access (I used /usr/share/adodb).

------------------------------------

BASE also needs a couple of PHP extensions, installed using PEAR (similar to CPAN). Image_Color requires the PHP to be compiled with gd, so if you didn't install it above, you must now do some backtracking. I installed these with the following commands:

Those last three packages will not automatically be found by PEAR, which is why I had to specify the URL. Finding the URL is easy, however. Simply go to http://pear.php.net and search for the package name, then copy the link location for the current release.

------------------------------------

Believe it or not, those are the ONLY prerequisites! That was a pain in the ass, I know. Now for the reason we all started this journey.

To install BASE, I downloaded and unarchived the latest version (1.2.4, aka Melissa). The documentation says to unpack it into Apache's document root (usually the htdocs directory, although not in my case), but I don't like that idea for many reasons. I unarchived it into its own directory (/programs/base-1.2.4) and then created a symbolic link inside of the htdocs directory by typing ln -sv /programs/base-1.2.4 /usr/apache/www/default/base.

I then created the BASE database in MySQL by using the supplied script:

Next, I copied the stock configuration file and customized it for my environment. This is in base' root dir, and can be named correctly, and permissions set, by typing the following commands:

Make sure to set the permissions on this file, because it contains the password for mysql's snort user in plain text!

Now, edit this base_conf.php file and make sure that the following lines are correct:

That $db_connect_method option is important - left at the default (1 = persistant connection), Snort will be unable to obtain a connection with the MySQL server and therefore be able to add any alerts!

You may also need to add an ExecCGI directive to your httpd.conf file for the base directory (especially if you get a "Options ExecCGI is off in this directory" error). This, of course, can also be done by creating an .htaccess file, with the following lines:

You will need the following lines in httpd.conf as well:

Those first two lines are actually a replacement for one line that you normally see in the documentation, "AddType application/x-httpd-php .php" The reasons for these alternative lines can be read here. I actually put them in because the normal line didn't do anything for me. :)

Of course, it did let me in without authentication! I had not yet set the authentication through Apache at this point though, so I simply set it through there (with the .htaccess file I printed above). To generate or add to the .htpasswd file, run the htpasswd program supplied with Apache (/usr/bin/htpasswd -d /path/to/.htpasswd username) Voila!

You should now have a working Snort/Mysql/Base installation. Enjoy!

Should you wish to create a database for archiving Snort alerts, here are the commands (which are almost exactly like those used to create the original database):

Then, run http://base.ip/base/setup/setup1.php again to extend the database tables and create a new base_conf.php file.

Install Barnyard (processor for Snort's Unified File Format - increases speed) and Oinkmaster (keeps rules up to date). Check out this documentation.

A Snort/ACID database archiving/cleaning perl script can be found here.

Set up archive database for BASE?

Set appropriate permissions?

More to come...

Links:

Basic Analysis and Security Engine (BASE) project - This is the successor to ACID.