ток вырезки Suricata

Suricata

IDS/IPS (Intrusion Detection/Prevention System)
IDS/IPS (система обнаружения/предотвращения вторжений)

Suricata — barnyard2/sguil-sensor — snortsam — cisco route

The Open Information Security Foundation (OISF) will provide support to Ian Firns (aka “firnsy”), one of the official Barnyard2 maintainers at SecurixLive, to help get a few milestones completed within the Barnyard2 roadmap. Most significantly a Snortsam Output Plugin will be completed to allow both Snort and Suricata users to more easily plug in to Snortsam for distributed blocking and response using Frank Knobbe’s Snortsam project. This will make using Snortsam much easier as it will no longer require patching Snort or Suricata on each upgrade.

Barnyard is a critical piece of Suricata as well as Snort, so this support is beneficial to the community as a whole!

при сборке и нач.старте… лезет


 checking magic.h usability... no
 checking magic.h presence... no
 checking for magic.h... no
 <strong>configure: error: magic.h not found ...</strong>

решение должно быть

yum install file-devel

/usr/local/bin/suricata -c /etc/suricata/suricata.yaml -D -i eth0 --user=suri --group=suri

mkdir -p /var/log/suricata
chown -R root:suri /var/log/suricata
chmod -R 775 /var/log/suricata


[root@suricata suricata]# pwd
/var/log/suricata
[root@suricata suricata]# tail -f http.log stats.log

[root@suricata suricata]# suricata --build-info
23/1/2013 -- 10:03:56 - <Info> - This is Suricata version 1.4 RELEASE
23/1/2013 -- 10:03:56 - <Info> - Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG HAVE_HTP_URI_NORMALIZE_HOOK HAVE_HTP_TX_GET_RESPONSE_HEADERS_RAW
23/1/2013 -- 10:03:56 - <Info> - 64-bits, Little-endian architecture
23/1/2013 -- 10:03:56 - <Info> - GCC version 4.4.6 20120305 (Red Hat 4.4.6-4), C version 199901
23/1/2013 -- 10:03:56 - <Info> - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_1
23/1/2013 -- 10:03:56 - <Info> - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_2
23/1/2013 -- 10:03:56 - <Info> - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_4
23/1/2013 -- 10:03:56 - <Info> - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_8
23/1/2013 -- 10:03:56 - <Info> - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_16
23/1/2013 -- 10:03:56 - <Info> - compiled with libhtp 0.2.11, linked against 0.2.11
[root@suricata suricata]#

30 2 * * * oinkmaster.pl -o /etc/suricata/rules/ -b /etc/suricata/backup 2>&1 |logger -t oinkmaster

freebsd

/usr/ports/security/suricata

linux

yum install libpcre3 libpcre3-dbg libpcre3-dev build-essential autoconf \
automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev zlib1g zlib1g-dev \
pkg-config python libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-dev \
libnfnetlink0 git-core libtool automake autoconf libmagic-dev -y

интеграция

https://home.regit.org/2012/02/ecosystem-of-suricata/

AS65002# whereis snortsam
snortsam: /usr/ports/security/snortsam

AS65002# whereis barnyard2
barnyard2: /usr/ports/security/barnyard2

танцы


Locate the paths to key Snort files, and make sure the paths are correctly set to point to the appropriate files in /etc/snort
config reference_file: /etc/snort/reference.config
config classification_file: /etc/snort/classification.config
config gen_file: /etc/snort/gen-msg.map
config sid_file: /etc/snort/sid-msg.map
Find the setting for output logging, uncomment it, and edit it to read:
config logdir: /var/log/barnyard2
Find the lines with hostname and interface declarations, uncomment them, and edit them to read:
config hostname: localhost
config interface: eth0
Find the line for declaring the path to the waldo file and edit it to read:
config waldo_file: /var/log/snort/barnyard2.waldo

~~ставим это… сенсор sguil~~

http://sguil.sourceforge.net/

/usr/ports/security/sguil-sensor

TCL_MODULES Install tcl common modules

cd /usr/ports/devel/git
make install clean
git clone http://github.com/Snorby/snorby.git
cd snorby && bundle install

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricata_Snorby_and_Barnyard2_set_up_guide

в режиме IDS. из 3-х состовляющих Suricata + barnyard2 + snortsam

http://www.corelan.be/index.php/2011/02/27/cheat-sheet-installing-snorby-2-2-with-apache2-and-suricata-with-barnyard2-on-ubuntu-10-x/

собираем под ubuntu в режиме IPS


root@suricata:/var/log/suricata# suricata --build-info
31/1/2013 -- 00:06:40 - <Info> - This is Suricata version 1.4 RELEASE
31/1/2013 -- 00:06:40 - <Info> - Features: NFQ PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK HAVE_HTP_TX_GET_RESPONSE_HEADERS_RAW PCRE_JIT
31/1/2013 -- 00:06:40 - <Info> - 64-bits, Little-endian architecture
31/1/2013 -- 00:06:40 - <Info> - GCC version 4.7.2, C version 199901
31/1/2013 -- 00:06:40 - <Info> - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_1
31/1/2013 -- 00:06:40 - <Info> - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_2
31/1/2013 -- 00:06:40 - <Info> - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_4
31/1/2013 -- 00:06:40 - <Info> - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_8
31/1/2013 -- 00:06:40 - <Info> - __GCC_HAVE_SYNC_COMPARE_AND_SWAP_16
31/1/2013 -- 00:06:40 - <Info> - compiled with -fstack-protector
31/1/2013 -- 00:06:40 - <Info> - compiled with _FORTIFY_SOURCE=2
31/1/2013 -- 00:06:40 - <Info> - compiled with libhtp 0.2.11, linked against 0.2.11

bridge

apt-get install bridge-utils
<s>#!/bin/bash
 #Снимаем IP адреса с интерфейсов (Они нам не нужны)
 ifconfig eth0 0.0.0.0
 ifconfig eth1 0.0.0.0
 #Создаём бридж интерфейс
 brctl addbr bridge0
 #Добавляем в наш бридж интерфейсы
 brctl addif bridge0 eth0
 brctl addif bridge0 eth1
 #Поднимаем бридж
 ifconfig bridge0 up</s>

iptables

iptables -A INPUT -i lo -j ACCEPT
iptables -A FORWARD -i eth1 -o eth2 -m state --state NEW,ESTABLISHED,RELATED -j NFQUEUE
iptables -A FORWARD -i eth2 -o eth1 -m state --state NEW,ESTABLISHED,RELATED -j NFQUEUE

route add default gw 195.1.1.1 eth0

root@suricata:~/barnyard2-1.9# apt-get install libprelude-*
Чтение списков пакетов… Готово
Построение дерева зависимостей
Чтение информации о состоянии… Готово
Заметьте, выбирается «libpreludedb0» для регулярного выражения «libprelude-*»
Заметьте, выбирается «libprelude-dev» для регулярного выражения «libprelude-*»
Заметьте, выбирается «libprelude2-dbg» для регулярного выражения «libprelude-*»
Заметьте, выбирается «libpreludedb-dev» для регулярного выражения «libprelude-*»
Заметьте, выбирается «libprelude2» для регулярного выражения «libprelude-*»
Заметьте, выбирается «libpreludedb-perl» для регулярного выражения «libprelude-*»
Заметьте, выбирается «libprelude-perl» для регулярного выражения «libprelude-*»

apt-get install libprelude2-dbg
apt-get install libpreludedb-dev
apt-get install libmysqlclient-dev

возня прекратилась


.........skip
checking for libprelude-config... /usr/bin/libprelude-config
checking for libprelude - version >= 0.9.6... yes
checking for linuxthreads... no
configure: creating ./config.status
config.status: creating Makefile
config.status: creating src/Makefile
config.status: creating src/sfutil/Makefile
config.status: creating src/input-plugins/Makefile
config.status: creating src/output-plugins/Makefile
config.status: creating etc/Makefile
config.status: creating doc/Makefile
config.status: creating rpm/Makefile
config.status: creating schemas/Makefile
config.status: creating m4/Makefile
config.status: creating config.h
config.status: executing depfiles commands
config.status: executing libtool commands
root@suricata:~/barnyard2-1.9#

в итоге

./configure --prefix=/usr/local \
--enable-prelude \
--enable-aruba \
--enable-gre --enable-64bit-gcc \
--with-mysql-libraries=/usr/lib/x86_64-linux-gnu \
--with-mysql