Snort-IPS-入侵防護系統安裝及部署小記

原文

sudo apt-get update && sudo apt-get dist-upgrade -y
sudo dpkg-reconfigure tzdata
mkdir ~/snort_src
cd ~/snort_src
sudo apt-get install -y build-essential autotools-dev libdumbnet-dev \
libluajit-5.1-dev libpcap-dev zlib1g-dev pkg-config libhwloc-dev \
cmake
sudo apt-get install -y liblzma-dev openssl libssl-dev cpputest \
libsqlite3-dev uuid-dev
sudo apt-get install -y asciidoc dblatex source-highlight w3m
sudo apt-get install -y libtool git autoconf
sudo apt-get install -y bison flex libcmocka-dev
sudo apt-get install -y libnetfilter-queue-dev libmnl-dev
cd ~/snort_src
#直接從github下載較慢，已轉存至gitee
wget https://gitee.com/deng_wenyi/snort3-ubuntu-install-source-code/repository/archive/master.zip
apt install unzip
unzip master.zip
mv snort3-ubuntu-install-source-code/libsafec-08112019.0-gad76c7.tar.gz ./
tar -xzvf libsafec-08112019.0-gad76c7.tar.gz
cd libsafec-08112019.0-gad76c7/
./configure
make
sudo make install
cd ~/snort_src/
mv snort3-ubuntu-install-source-code/pcre-8.43.tar.gz ./
tar -xzvf pcre-8.43.tar.gz
cd pcre-8.43
./configure
make
sudo make install
sudo apt-get install -y libunwind-dev
cd ~/snort_src
mv snort3-ubuntu-install-source-code/gperftools-2.7.90.tar.gz ./
tar xzvf gperftools-2.7.90.tar.gz
cd gperftools-2.7.90
./configure
make
sudo make install
cd ~/snort_src
mv snort3-ubuntu-install-source-code/ragel-6.10.tar.gz ./
tar -xzvf ragel-6.10.tar.gz
cd ragel-6.10
./configure
make
sudo make install
cd ~/snort_src
#boost庫比較大（約120M），見百度網盤下載；或使用原連接下載
#連接: https://pan.baidu.com/s/1GOM1KXJDjBMsElGw7q3fRg  密碼: e4av
#--來自百度網盤超級會員V4的分享
wget https://dl.bintray.com/boostorg/release/1.72.0/source/boost_1_72_0.tar.gz
tar -xvzf boost_1_72_0.tar.gz
cd ~/snort_src
mv snort3-ubuntu-install-source-code/hyperscan-5.2.1.tar.gz ./
tar -xvzf hyperscan-5.2.1.tar.gz
mkdir ~/snort_src/hyperscan-5.2.1-build
cd hyperscan-5.2.1-build/
cmake -DCMAKE_INSTALL_PREFIX=/usr/local -DBOOST_ROOT=~/snort_src/boost_1_72_0/ ../hyperscan-5.2.1
make
sudo make install
cd ~/snort_src/hyperscan-5.2.1-build/
./bin/unit-hyperscan
cd ~/snort_src
mv snort3-ubuntu-install-source-code/flatbuffers-v1.12.0.tar.gz ./
tar -xzvf flatbuffers-v1.12.0.tar.gz
mkdir flatbuffers-build
cd flatbuffers-build
cmake ../flatbuffers-1.12.0
make
sudo make install
cd ~/snort_src
git clone https://gitee.com/deng_wenyi/snort3-libdaq.git
cd snort3-libdaq
./bootstrap
./configure
make
sudo make install
sudo ldconfig
cd ~/snort_src
git clone https://gitee.com/deng_wenyi/snortadmin-snort3.git
cd snortadmin-snort3/
./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc
cd build
make
sudo make install
/usr/local/bin/snort -V
root@UbuntuServer:~/snort_src/snortadmin-snort3/build# /usr/local/bin/snort -V

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.0.3 (Build 5)
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.0
           Using LuaJIT version 2.0.4
           Using OpenSSL 1.0.2g  1 Mar 2016
           Using libpcap version 1.7.4
           Using PCRE version 8.43 2019-02-23
           Using ZLIB version 1.2.8
           Using FlatBuffers 1.12.0
           Using Hyperscan version 5.2.1 2020-12-13
           Using LZMA version 5.1.0alpha
snort -c /usr/local/etc/snort/snort.lua
Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting
sudo ethtool -k ens3 | grep receive-offload
generic-receive-offload: on
large-receive-offload: off [fixed]
sudo vi /lib/systemd/system/ethtool.service
[Unit]
Description=Ethtool Configration for Network Interface

[Service]
Requires=network.target
Type=oneshot
ExecStart=/sbin/ethtool -K ens3 gro off
ExecStart=/sbin/ethtool -K ens3 lro off

[Install]
WantedBy=multi-user.target
sudo systemctl enable ethtool
sudo service ethtool start
sudo ethtool -k ens3 | grep receive-offload
generic-receive-offload: off
large-receive-offload: off [fixed]
cd ~/snort_src/
mv snort3-ubuntu-install-source-code/snort-openappid.tar.gz ./
tar -xzvf snort-openappid.tar.gz
sudo cp -R odp /usr/local/lib/
sudo vi /usr/local/etc/snort/snort.lua
appid =
{

    −− appid requires this to use appids in rules
    app_detector_dir = '/usr/local/lib',
 }
snort -c /usr/local/etc/snort/snort.lua --warn-all
...
Finished /usr/local/etc/snort/snort.lua:
WARNING: appid: no lua detectors found in directory '/usr/local/lib/custom/lua/*'
--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 1 warnings).
o")~ Snort exiting
sudo mkdir /usr/local/etc/rules
sudo touch /usr/local/etc/rules/local.rules
sudo vi /usr/local/etc/rules/local.rules
alert tcp any any -> any any ( msg:"Facebook Detected"; appids:"Facebook";sid:10000001; )
alert icmp any any -> any any (msg:"ICMP Traffic Detected";sid:10000002;)
snort -c /usr/local/etc/snort/snort.lua \
-R /usr/local/etc/rules/local.rules
sudo snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules \
-i eth0 -A alert_fast -s 65535 -k none
Commencing packet processing
++ [0] eth0
wget facebook.com
05/30−21:26:48.482231 [**] [1:10000001:0] "Facebook Detected" [**] [Priority: 0] [AppID: Facebook] {TCP} 10.10.10.170:59632 −>
    185.60.216.35:80
05/30−21:26:48.506197 [**] [1:10000001:0] "Facebook Detected" [**] [Priority: 0] [AppID: Facebook] {TCP} 185.60.216.35:80 −>
    10.10.10.170:59632
...
sudo mkdir /var/log/snort
appid =
{

    app_detector_dir = '/usr/local/lib',
    log_stats = true,
}
sudo snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/rules/local.rules \
-i eth0 -A alert_fast -s 65535 -k none -l /var/log/snort
sudo chmod a+r /var/log/snort/appid_stats.log
noah@snort3:~/snort_src$ cat /var/log/snort/appid_stats.log
1549218716,DNS,1576,1778
1549218716,Facebook,8727,630912
1549218716,OpenSSH,19523,2344
1549218716,SSH,19523,23445
1549218716,HTTPS,8727,630912
1549218716,SSL client,8727,630912
1549218716,ICMP,392,392
1549218716,__unknown,11028,139100
sudo mkdir /usr/local/etc/rules
sudo mkdir /usr/local/etc/builtin_rules

sudo mkdir /usr/local/etc/so_rules
sudo mkdir /usr/local/etc/lists
cd ~/snort_src/

#在此提供了註冊規則集的下載地址，但仍但願您去官方下載，由於它有可能會失效
wget https://www.snort.org/rules/snortrules-snapshot-3000.tar.gz?oinkcode=0e0795beeba6b8bd7c1d5b2727e48ad7a9202eb6 -O snortrules-snapshot-3000.tar.gz

mkdir snortrules-3000
tar -xvzf snortrules-snapshot-3000.tar.gz -C ./snortrules-3000
cd snortrules-3000

#複製單個規則文件
sudo cp ./rules/*.rules /usr/local/etc/rules/

#複製內建規則文件
sudo cp ./builtins/builtins.rules /usr/local/etc/builtin_rules/

#複製新的配置文件(咱們將覆蓋當前的配置)。
sudo cp ./etc/* /usr/local/etc/snort/
sudo vi /usr/local/etc/snort/snort.lua
HOME_NET = '10.0.0.0/24'
rules = [[

        include $RULE_PATH/snort3-app-detect.rules
        include $RULE_PATH/snort3-browser-chrome.rules
        include $RULE_PATH/snort3-browser-firefox.rules
        include $RULE_PATH/snort3-browser-ie.rules
        ...
snort -c /usr/local/etc/snort/snort.lua
Finished /usr/local/etc/snort/snort.lua:
Loading ips.rules:
FATAL: ips.rules:3 undefined variable name: RULE_PATH.
Fatal Error, Quitting..

文件夾名稱	目的
rules	註冊規則集中的全部基本規則文件
builtin_rules	包含內置規則的引用和信息的規則文件
so_rules	這些是編譯後的規則。Snort 3尚未這些功能，但很快就會實現
lists	白名單和黑名單。咱們在本指南中沒有設置這些

Snort-IPS-入侵防護系統安裝及部署小記

Ubuntu 18和20上的Snort 3.0.1

內容

介紹

安裝Snort

配置網卡

安裝OpenApplD

安裝Snort規則集