Any private network should be running some sort of Intrusion Detection System for system adminstrators to watch for any malicious traffic. In this guide you will learn how to set up snort and one of its reporting utilities, snortreport.
- Local root access on the box or be able to su to root.
- A SSH client that supports ANSI colors such as puTTy or SecureCRT (if you aren’t on the box).
- Your favorite text editor (I like nano).
- Apache and MySQL servers installed and running.
Installation of snort is pretty straight forward.
# cd /usr/ports/security/snort # make install -DWITH_MYSQL
Snortreport uses php4-gd and jpgraph to display a pretty chart, so if you didn’t compile php4 with GD support and don’t have jpgraph installed, let’s do it now.
# cd /usr/ports/graphics/php4-gd # make install distclean # cd /usr/ports/graphics/jpgraph # make install distclean
Now that the required packages are installed for Snortreport, let’s install the reporting utility.
# cd /usr/ports/security/snortreport # make install distclean
Snort gets launched from /etc/rc.conf on bootup so we need to add it.
# echo 'snort_enable="YES"' >> /etc/rc.conf
Because we will be using Snortreport, we need to set up our MySQL database to support snort:
# mysqladmin -u root -p create snort # cd /usr/ports/security/snort/work/snort-*/contrib # mysql -u root -p -D snort < create_mysql # mysql -u root -p -D snort < /usr/local/share/doc/snortreport/create_indexes.sql
If you already have a MySQL user you plan on using, you can skip this step. Otherwise, execute the following to create a MySQL user of "snort" and a password of "snortpw." Of course, you will probably want to change the password for security purposes.
# cat << EOF > /usr/ports/security/snort/work/snort-*/contrib/snort_user.sql # GRANT USAGE ON * . * TO snort@localhost IDENTIFIED BY "snortpw" WITH MAX_QUERIES_PER_HOUR 0 # MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 ; # FLUSH PRIVILEGES; # GRANT SELECT, INSERT, UPDATE, DELETE ON snort . * TO snort@localhost; # FLUSH PRIVILEGES; # EOF # mysql -u root -p < /usr/ports/security/snort/work/snort-*/contrib/snort_user.sql # cd /usr/ports/security/snort # make distclean
Now it's time to edit and tailor snort's config file to our needs. This is where we can have snort only keep track of certain subnets, interfaces, and the services we run. There's no need to have snort use resources looking for bad DNS traffic if we don't run a DNS server.
# nano -w /usr/local/etc/snort.conf ..output omitted.. # List of DNS servers on your network #var DNS_SERVERS $HOME_NET # List of SMTP servers on your network var SMTP_SERVERS $HOME_NET # List of web servers on your network var HTTP_SERVERS $HOME_NET # List of sql servers on your network var SQL_SERVERS $HOME_NET # List of telnet servers on your network var TELNET_SERVERS $HOME_NET # List of snmp servers on your network var SNMP_SERVERS $HOME_NET ..output omitted..
In the same file, we need to set up the logging options for snort to log to the log file and to MySQL for Snortreport to parse. So, uncomment and change the following line:
output database: log, mysql, user=snort password=snortpw dbname=snort host=localhost
Save and exit. Before we start Snort, we need to set up the log directory with the appropriate permissions.
# mkdir /var/log/snort # chmod 0744 /var/log/snort
Snort is all set up and we might as well fire it up right now. You can either reboot or just issue:
# /usr/local/etc/rc.d/snort.sh start
First we need to edit the config file for Snortreport for MySQL database access.
nano -w /usr/local/www/snortreport/srconf.php ..output omitted.. // Put your snort database login credentials in this section $server = "localhost"; $user = "snort"; $pass = "snortpw"; $dbname = "snort"; ..output omitted..
Now, in the same file, locate and change your jpgraph line to the following: