2013-10-29
********************************************************************************
這四篇是相關的
[研究] snort-2.9.5.5.tar.gz (CentOS 6.4 x64) 快速安裝程式
http://shaurong.blogspot.tw/2013/10/snort-2955targz-centos-64-x64.html
[研究] snort-2.9.5.5.tar.gz (CentOS 6.4 x64) 快速安裝程式(二)
http://shaurong.blogspot.tw/2013/10/snort-2955targz-centos-64-x64_28.html
[研究] Snort 2.9.5.5 + Barnyard 安裝 (CentOS 6.4 x64)
http://shaurong.blogspot.tw/2013/10/snort-2955-barnyard-centos-64-x64.html
[研究] Snort 2.9.5.5 + Barnyard +BASE 安裝 (CentOS 6.4 x64)
http://shaurong.blogspot.tw/2013/10/snort-2955-barnyard-base-centos-64-x64.html
********************************************************************************
[研究] snort-2.9.5.5.tar.gz (CentOS 6.4 x64) 快速安裝程式
http://shaurong.blogspot.tw/2013/10/snort-2955targz-centos-64-x64.html
[研究] snort-2.9.5.5.tar.gz (CentOS 6.4 x64) 快速安裝程式(二)
http://shaurong.blogspot.tw/2013/10/snort-2955targz-centos-64-x64_28.html
開始安裝(請看黃底黑字)
全部用 root 操作省麻煩
su root
# 安裝 mysql 讓 barnyard 輸出 snort資訊到 mysql
# 安裝 git 是為了稍後安裝 Barnyard 使用
# 安裝 httpd、php 方便測試
# 安裝 php-mbstring、php-mcrypt 是稍後安裝 phpMyAdmin 方便測試
yum -y install mysql mysql-devel git libtool mysql-server httpd php php-mysql php-mbstring php-mcrypt
#下載 Barnyad
cd /usr/local/src
git clone https://github.com/firnsy/barnyard2.git barnyard2
cd barnyard2
./autogen.sh
#設定 Barnyard
#在 x86 上
./configure --with-mysql
#在 x86_64 上
./configure --with-mysql --with-mysql-libraries=/usr/lib64/mysql
#如果要寫 shell script 可以參考下面
if [ "`uname -a | grep x86_64`" != "" ]; then
echo "x86_64"
./configure --with-mysql --with-mysql-libraries=/usr/lib64/mysql
else
echo "x86"
./configure --with-mysql
exit
fi
#安裝 Barnyard
make && make install
#設定啟動檔案
cp rpm/barnyard2 /etc/init.d/
chmod +x /etc/init.d/barnyard2
cp rpm/barnyard2.config /etc/sysconfig/barnyard2
chkconfig --add barnyard2
ln -s /usr/local/etc/barnyard2.conf /etc/snort/barnyard.conf
ln -s /usr/local/bin/barnyard2 /usr/bin/
mkdir -p /var/log/snort/eth0/archive/
# 因為 /etc/init.d/barnyard2 中 snort 程式為 /usr/sbin/snort,但小弟之前安裝到 /usr/local/bin/snort,所以建個 link 讓它可以執行到
ln -s /usr/local/bin/snort /usr/sbin/snort
vi /etc/init.d/barnyard2
#找到OPTSS 這行
...
BARNYARD_OPTS="-D -c $CONF -d $SNORTDIR/${INT} -w $WALDO_FILE -L $SNORTDIR/${INT} -a $ARCHIVEDIR -f $LOG_FILE -X $PIDFILE $EXTRA_ARGS"
這行實際上會變成下面,不符需求
-D -c /etc/snort/barnyard.conf -d /var/log/snort -w /var/log/snort/barnyard.waldo -l /var/log/snort/eth0 -a /var/log/snort/eth0/archive -f snort.log -X /var/lock/subsys/barnyard2-eth0.pid
故改為
BARNYARD_OPTS="-D -c /etc/snort/barnyard.conf -d /var/log/snort -w /var/log/snort/barnyard2.waldo -l /var/log/snort -a /var/log/snort -f snort.log -X /var/lock/subsys/barnyard2-eth0.pid"
原來設定 -d 和 -l 都輸出到 /var/log/snort/eth0, -a 輸出到 /var/log/snort/eth0/archive ,但小弟之前安裝 snort 的文章是輸出到 /var/log/snort
#相關參數說明
[root@localhost ~]# barnyard2
______ -*> Barnyard2 <*-
/ ,,_ \ Version 2.1.13 (Build 327)
|o" )~| By Ian Firns (SecurixLive): http://www.securixlive.com/
+ '''' + (C) Copyright 2008-2013 Ian Firns <firnsy@securixlive.com>
USAGE: barnyard2 [-options] <filter options>
Gernal Options:
-c <file> Use configuration file <file>
-C <file> Read the classification map from <file>
-D Run barnyard2 in background (daemon) mode
-e Display the second layer header info
-F Turn off fflush() calls after binary log writes
-g <gname> Run barnyard2 gid as <gname> group (or gid) after initialization
-G <file> Read the gen-msg map from <file>
-h <name> Define the hostname <name>. For logging purposes only
-i <if> Define the interface <if>. For logging purposes only
-I Add Interface name to alert output
-l <ld> Log to directory <ld>
-m <umask> Set umask = <umask>
-O Obfuscate the logged IP addresses
-q Quiet. Don't show banner and status report
-r <id> Include 'id' in barnyard2_intf<id>.pid file name
-R <file> Read the reference map from <file>
-S <file> Read the sid-msg map from <file>
-t <dir> Chroots process to <dir> after initialization
-T Test and report on the current barnyard2 configuration
-u <uname> Run barnyard2 uid as <uname> user (or uid) after initialization
-U Use UTC for timestamps
-v Be verbose
-V Show version number
-y Include year in timestamp in the alert and log files
-? Show this information
Continual Processing Options:
-a <dir> Archive processed files to <dir>
-f <base> Use <base> as the base filename pattern
-d <dir> Spool files from <dir>
-n Only process new events
-w <file> Enable bookmarking using <file>
Batch Processing Mode Options:
-o Enable batch processing mode
# 重設 barnyard2
chkconfig barnyard2 reset
# 修正 barnyard 和 snort 設定檔案,使其匹配 (都使用 snort.log 當輸出)
# 修改 /etc/sysconfig/barnyard2
[root@localhost ~]# vi /etc/sysconfig/barnyard2
找到 LOG_FILE,修改輸出檔案為 snort.log
...
LOG_FILE="snort.log"
...
# 修改 /etc/snort/snort.conf
[root@localhost ~]# vi /etc/snort/snort.conf
找到 output unified2 這行
# output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types
底下增加一行
output unified2: filename snort.log, limit 128
# 修改 /etc/sysconfig/snort
[root@localhost ~]# cp /usr/local/src/snort-2.9.5.5/rpm/snort.sysconfig /etc/sysconfig/snort
[root@localhost ~]# vi /etc/sysconfig/snort
找到並修改如下 (註解掉兩項)
...
LOGDIR=/var/log/snort/
...
#ALERTMODE=fast
...
#BINARY_LOG=1
...
****************************************
# 處理 mysql
[root@localhost ~]# service mysqld restart
# 替 MySQL 的 root 帳號設定密碼 (除了輸入密碼,其他全部按下 Enter 回答)
[root@localhost ~]# /usr/bin/mysql_secure_installation
...
Set root password? [Y/n]
New password: 輸入密碼
Re-enter new password: 再輸入一次密碼
Password updated successfully!
Reloading privilege tables..
... Success!
# 建立 snortdb 資料庫,存取帳號 barnyard2,密碼 123456,執行 flush privileges; 立刻生效
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 10
Server version: 5.1.69 Source distribution
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> create database snortdb;
Query OK, 1 row affected (0.00 sec)
mysql> grant all privileges on snortdb.* to barnyard2@localhost identified by '123456';
Query OK, 0 rows affected (0.00 sec)
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)
mysql> exit
Bye
[root@localhost ~]#
#設定 barnyard2 輸出到 mysql
[root@localhost ~]# vi /etc/snort/barnyard.conf
尋找 output database
新建立一行
output database: log, mysql, user=barnyard2 password=123456 dbname=snortdb host=localhost
在 snortdb 資料庫中建立 barnyard 放 snort 結果資料的 table (密碼 123456)
[root@localhost ~]# mysql snortdb -ubarnyard2 -p < /usr/local/src/barnyard2/schemas/create_mysql
****************************************
重新啟動 snort 和 barnyard2 (建議 snort 先啟動)
重新啟動 snort (因為 snort.conf 修改過)
[root@localhost barnyard2]# service snortd restart
Stopping Snort: [ OK ]
Starting Snort: PCAP_FRAMES -> 32768 * 4096 / 2 = 67108864 (1600)
Spawning daemon child...
My daemon child 54919 lives...
Daemon parent exiting (0)
[ OK ]
[root@localhost barnyard2]#
[root@localhost barnyard2]# service snortd status
snort (pid 54919) is running...
root 54919 0.0 33.1 654296 335884 ? Ssl 11:45 0:00 /usr/local/bin/snort -D -i eth0 -c /etc/snort/snort.conf
root 54943 0.0 0.0 103244 828 pts/1 S+ 11:47 0:00 grep snort
[root@localhost barnyard2]#
rm -fr /var/lock/subsys/snort
啟動 barnyard2 (會有點慢)
[root@localhost barnyard2]# service barnyard2 restart
Shutting down Snort Output Processor (barnyard2): [ OK ]
Starting Snort Output Processor (barnyard2): [ OK ]
[root@localhost barnyard2]#
[root@localhost barnyard2]# service barnyard2 status
barnyard2 (pid 54830) is running...
root 52757 0.3 33.9 654452 343412 ? Ssl 11:14 0:01 /usr/local/bin/snort -D -i eth0 -c /etc/snort/snort.conf
root 53328 0.0 0.8 60428 8856 ? Ss 11:15 0:00 barnyard2 -D -c /etc/snort/barnyard.conf -d /var/log/snort/eth0 -w /var/log/snort/eth0/barnyard2.waldo -l /var/log/snort/eth0 -a /var/log/snort/eth0/archive -f snort.log -X /var/lock/subsys/barnyard2-eth0.pid
root 54805 0.0 0.0 103244 824 pts/1 S+ 11:20 0:00 grep snort
[root@localhost barnyard2]#
測試
手動去 http://www.phpmyadmin.net 網站下載 phpMyAdmin-4.0.8-all-languages.zip 回來安裝,方便稍後檢查是否輸出到 mysql
[root@localhost src]# unzip phpMyAdmin-4.0.8-all-languages.zip -d /var/www/html
[root@localhost src]# mv /var/www/html/phpMyAdmin-4.0.8-all-languages /var/www/html/phpMyAdmin
[root@localhost barnyard2]# ls -al /var/log/snort
total 76
drwx------. 5 snort snort 4096 Oct 29 15:21 .
drwxr-xr-x. 14 root root 4096 Oct 29 10:50 ..
-rw-r--r--. 1 root root 8248 Oct 29 10:32 alert
-rw-r--r--. 1 snort snort 18 Feb 22 2013 .bash_logout
-rw-r--r--. 1 snort snort 176 Feb 22 2013 .bash_profile
-rw-r--r--. 1 snort snort 124 Feb 22 2013 .bashrc
drwxr-xr-x. 3 root root 4096 Oct 29 14:51 eth0
drwxr-xr-x. 2 snort snort 4096 Nov 12 2010 .gnome2
drwxr-xr-x. 4 snort snort 4096 Oct 18 00:00 .mozilla
-rw-------. 1 root root 7359 Oct 29 10:32 snort.log.1383013442
-rw-------. 1 root root 10853 Oct 29 15:18 snort.log.1383030811
-rw-------. 1 root root 10853 Oct 29 15:22 snort.log.1383031315
(下圖) 用瀏覽器連上 http://192.168.128.20/phpMyAdmin 網址 (IP 是 mysql + phpMyAdmin 主機的 IP ,帳號密碼為可存取 mysql 資料庫的,例如 root 和 ??? (問你自己) 或 barnyard2 和 123456)
點選 snortdb 資料庫,目前所有 tables 有 6 筆資料
到另一台主機,進行攻擊 (實測若 nikto.pl 和 snort 同一台,測試無攻擊效果)
[root@localhost nikto-2.1.5]# ./nikto.pl -h 192.168.128.102
- ***** SSL support not available (see docs for SSL install) *****
- Nikto v2.1.5
---------------------------------------------------------------------------
+ Target IP: 192.168.128.102
+ Target Hostname: 192.168.128.102
+ Target Port: 80
+ Start Time: 2013-10-29 15:27:34 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache/2.2.15 (CentOS)
+ The anti-clickjacking X-Frame-Options header is not present.
+ Apache/2.2.15 appears to be outdated (current is at least Apache/2.2.22). Apac he 1.3.42 (final release) and 2.0.64 are also current.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ Retrieved x-powered-by header: PHP/5.3.3
+ Uncommon header 'x-webkit-csp' found, with contents: default-src 'self' ;scrip t-src 'self' 'unsafe-inline' 'unsafe-eval';style-src 'self' 'unsafe-inline';img -src 'self' data: *.tile.openstreetmap.org *.tile.opencyclemap.org;
+ Uncommon header 'x-ob_mode' found, with contents: 0
+ Uncommon header 'x-frame-options' found, with contents: DENY
+ Uncommon header 'x-content-security-policy' found, with contents: default-src 'self' ;options inline-script eval-script;img-src 'self' data: *.tile.openstree tmap.org *.tile.opencyclemap.org;
+ OSVDB-3092: /phpMyAdmin/: phpMyAdmin is for managing MySQL databases, and shou ld be protected or limited to authorized hosts.
+ OSVDB-3268: /icons/: Directory indexing found.
+ Server leaks inodes via ETags, header found with file /icons/README, inode: 31 46028, size: 5108, mtime: 0x438c0358aae80
+ OSVDB-3233: /icons/README: Apache default file found.
+ /phpMyAdmin/: phpMyAdmin directory found
+ 6545 items checked: 0 error(s) and 14 item(s) reported on remote host
+ End Time: 2013-10-29 15:27:43 (GMT8) (9 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
[root@localhost nikto-2.1.5]#
回 snort 電腦檢查結果
[root@localhost barnyard2]# ls -al /var/log/snort
total 92
drwx------. 5 snort snort 4096 Oct 29 15:26 .
drwxr-xr-x. 14 root root 4096 Oct 29 10:50 ..
-rw-r--r--. 1 root root 8248 Oct 29 10:32 alert
-rw-------. 1 root root 2056 Oct 29 15:27 barnyard2.waldo
-rw-r--r--. 1 snort snort 18 Feb 22 2013 .bash_logout
-rw-r--r--. 1 snort snort 176 Feb 22 2013 .bash_profile
-rw-r--r--. 1 snort snort 124 Feb 22 2013 .bashrc
drwxr-xr-x. 3 root root 4096 Oct 29 14:51 eth0
drwxr-xr-x. 2 snort snort 4096 Nov 12 2010 .gnome2
drwxr-xr-x. 4 snort snort 4096 Oct 18 00:00 .mozilla
-rw-------. 1 root root 7359 Oct 29 10:32 snort.log.1383013442
-rw-------. 1 root root 10853 Oct 29 15:18 snort.log.1383030811
-rw-------. 1 root root 21706 Oct 29 15:27 snort.log.1383031315
[root@localhost src]#
應該會有一個 barnyard2.waldo 檔案存在,snort.log.xxxx 在每次 snort 重新啟動都會新建立一個,只有新建立的這個 size 會變大
alert 檔案在只安裝 snort,沒有安裝 barnyard 時候,每攻擊一次會變大一次,但是目前不會變大了,待研究....
(未完待續....還有 BASE 和 ADODB)
這一篇我已經實做完畢,確實可以執行,但是比較那悶您的SNORT安裝好像都不用設定Snort.conf
回覆刪除很多參考的文件有提到修改的地方例如 IPvar HOME_NET 192.168.1.0/24 (需要偵測的區段,您就沒改)
所以我就不太理解這個安裝,可能是我實力太弱了,目前還沒能夠領略 QQ
很感謝您都能在短時間寫出教學,而且都能夠讓程式跑起來,小弟委實受益良多
HOME_NET 預設值可以用,就不用改了;以前好像必須設定 or 必須改才能用 (不太記得);或者是因為每個人有各自的環境考量
回覆刪除可以的話這篇barnyard2能夠更新一下嗎>"<
回覆刪除試了好多次snort都正常執行也能收到警報(很多)
但這篇barnyard2無法讀snort.log所以...資料庫
也一直是空的=_=,期望大大能夠研究出來.....
以下是我安裝的版本
barnyard2-1.13.tar.gz
daq-2.0.2.tar.gz
snort-2.9.6.1.tar.gz
snortrules-snapshot-2961.tar.gz
snort-centos-6x.sh
libdnet-1.11.tar.gz
改版如這篇
刪除[研究] Snort 2.9.6.1 + Barnyard 安裝 (CentOS 6.5 x64)
http://shaurong.blogspot.tw/2014/06/snort-2961-barnyard-centos-65-x64.html
請問為何要用 barnyard2-1.13.tar.gz ,不用 autogen.sh 安裝 ?
arnyard2-1.13.tar.gz 從哪個網頁下載的 ?
我也是同OnoYes安裝的版本一樣,snort 有alert and sort.log.XXXXX
回覆刪除但Database只有reference不斷有record insert, why?
改版如這篇
刪除[研究] Snort 2.9.6.1 + Barnyard 安裝 (CentOS 6.5 x64)
http://shaurong.blogspot.tw/2014/06/snort-2961-barnyard-centos-65-x64.html