[研究] Suricata 1.4.6 入侵偵測系統安裝 (CentOS 6.4 x64)

[研究] Suricata 1.4.6 入侵偵測系統安裝 (CentOS 6.4 x64)

**********************************************************************************

這幾篇是相關的

[研究] Suricata 1.4.6 入侵偵測系統安裝 (CentOS 6.4 x64)
http://shaurong.blogspot.com/2013/10/suricata-146-centos-64-x64.html
或
[研究] Suricata 1.4.6 快速安裝程式 (CentOS 6.4 x64)
http://shaurong.blogspot.com/2013/10/suricata-146-centos-64-x64_31.html

[研究] Barnyard2 for Suricata 1.4.6 安裝 (CentOS 6.4 x64)
http://shaurong.blogspot.com/2013/11/barnyard2-for-suricata-146-centos-64-x64.html
或
[研究] Barnyard2 for Suricata 1.4.6 快速安裝程式 (CentOS 6.4 x64)
http://shaurong.blogspot.com/2013/10/barnyard2-for-suricata-146-centos-64-x64.html

[研究] Suricata 1.4.6 + Barnyard + BASE 安裝 (CentOS 6.4 x64)
http://shaurong.blogspot.com/2013/11/suricata-146-barnyard-base-centos-64-x64.html

**********************************************************************************

Suricata IDS 是一種入侵偵測系統(intrusion Detection Systems, IDS)。

Snort vs Suricata 比較
http://wiki.aanval.com/wiki/Snort_vs_Suricata
Suricata 最大優於 Snort 特點是支援 Multi-Threads

Quantitative Analysis of Intrusion Detection Systems: Snort and Suricata
http://people.clarkson.edu/~jmatthew/publications/SPIE_SnortSuricata_2013.pdf
(這裡有效能圖比較，為了方便辨識，小弟上了點顏色)

(下圖) 預設組態，在 2,3,4 cores 時候，Suricata 效能遠超過 Snort

(下圖) Suricata 的 CPU 使用率比 Snort 低

(下圖) CPU cores 不大於4個時，Suricata 的 RAM 用量較高，超過8個時候，Snort暴增

官方網站
http://www.openinfosecfoundation.org/index.php/download-suricata

參考
https://redmine.openinfosecfoundation.org/projects/suricata/wiki
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Quick_Start_Guide
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricata_Installation
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_56_Installation
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Basic_Setup
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricata_User_Guide

安裝

su root
cd /usr/local/src

wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
rpm -Uvh epel-release-6-8.noarch.rpm

yum -y install libpcap libpcap-devel libnet libnet-devel pcre pcre-devel gcc gcc-c++ automake autoconf libtool make libyaml libyaml-devel zlib zlib-devel file-devel libcap-ng libcap-ng-devel

rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/libnfnetlink-1.0.0-1.x86_64.rpm
rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/libnfnetlink-devel-1.0.0-1.x86_64.rpm
rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/libnetfilter_queue-0.0.17-2.x86_64.rpm
rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/libnetfilter_queue-devel-0.0.17-2.x86_64.rpm

wget http://www.openinfosecfoundation.org/download/suricata-1.4.6.tar.gz
tar -xvzf suricata-1.4.6.tar.gz
cd suricata-1.4.6
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
make
make install-full
ldconfig

測試

# 測試程式可否執行

[root@localhost suricata]# /usr/bin/suricata
30/10/2013 -- 14:03:14 - <Info> - This is Suricata version 1.4.6 RELEASE
30/10/2013 -- 14:03:14 - <Info> - CPUs/cores online: 1
30/10/2013 -- 14:03:14 - <Info> - allocated 3670016 bytes of memory for the defrag hash... 65536 buckets of size 56
30/10/2013 -- 14:03:14 - <Info> - preallocated 65535 defrag trackers of size 144
30/10/2013 -- 14:03:14 - <Info> - defrag memory usage: 13107056 bytes, maximum: 33554432
Suricata 1.4.6
USAGE: /usr/bin/suricata [OPTIONS] [BPF FILTER]

        -c <path>                            : path to configuration file
        -T                                   : test configuration file (use with -c)
        -i <dev or ip>                       : run in pcap live mode
        -F <bpf filter file>                 : bpf filter file
        -r <path>                            : run in pcap file/offline mode
        -s <path>                            : path to signature file loaded in addition to suricata.yaml settings (optional)
        -S <path>                            : path to signature file loaded exclusively (optional)
        -l <dir>                             : default log directory
        -D                                   : run as daemon
        -V                                   : display Suricata version
        --list-app-layer-protos              : list supported app layer protocols
        --list-keywords[=all|csv|<kword>]    : list keywords implemented by the engine
        --list-runmodes                      : list supported runmodes
        --runmode <runmode_id>               : specific runmode modification the engine should run.  The argument
                                               supplied should be the id for the runmode obtained by running
                                               --list-runmodes
        --engine-analysis                    : print reports on analysis of different sections in the engine and exit.
                                               Please have a look at the conf parameter engine-analysis on what reports
                                               can be printed
        --pidfile <file>                     : write pid to this file (only for daemon mode)
        --init-errors-fatal                  : enable fatal failure on signature init error
        --dump-config                        : show the running configuration
        --build-info                         : display build information
        --pcap[=<dev>]                       : run in pcap mode, no value select interfaces from suricata.yaml
        --pcap-buffer-size                   : size of the pcap buffer value from 0 - 2147483647
        --af-packet[=<dev>]                  : run in af-packet mode, no value select interfaces from suricata.yaml
        --user <user>                        : run suricata as this user after init
        --group <group>                      : run suricata as this group after init
        --erf-in <path>                      : process an ERF file


To run the engine with default configuration on interface eth0 with signature file "signatures.rules", run the command as:

/usr/bin/suricata -c suricata.yaml -s signatures.rules -i eth0

[root@localhost suricata]#

# 顯示版本

[root@localhost suricata-1.4.6]# /usr/bin/suricata -V
This is Suricata version 1.4.6 RELEASE

# 測試設定檔案  /etc/suricata//suricata.yaml

/usr/bin/suricata -T -c /etc/suricata//suricata.yaml -i eth0

如果看到這個 Warning 可不理會，這是因為 /etc/suricata/rules/emerging-icmp.rules 中每條 rule 都關閉了
30/10/2013 -- 14:09:27 - <Warning> - [ERRCODE: SC_ERR_NO_RULES(42)] - No rules loaded from /etc/suricata/rules/emerging-icmp.rules

The two most common are Oinkmaster and Pulledpork. For a guide see:
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster

# 測試輸出到檔案

vi  /etc/suricata//suricata.yaml

找到這些敘述，預設只會輸出結果到 console 畫面，可把 file 的 enabled 從 no 改為 yes，就會輸出到 /var/log/suricata.log

  outputs:
  - console:
      enabled: yes
  - file:
      enabled: yes
      filename: /var/log/suricata.log
  - syslog:
      enabled: no
      facility: local5
      format: "[%i] <%d> -- "

# 以前景方式執行 (要結束就 Ctrl-C 中斷)

/usr/bin/suricata -c /etc/suricata//suricata.yaml -i eth0

# 以背景 (daemon) 方式執行 (多 -D 參數)

/usr/bin/suricata -D -c /etc/suricata//suricata.yaml -i eth0

背景方式執行的中斷比較麻煩，先用找出 PID 再用 kill 砍掉

[root@localhost suricata]# ps aux | grep suricata
root     36436 87.5  9.4 120508 96036 ?        Rs   14:40   0:07 /usr/bin/suricata -D -c /etc/suricata//suricata.yaml -i eth0
root     36438  0.0  0.0 103244   828 pts/1    S+   14:40   0:00 grep sur
[root@localhost suricata]# kill -9 36436
[root@localhost suricata]# ps aux |  | grep suricata
root     36440  0.0  0.0 103244   828 pts/1    S+   14:40   0:00 grep sur
[root@localhost suricata]#

# 攻擊測試

目前 suricata 電腦上情況

[root@localhost ~]# ls  -al  /var/log/suricata
total 88
drwxr-xr-x.  3 root root  4096 Oct 30 14:09 .
drwxr-xr-x. 14 root root  4096 Oct 30 14:09 ..
-rw-r-----.  1 root root 17805 Oct 30 14:08 fast.log
drwxr-xr-x.  2 root root  4096 Oct 30 13:57 files
-rw-r-----.  1 root root     0 Oct 30 14:07 http.log
-rw-r--r--.  1 root root 30867 Oct 30 14:08 stats.log
-rw-r-----.  1 root root 24044 Oct 30 14:08 unified2.alert.1383113238

另外找一台主機來攻擊 ( nikto 好像無法對自己攻擊，所以必須另外找一台)

[root@localhost ~]# wget  http://www.cirt.net/nikto/nikto-current.tar.gz

[root@localhost ~]# tar zxvf nikto-current.tar.gz

[root@localhost ~]# cd nikto-*

[root@localhost nikto-2.1.5]# chmod +x nikto.pl

[root@localhost nikto-2.1.5]# ./nikto.pl -h 192.168.128.102

- ***** SSL support not available (see docs for SSL install) *****
- Nikto v2.1.5
---------------------------------------------------------------------------
+ No web server found on 192.168.128.102:80
---------------------------------------------------------------------------
+ 0 host(s) tested
[root@localhost nikto-2.1.5]#

現在 suricata 電腦上情況

[root@localhost ~]# ls  -al  /var/log/suricata
total 132
drwxr-xr-x.  3 root root  4096 Oct 30 14:13 .
drwxr-xr-x. 14 root root  4096 Oct 30 14:09 ..
-rw-r-----.  1 root root 31143 Oct 30 14:14 fast.log
drwxr-xr-x.  2 root root  4096 Oct 30 13:57 files
-rw-r-----.  1 root root     0 Oct 30 14:07 http.log
-rw-r--r--.  1 root root 41152 Oct 30 14:13 stats.log
-rw-r-----.  1 root root 24044 Oct 30 14:08 unified2.alert.1383113238
-rw-r--r--.  1 root root 19113 Oct 30 14:14 unified2.alert.1383113613
[root@localhost suricata]#

rule 管理可考慮 Oinkmaster and Pulledpork
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster

建立一個方便執行/停止的程式

#!/bin/bash

echo -e "\033[31m"
echo -e "Program : Suricata_Manager.sh "
echo -e "Suricata Daemon Runtime Manager Maker Shell Script (CentOS 6.4 x86_64) "
echo -e "by Shau-Rong Lu 2013/10/30 "
echo -e "\033[0m"

rm -fr /etc/init.d/suricatad

echo ""  > /etc/init.d/suricatad
echo "" >> /etc/init.d/suricatad
echo ". /etc/rc.d/init.d/functions "  >> /etc/init.d/suricatad
echo "" >> /etc/init.d/suricatad
echo "case \"\$1\" in " >> /etc/init.d/suricatad
echo "start)" >> /etc/init.d/suricatad
echo "  echo -n \"Starting Suricata: \"" >> /etc/init.d/suricatad
echo "  daemon PCAP_FRAMES=max /usr/bin/suricata -D -c /etc/suricata//suricata.yaml -i eth0" >> /etc/init.d/suricatad
echo "  echo" >> /etc/init.d/suricatad
echo "  ;;" >> /etc/init.d/suricatad
echo "" >> /etc/init.d/suricatad
echo "stop)" >> /etc/init.d/suricatad
echo "  echo -n \"Stopping Suricata: \"" >> /etc/init.d/suricatad
echo "  killproc suricata" >> /etc/init.d/suricatad
echo "  echo" >> /etc/init.d/suricatad
echo "  ;;" >> /etc/init.d/suricatad
echo "" >> /etc/init.d/suricatad
echo "restart)" >> /etc/init.d/suricatad
echo "  \$0 stop" >> /etc/init.d/suricatad
echo "  \$0 start" >> /etc/init.d/suricatad
echo "  ;;" >> /etc/init.d/suricatad
echo "status)" >> /etc/init.d/suricatad
echo "  status suricata" >> /etc/init.d/suricatad
echo "  ;;" >> /etc/init.d/suricatad
echo "*)" >> /etc/init.d/suricatad
echo "  echo \"Usage: service suricatad {start|stop|restart|status}\"" >> /etc/init.d/suricatad
echo "  exit 1" >> /etc/init.d/suricatad
echo "  esac" >> /etc/init.d/suricatad
echo "  exit 0" >> /etc/init.d/suricatad

chmod +x /etc/init.d/suricatad

以後 ...

啟動程式

service  suricatad start

停止程式

service  suricatad stop

重新啟動程式

service  suricatad restart

顯示狀態

service  suricatad status

(完)

相關

[研究] snort-2.9.5.5.tar.gz (CentOS 6.4 x64) 快速安裝程式
http://shaurong.blogspot.tw/2013/10/snort-2955targz-centos-64-x64.html