浮雲雅築: [研究] Snort 2.9.7.0 + Barnyard 2.13 安裝 (CentOS 6.6 x64) 快速安裝程式

[研究] Snort 2.9.7.0 + Barnyard 2.13 安裝 (CentOS 6.6 x64) 快速安裝程式

2015-02-03

********************************************************************************

這幾篇是相關的 ( 3 大步驟)

[研究] snort-2.9.7.0.tar.gz (CentOS 6.5 x64) 快速安裝程式
http://shaurong.blogspot.tw/2015/02/snort-2970targz-centos-66-x64.html

[研究] Snort 2.9.7.0 + Barnyard 2.13 安裝 (CentOS 6.5 x64) 快速安裝程式
http://shaurong.blogspot.com/2015/02/snort-2970-barnyard-213-centos-66-x64.html

********************************************************************************

這幾篇是相關的 ( 3 大步驟)

[研究] snort-2.9.6.2.tar.gz (CentOS 6.5 x64) 快速安裝程式
http://shaurong.blogspot.com/2014/08/snort-2962targz-centos-65-x64.html

[研究] Snort 2.9.6.2 + Barnyard 2.13 安裝 (CentOS 6.5 x64) 快速安裝程式
http://shaurong.blogspot.com/2014/08/snort-2962-barnyard-213-centos-65-x64.html

[研究] Snort 2.9.6.1 + Barnyard + BASE 安裝 (CentOS 6.5 x64) 快速安裝程式
(待測試)

********************************************************************************

這幾篇是相關的 ( 3 大步驟)

[研究] snort-2.9.6.1.tar.gz (CentOS 6.5 x64) 快速安裝程式
http://shaurong.blogspot.tw/2014/06/snort-2961targz-centos-65-x64.html

[研究] Snort 2.9.6.1 + Barnyard 2.13 安裝 (CentOS 6.5 x64) 快速安裝程式
http://shaurong.blogspot.tw/2014/06/snort-2961-barnyard-213-centos-65-x64.html
或
[研究] Snort 2.9.6.1 + Barnyard 安裝 (CentOS 6.5 x64)
http://shaurong.blogspot.tw/2014/06/snort-2961-barnyard-centos-65-x64.html

[研究] Snort 2.9.6.1 + Barnyard + BASE 安裝 (CentOS 6.5 x64) 快速安裝程式
http://shaurong.blogspot.tw/2014/06/snort-2961-barnyard-base-centos-65-x64_20.html
或
[研究] Snort 2.9.6.1 + Barnyard + BASE 安裝 (CentOS 6.5 x64)
http://shaurong.blogspot.tw/2014/06/snort-2961-barnyard-base-centos-65-x64.html

********************************************************************************

資料庫名稱小弟用 snortdb，您可以換掉
MySQL root 密碼用 654321，您可以換掉
MySQL 帳號 barnyard2 ，您可以換掉
MySQL 帳號 barnyard2 的密碼 123456，您可以換掉

全部用 root 操作省麻煩
su root

快速安裝程式如下

#!/bin/bash
echo -e "\033[31m"
echo -e "Program : snort2.9.7.0_barnyard2_centos6.6x64.sh "
echo -e "Barnyard 2.13 Install Shell Script (CentOS 6.6 x64 + Snort 2.9.7.0) "
echo -e "by Shau-Rong Lu 2015-02-03 "
echo -e "\033[0m"

yum -y install mysql mysql-devel git libtool mysql-server httpd php php-mysql php-mbstring php-mcrypt

cd /usr/local/src
git clone https://github.com/firnsy/barnyard2.git barnyard2
cd barnyard2
./autogen.sh

if [ "`uname -a | grep x86_64`" != "" ]; then
echo "x86_64"
./configure --with-mysql --with-mysql-libraries=/usr/lib64/mysql
else
echo "x86"
./configure --with-mysql
exit
fi

make && make install

cp rpm/barnyard2 /etc/init.d/
chmod +x /etc/init.d/barnyard2
cp rpm/barnyard2.config /etc/sysconfig/barnyard2
chkconfig --add barnyard2

ln -s /usr/local/etc/barnyard2.conf /etc/snort/barnyard.conf
ln -s /usr/local/bin/barnyard2 /usr/bin/
mkdir -p /var/log/snort/eth0/archive/

ln -s /usr/local/bin/snort /usr/sbin/snort

# modify BARNYARD_OPTS=
sed -i -e "s@BARNYARD_OPTS=@#BARNYARD_OPTS=@" /etc/init.d/barnyard2
sed -i -e "/BARNYARD_OPTS=\"-D -c \$CONF/aBARNYARD_OPTS=\"-D -c /etc/snort/barnyard.conf -d /var/log/snort -w /var/log/snort/barnyard2.waldo -l /var/log/snort -a /var/log/snort -f snort.log -X /var/lock/subsys/barnyard2-eth0.pid\"" /etc/init.d/barnyard2
cat /etc/init.d/barnyard2 | grep "BARNYARD_OPTS="

chkconfig barnyard2 reset

# modify /etc/sysconfig/barnyard2, match barnyard's and snort's setting
# remark LOG_FILE=
sed -i -e "s@LOG_FILE=@#LOG_FILE=@" /etc/sysconfig/barnyard2
# append LOG_FILE="snort.log"
sed -i -e "/LOG_FILE=\"snort_unified.log\"/aLOG_FILE=\"snort.log\"" /etc/sysconfig/barnyard2
# check
cat /etc/sysconfig/barnyard2 | grep "LOG_FILE="

# modify /etc/snort/snort.conf
# remark output unified2
sed -i -e "s@output unified2@#output unified2@" /etc/snort/snort.conf
# append output unified2: filename snort.log, limit 128
sed -i -e "/output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types/aoutput unified2: filename snort.log, limit 128" /etc/snort/snort.conf
# check
cat /etc/snort/snort.conf | grep "output unified2"

# modify /etc/sysconfig/snort
cp /usr/local/src/snort-2.9.7.0/rpm/snort.sysconfig /etc/sysconfig/snort
# remark two line
sed -i -e "s@ALERTMODE=fast@#ALERTMODE=fast@" /etc/sysconfig/snort
sed -i -e "s@BINARY_LOG=1@#BINARY_LOG=1@" /etc/sysconfig/snort
# check
cat /etc/sysconfig/snort | grep "ALERTMODE=fast"
cat /etc/sysconfig/snort | grep "BINARY_LOG=1"

# set MySQL root's password is 654321, you can change
service mysqld restart
/usr/bin/mysqladmin -u root password '654321'
/usr/bin/mysqladmin -u root -h localhost.localdomain password '654321' -p654321

mysql -e "create database snortdb;" -uroot -p654321
mysql -e "grant all privileges on snortdb.* to barnyard2@localhost identified by '123456';" -uroot -p654321
mysql -e "flush privileges;" -uroot -p654321

#set barnyard2 output to mysql
#remark
sed -i -e "s@output database@#output database@" /etc/snort/barnyard.conf
#append
sed -i -e "/output database: log, mysql, user=root password=test dbname=db host=localhost/aoutput database: log, mysql, user=barnyard2 password=123456 dbname=snortdb host=localhost" /etc/snort/barnyard.conf
# check
cat /etc/snort/barnyard.conf | grep "output database"

# create barnyard2's tables in snortdb
mysql snortdb -ubarnyard2 -p123456 < /usr/local/src/barnyard2/schemas/create_mysql
#check
mysql -e "use snortdb; show tables;" -uroot -p654321

cp /usr/local/src/snort-2.9.7.0/etc/gen-msg.map /etc/snort/.

#Start
barnyard2 -T -c /etc/snort/barnyard.conf -d /var/log/snort -w /var/log/snort/barnyard2.waldo -l /var/log/snort -a /var/log/snort -f snort.log -X /var/lock/subsys/barnyard2-eth0.pid
if [ "$?" != "0" ]; then
echo "Barnyard2 or Snort Setting is error !"
exit
fi

service snortd restart
if [ "$?" != "0" ]; then
echo "Snort ReStart Failed !"
exit
fi
service snortd status
ps axu| grep snort

service barnyard2 restart
if [ "$?" != "0" ]; then
echo "Barnyard2 ReStart Failed !"
exit
fi
service barnyard2 status
ps aux | grep snort

其中 barnyard2 執行情況如下

[root@localhost barnyard2]# barnyard2 -T -c /etc/snort/barnyard.conf -d /var/log/snort -w /var/log/snort/barnyard2.waldo -l /var/log/snort -a /var/log/snort -f snort.log -X /var/lock/subsys/barnyard2-eth0.pid
Running in Test mode

--== Initializing Barnyard2 ==--
Initializing Input Plugins!
Initializing Output Plugins!
Parsing config file "/etc/snort/barnyard.conf"

+[ Signature Suppress list ]+
----------------------------
+[No entry in Signature Suppress List]+
----------------------------
+[ Signature Suppress list ]+

Barnyard2 spooler: Event cache size set to [2048]
INFO database: Defaulting Reconnect/Transaction Error limit to 10
INFO database: Defaulting Reconnect sleep time to 5 second

[ClassificationPullDataStore()]: No Classification found in database ...
[SignaturePullDataStore()]: No signature found in database ...
[SystemPullDataStore()]: No System found in database ...
[ReferencePullDataStore()]: No Reference found in database ...
[SignatureReferencePullDataStore()]: No Reference found in database ...
database: compiled support for (mysql)
database: configured to use mysql
database: schema version = 107
database: host = localhost
database: user = barnyard2
database: database name = snortdb
database: sensor name = localhost.localdomain:NULL
database: sensor id = 1
database: sensor cid = 1
database: data encoding = hex
database: detail level = full
database: ignore_bpf = no
database: using the "log" facility

--== Initialization Complete ==--

______ -*> Barnyard2 <*-
/ ,,_ \ Version 2.1.14 (Build 335)
|o" )~| By Ian Firns (SecurixLive): http://www.securixlive.com/
+ '''' + (C) Copyright 2008-2013 Ian Firns <firnsy@securixlive.com>

Barnyard2 successfully loaded configuration file!
Barnyard2 exiting
database: Closing connection to database "snortdb"
[root@localhost barnyard2]#

用 ps aux | grep snort 檢查應該有兩筆，一筆是 snort 執行，一筆是 barnyard2 執行，少了就有問題。

[root@localhost barnyard2]# ps aux | grep snort
root 29516 0.0 20.3 722560 387292 ? Ssl 12:20 0:00 /usr/local/bin/snort -D -i eth0 -c /etc/snort/snort.conf
root 29550 55.6 5.0 148000 96556 ? Ss 12:20 0:23 barnyard2 -D -c /etc/snort/barnyard.conf -d /var/log/snort -w /var/log/snort/barnyard2.waldo -l /var/log/snort -a /var/log/snort -f snort.log -X /var/lock/subsys/barnyard2-eth0.pid
root 29569 0.0 0.0 103244 872 pts/1 S+ 12:21 0:00 grep snort
[root@localhost barnyard2]#

測試

手動去
http://www.phpmyadmin.net/home_page/downloads.php
網站下載 phpMyAdmin-4.0.10-all-languages.zip 回來安裝，方便稍後檢查是否輸出到 mysql
( phpMyAdmin 4.1.x 和 4.2.x 只支援 MySQL 5.5.0 或更新，不支援 CentOS 6.6 用 yum 安裝的 5.1.x 版，只能下載 4.0.x 版用)

[root@localhost src]# yum -y install httpd
[root@localhost src]# service httpd restart

[root@localhost src]# cd /usr/local/src
[root@localhost src]# unzip phpMyAdmin-4.0.10.8-all-languages.zip -d /var/www/html

[root@localhost src]# mv /var/www/html/phpMyAdmin-4.0.10.8-all-languages /var/www/html/phpMyAdmin

檢查目前輸出情況

[root@localhost src]# ls -al /var/log/snort
total 48
drwx------. 5 snort snort 4096 Feb 3 12:21 .
drwxr-xr-x. 14 root root 4096 Feb 3 12:14 ..
-rw-r--r--. 1 root root 4343 Feb 3 12:04 alert
-rw-------. 1 root root 2056 Feb 3 12:21 barnyard2.waldo
-rw-r--r--. 1 snort snort 18 Oct 16 21:56 .bash_logout
-rw-r--r--. 1 snort snort 176 Oct 16 21:56 .bash_profile
-rw-r--r--. 1 snort snort 124 Oct 16 21:56 .bashrc
drwxr-xr-x. 3 root root 4096 Feb 3 12:17 eth0
drwxr-xr-x. 2 snort snort 4096 Nov 12 2010 .gnome2
drwxr-xr-x. 4 snort snort 4096 Feb 3 2015 .mozilla
-rw-------. 1 root root 2876 Feb 3 12:04 snort.log.1422935941
-rw-------. 1 root root 0 Feb 3 12:20 snort.log.1422937241
[root@localhost src]#

(下圖) 用瀏覽器連上
http://192.168.128.101/phpMyAdmin
網址 (IP 是 mysql + phpMyAdmin 主機的 IP ，帳號密碼為可存取 mysql 資料庫的，例如 root 和 654321 (問你自己) 或 barnyard2 和 123456)

點選 snortdb 資料庫，看目前所有 tables 有幾筆資料

到另一台主機，進行攻擊 (實測若 nikto.pl 和 snort 同一台，測試無攻擊效果)
Snort 那台 IP 為 192.168.128.101

[root@localhost nikto-2.1.5]# ./nikto.pl -h 192.168.128.101

回 snort 電腦檢查結果

[root@localhost src]# ls -al /var/log/snort
total 52
drwx------. 5 snort snort 4096 Feb 3 12:21 .
drwxr-xr-x. 14 root root 4096 Feb 3 12:14 ..
-rw-r--r--. 1 root root 4343 Feb 3 12:04 alert
-rw-------. 1 root root 2056 Feb 3 12:27 barnyard2.waldo
-rw-r--r--. 1 snort snort 18 Oct 16 21:56 .bash_logout
-rw-r--r--. 1 snort snort 176 Oct 16 21:56 .bash_profile
-rw-r--r--. 1 snort snort 124 Oct 16 21:56 .bashrc
drwxr-xr-x. 3 root root 4096 Feb 3 12:17 eth0
drwxr-xr-x. 2 snort snort 4096 Nov 12 2010 .gnome2
drwxr-xr-x. 4 snort snort 4096 Feb 3 2015 .mozilla
-rw-------. 1 root root 2876 Feb 3 12:04 snort.log.1422935941
-rw-------. 1 root root 3572 Feb 3 12:27 snort.log.1422937241
[root@localhost src]#

應該會有一個 barnyard2.waldo 檔案存在，snort.log.xxxx 可能不只一個，在每次 snort 重新啟動都會新建立一個，只有新建立的這個 size 會變大

(下圖) 所有 tables 的資料筆數應該增加 ( 請等幾秒按 F5 更新畫面，寫入要花點時間)