S - Revision history

Vlutter: moved Snort - Veronia Lutter to S

2015-01-15T18:50:26Z

← Older revision		Revision as of 21:50, 15 January 2015
(No difference)

Vlutter: Replaced content with "{{db-g7}}"

2015-01-15T16:02:30Z

Replaced content with "{{db-g7}}"

Show changes

Vlutter at 15:50, 15 January 2015

2015-01-15T15:50:30Z

← Older revision		Revision as of 18:50, 15 January 2015
Line 175:		Line 175:
	<pre> cd /usr/share/oinkmaster </pre>		<pre> cd /usr/share/oinkmaster </pre>
	<pre> bash -c "sudo ./create-sidmap.pl /etc/snort/rules > /etc/snort/sid-msg.map" </pre>		<pre> bash -c "sudo ./create-sidmap.pl /etc/snort/rules > /etc/snort/sid-msg.map" </pre>

			== Barnyard2 alglaadimisel käivitamine ==

			Tekitame faili:

			<pre> touch /etc/init.d/runbarnyard2 </pre>

			Kirjutame faili:

			<pre> nano /etc/init.d/runbarnyard2 </pre>

			<pre>
			#!/bin/sh

			case $1 in
			start)
			echo "Starting Barnyard2"
			sudo bash -c "barnyard2 -D -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -n"
			echo 'Barnyard2 started.'
			;;
			stop)
			echo "Stopping Barnyard2"
			sudo killall barnyard2
			echo 'Barnyard2 stopped.'
			;;
			restart)
			$0 stop

			sleep 4
			$0 start
			;;
			*)
			echo "usage: $0 (start\|stop\|restart)"
			;;
			esac

			exit 0 </pre>

			Anname root kasutajale kõik õigused loodud failile:

			<pre> chmod 700 /etc/init.d/runbarnyard2 </pre>

			ning uuendame:

			<pre> update-rc.d runbarnyard2 defaults 21 00 </pre>

			Muudame Barnyard2 käivitatavaks deemonina(taustal käivitatav protsess):

			<pre> nano /etc/snort/barnyard2.conf </pre>

			Selleks võtame kommentaari märgi rea 84 eest ära(tulemus peaks olema selline):

			<pre>
			# enable daemon mode
			#
			config daemon
			</pre>

			Kasutus:

			<pre> /etc/init.d/runbarnyard2 start/stop/restart </pre>

			== Apache2 / BASE graafilise kasutajaliidese seadistamine ==

			Apache2 seaditamine:

			<pre> apt-get install apache2 </pre>
			<pre> apt-get install libapache2-mod-php5 </pre>
			<pre> apt-get install libphp-adodb </pre>

			Muudame /etc/php5/apache2/php.ini faili:

			<pre> nano /etc/php5/apache2/php.ini </pre>

			ning muudame rida 462:

			<pre> error_reporting = E_ALL & ~E_NOTICE </pre>

			Seejärel muudame /etc/apache2/apache2.conf faili, et lisada autoriseerimine www/base jaoks:

			<pre> <Directory /var/www/html/base>
			AllowOverride All
			Require all granted
			</Directory> </pre>

			Taaskäivitame apache2:

			<pre> service apache2 restart </pre>

			'''Installeerime BASE sõltuvused'''

			<pre> apt-get install php-pear </pre>
			<pre> apt-get install libwww-perl </pre>
			<pre> apt-get install php5-gd </pre>

			<pre> pear config-set preferred_state alpha </pre>
			<pre> pear channel-update pear.php.net </pre>
			<pre> pear install --alldeps Image_Color Image_Canvas Image_Graph </pre>


			== Kasutatud kirjandus ==
			#http://computer-outlines.over-blog.com/article-nids-snort-barnyard2-apache2-base-with-ubuntu-14-04-lts-123532107.html

			== Autor ==
			Veronia Lutter A31

Vlutter at 15:09, 15 January 2015

2015-01-15T15:09:17Z

@@ Line 84: / Line 84: @@
 <pre> apt-get install libpcap-dev </pre>
 <pre> apt-get install libmysqlclient-dev </pre>
 Seejärel installeerime barnyard2´e:
@@ Line 165: / Line 170: @@
 <pre> /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/barnyard2/bylog.waldo -C /etc/snort/classification.config </pre>

Vlutter at 14:40, 15 January 2015

2015-01-15T14:40:12Z

← Older revision		Revision as of 17:40, 15 January 2015
Line 109:		Line 109:
	Muudame rida 347, selleks kustutame kommentaari märgi ära ning muudame parooli:		Muudame rida 347, selleks kustutame kommentaari märgi ära ning muudame parooli:

	<pre> output database: log, mysql, user=snort password=''sinuvalitudparool'' dbname=snort host=localhost </pre>		<pre> output database: log, mysql, user=snort password=sinuvalitudparool dbname=snort host=localhost </pre>

	== MySql´i seadistamine ==		== MySql´i seadistamine ==
Line 119:		Line 119:
	Installatsiooni käigus küsitakse Mysql´i serveri parooli, tuleb sisestada:		Installatsiooni käigus küsitakse Mysql´i serveri parooli, tuleb sisestada:

	<pre> ''sinuvalitudparool'' </pre>		<pre> sinuvalitudparool </pre>

	Seadistame andmebaasi:		Seadistame andmebaasi:
Line 151:		Line 151:
	<pre> source /usr/src/create_mysql; </pre>		<pre> source /usr/src/create_mysql; </pre>

	Selle päringuga näeme uusi tabeleid, mis me just importisime		Selle päringuga näeme uusi tabeleid, mis me just importisime:
	<pre> show tables; </pre>		<pre> show tables; </pre>

	<pre> exit </pre>		<pre> exit </pre>

			== Snort´i ja Barnyard´i testimine ==

			Kontrollime, kas snort teenus on käivitatud:

			<pre> service snort restart </pre>

			Manuaalselt käivitame Barnyard2´e:

			<pre> /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/barnyard2/bylog.waldo -C /etc/snort/classification.config </pre>

Vlutter at 14:36, 15 January 2015

2015-01-15T14:36:21Z

@@ Line 33: / Line 33: @@
 <pre> nano /etc/snort/snort.conf </pre>
-NB: '''Selleks, et näha nano-s, millisel real oled, tuleb kasutada CTRL + C.'''
+NB: '''Selleks, et minna mingile kindlale reale nano-s, tuleb kasutada CTRL + W ja siis CTRL + T ning kirjutada vastav reanumber.'''
 Muudame rida 51:
@@ Line 72: / Line 72: @@
 <pre>  snort -A console -u snort -g snort -c /etc/snort/snort.conf -i eth1 -T </pre>
-Käivitame snort´i otse hoiatuste konsoolirežiimis:
+Käivitame snort´i otse hoiatuste konsoolirežiimis(kui serverit nüüd pingida, peaksid ilmuma hoiatused):
 <pre> snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth1 </pre>

Vlutter at 14:03, 15 January 2015

2015-01-15T14:03:07Z

← Older revision		Revision as of 17:03, 15 January 2015
Line 13:		Line 13:
	Siin juhendis teeme kõike sudo õigustes, selleks tuleb sisestada:		Siin juhendis teeme kõike sudo õigustes, selleks tuleb sisestada:

	~~{\|style="background:lightyellow;width:300px;margin:3px;border:1px solid lightgrey" align=centre~~		<pre> sudo -i </pre>
	~~\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|~~sudo -i
	\|}

	Esmalt tuleb teha tavaline apt-get update/upgrade:		Esmalt tuleb teha tavaline apt-get update/upgrade:

	~~{\|style="background:lightyellow;width:300px;margin:3px;border:1px solid lightgrey" align=centre~~		<pre> apt-get update </pre>
	~~\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|~~apt-get update
	\|}		<pre> apt-get upgrade </pre>
	~~{\|style="background:lightyellow;width:300px;margin:3px;border:1px solid lightgrey" align=centre~~
	~~\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|~~apt-get upgrade
	\|}

	ning peale seda installeerime snort´i:		ning peale seda installeerime snort´i:

	~~{\|style="background:lightyellow;width:300px;margin:3px;border:1px solid lightgrey" align=centre~~		<pre> apt-get install snort </pre>
	~~\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|~~apt-get install snort
	\|}

	Snort´i installatsiooni ajal peab kirjutama enda koduvõrgu ehk kaitstud alamvõrgu:		Snort´i installatsiooni ajal peab kirjutama enda koduvõrgu ehk kaitstud alamvõrgu:

	~~{\|style="background:lightyellow;width:300px;margin:3px;border:1px solid lightgrey" align=centre~~		<pre> 192.168.56.0/24 </pre>
	~~\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|~~192.168.56.0/24
	\|}

	Seejärel peab muutma snort.conf faili:		Seejärel peab muutma snort.conf faili:

	~~{\|style="background:lightyellow;width:300px;margin:3px;border:1px solid lightgrey" align=centre~~		<pre> nano /etc/snort/snort.conf </pre>
	~~\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|~~nano /etc/snort/snort.conf
	\|}

	NB: '''Selleks, et näha nano-s, millisel real oled, tuleb kasutada CTRL + C.'''		NB: '''Selleks, et näha nano-s, millisel real oled, tuleb kasutada CTRL + C.'''
Line 48:		Line 37:
	Muudame rida 51:		Muudame rida 51:

	~~{\|style="background:lightyellow;width:600px;margin:3px;border:1px solid lightgrey" align=left~~		<pre> ipvar HOME_NET 192.168.56.0/24 </pre>
	~~\| style="padding:0px 0px 0px 0px;font-family:courier;font-size:8pt;" \|~~ipvar HOME_NET 192.168.56.0/24
	\|}

	ning rida 536:		ning rida 536:

	~~{\|style="background:lightyellow;width:600px;margin:3px;border:1px solid lightgrey" align=left~~		<pre> output unified2: filename snort.log, limit 128, mpls_event_types, vlan_event_types </pre>
	~~\| style="padding:0px 0px 0px 0px;font-family:courier;font-size:8pt;" \|~~output unified2: filename snort.log, limit 128, mpls_event_types, vlan_event_types
	\|}

	Peale seda taaskäivitame snort´i:		Peale seda taaskäivitame snort´i:

	~~{\|style=~~"~~background~~:~~lightyellow~~;~~width~~:~~300px~~;~~margin~~:~~3px~~;~~border~~:~~1px solid lightgrey~~" ~~align=centre~~		<pre> service snort restart </pre>
	~~\| style=~~"~~padding~~:~~0px 0px 0px 80px~~;~~font-family~~:~~courier~~;~~font~~-~~size~~:~~8pt;" \|service~~ snort ~~restart~~
	\|}		Eemaldame eelmised logikirjed:

			<pre> rm /var/log/snort/snort.log </pre>

			Muudame /etc/snort/rules/local.rules faili:

			<pre> nano /etc/snort/rules/local.rules </pre>

			lisame sinna kaks reeglit testimise eesmärgil:

			<pre>alert icmp any any -> $HOME_NET any (msg:"ICMP Test NOW!!!"; classtype:not-suspicious; sid:1000001; rev:1;)
			alert tcp any any -> $HOME_NET 80 (msg:"HTTP Test NOW!!!"; classtype:not-suspicious; sid:1000002; rev:1;) </pre>

			== Snort´i testimine ==

			Testime snort´i:

			<pre> snort -i eth1 -v </pre>

			NB: '''CTRL + C, et peatada testimine.'''

			Seejärel teeme konfiguratsiooni laadimise testi:

			<pre> snort -A console -u snort -g snort -c /etc/snort/snort.conf -i eth1 -T </pre>

			Käivitame snort´i otse hoiatuste konsoolirežiimis:

			<pre> snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth1 </pre>

Vlutter at 13:37, 15 January 2015

2015-01-15T13:37:42Z

← Older revision		Revision as of 16:37, 15 January 2015
Line 48:		Line 48:
	Muudame rida 51:		Muudame rida 51:

	{\|style="background:lightyellow;width:~~800px~~;margin:3px;border:1px solid lightgrey" align=left		{\|style="background:lightyellow;width:600px;margin:3px;border:1px solid lightgrey" align=left
	\| style="padding:0px 0px 0px ~~80px~~;font-family:courier;font-size:8pt;" \|ipvar HOME_NET 192.168.56.0/24		\| style="padding:0px 0px 0px 0px;font-family:courier;font-size:8pt;" \|ipvar HOME_NET 192.168.56.0/24
	\|}		\|}

	ning rida 536:		ning rida 536:

	{\|style="background:lightyellow;width:~~300px~~;margin:3px;border:1px solid lightgrey" align=~~centre~~		{\|style="background:lightyellow;width:600px;margin:3px;border:1px solid lightgrey" align=left
	\| style="padding:0px 0px 0px ~~80px~~;font-family:courier;font-size:8pt;" \|output unified2: filename snort.log, limit 128, mpls_event_types, vlan_event_types		\| style="padding:0px 0px 0px 0px;font-family:courier;font-size:8pt;" \|output unified2: filename snort.log, limit 128, mpls_event_types, vlan_event_types
	\|}		\|}

	Peale seda taaskäivitame snort´i:		Peale seda taaskäivitame snort´i:

	{\|style="background:lightyellow;width:~~800px~~;margin:3px;border:1px solid lightgrey" align=~~left~~		{\|style="background:lightyellow;width:300px;margin:3px;border:1px solid lightgrey" align=centre
	\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|service snort restart		\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|service snort restart
	\|}		\|}

Vlutter at 13:36, 15 January 2015

2015-01-15T13:36:45Z

← Older revision		Revision as of 16:36, 15 January 2015
Line 48:		Line 48:
	Muudame rida 51:		Muudame rida 51:

	{\|style="background:lightyellow;width:~~300px~~;margin:3px;border:1px solid lightgrey" align=~~centre~~		{\|style="background:lightyellow;width:800px;margin:3px;border:1px solid lightgrey" align=left
	\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|ipvar HOME_NET 192.168.56.0/24		\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|ipvar HOME_NET 192.168.56.0/24
	\|}		\|}
Line 60:		Line 60:
	Peale seda taaskäivitame snort´i:		Peale seda taaskäivitame snort´i:

	{\|style="background:lightyellow;width:~~300px~~;margin:3px;border:1px solid lightgrey" align=~~centre~~		{\|style="background:lightyellow;width:800px;margin:3px;border:1px solid lightgrey" align=left
	\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|service snort restart		\| style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" \|service snort restart
	\|}		\|}

Vlutter at 13:35, 15 January 2015

2015-01-15T13:35:39Z

@@ Line 42: / Line 42: @@
 {|style="background:lightyellow;width:300px;margin:3px;border:1px solid lightgrey" align=centre
 | style="padding:0px 0px 0px 80px;font-family:courier;font-size:8pt;" |nano /etc/snort/snort.conf
-Muudame
+NB: '''Selleks, et näha nano-s, millisel real oled, tuleb kasutada CTRL + C.'''
 |}