Suricata - Revision history

Rjuhanni at 10:00, 11 December 2014

2014-12-11T10:00:39Z

← Older revision		Revision as of 13:00, 11 December 2014
Line 344:		Line 344:
	</source>		</source>

	Seejärel tuleb ~~teha suricatale restart. Selleks katkestage monitooring eth1 vajutades klahvikombinatsiooni "ctrl c" ning käivitame~~ uuesti.		Seejärel tuleb suricata uuesti käivitada:
	<source lang="bash">		<source lang="bash">
	suricata -c /etc/suricata/suricata.yaml -i eth1		suricata -c /etc/suricata/suricata.yaml -i eth1

Rjuhanni at 09:47, 11 December 2014

2014-12-11T09:47:42Z

← Older revision		Revision as of 12:47, 11 December 2014
Line 393:		Line 393:
	*https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricata_Installation		*https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricata_Installation
	*https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Basic_Setup		*https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Basic_Setup
			*http://www.sans.org/reading-room/whitepapers/detection/configuring-security-onion-detect-prevent-web-application-attacks-33980

	[[Category: Linuxi administreerimine]]		[[Category: Linuxi administreerimine]]

Rjuhanni at 09:43, 11 December 2014

2014-12-11T09:43:16Z

← Older revision		Revision as of 12:43, 11 December 2014
Line 360:		Line 360:
	2. Seejärel kirjutame reegli:		2. Seejärel kirjutame reegli:
	<source lang="bash">		<source lang="bash">
	drop http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"skripti tag avastatud URIs, voimalik xss runne"; flow:to_server,established;		drop http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"skripti tag avastatud URIs, voimalik xss runne"; flow:to_server,established; uricontent:"</script>"; nocase; reference:url,ha.ckers.org/xss.html;
	uricontent:"</script>"; nocase; reference:url,ha.ckers.org/xss.html; reference:url,doc.emergingthreats.net/2009714;		reference:url,doc.emergingthreats.net/2009714; classtype:web-application-attack; sid:2009714; rev:5;)
	classtype:web-application-attack; sid:2009714; rev:5;)
	</source>		</source>

Rjuhanni at 15:13, 10 December 2014

2014-12-10T15:13:22Z

← Older revision		Revision as of 18:13, 10 December 2014
Line 359:		Line 359:

	2. Seejärel kirjutame reegli:		2. Seejärel kirjutame reegli:
	<~~code~~>		<source lang="bash">
	drop http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"skripti tag avastatud URIs, voimalik xss runne"; flow:to_server,established; uricontent:"</script>"; nocase; reference:url,ha.ckers.org/xss.html; reference:url,doc.emergingthreats.net/2009714; classtype:web-application-attack; sid:2009714; rev:5;)		drop http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"skripti tag avastatud URIs, voimalik xss runne"; flow:to_server,established;
	</~~code~~>		uricontent:"</script>"; nocase; reference:url,ha.ckers.org/xss.html; reference:url,doc.emergingthreats.net/2009714;
			classtype:web-application-attack; sid:2009714; rev:5;)
			</source>

	3. Kui reegel on tehtud, tuleb see lisada ka suricata konfiguratsiooni:		3. Kui reegel on tehtud, tuleb see lisada ka suricata konfiguratsiooni:

Rjuhanni at 15:03, 10 December 2014

2014-12-10T15:03:10Z

← Older revision		Revision as of 18:03, 10 December 2014
Line 359:		Line 359:

	2. Seejärel kirjutame reegli:		2. Seejärel kirjutame reegli:
	<~~source lang="bash"~~>		<code>
	drop http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"skripti tag avastatud URIs, voimalik xss runne"; flow:to_server,established; uricontent:"</script>"; nocase; reference:url,ha.ckers.org/xss.html; reference:url,doc.emergingthreats.net/2009714; classtype:web-application-attack; sid:2009714; rev:5;)		drop http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"skripti tag avastatud URIs, voimalik xss runne"; flow:to_server,established; uricontent:"</script>"; nocase; reference:url,ha.ckers.org/xss.html; reference:url,doc.emergingthreats.net/2009714; classtype:web-application-attack; sid:2009714; rev:5;)
	</~~source~~>		</code>

	3. Kui reegel on tehtud, tuleb see lisada ka suricata konfiguratsiooni:		3. Kui reegel on tehtud, tuleb see lisada ka suricata konfiguratsiooni:

Rjuhanni at 14:14, 10 December 2014

2014-12-10T14:14:26Z

@@ Line 363: / Line 363: @@
 </source>
-. Kui reegel on tehtud, tuleb suricata uuesti käivitada:
+. Kui reegel on tehtud, tuleb see lisada ka suricata konfiguratsiooni:
 <source lang="bash">
 suricata -c /etc/suricata/suricata.yaml -i eth1

Rjuhanni at 14:09, 10 December 2014

2014-12-10T14:09:15Z

← Older revision		Revision as of 17:09, 10 December 2014
Line 1:		Line 1:
	Autorid: Martin Leppik ja Randel Raidmets		Autorid: Martin Leppik ja Randel Raidmets

	Reeglite sisselükkamise osa: Rene Juhanni		Reeglite sisselükkamise osa, uue reegli tegemine: Rene Juhanni

	Rühm: A31		Rühm: A31
Line 202:		Line 202:
	</source>		</source>

	~~2. Loome kausta Suricata reeglite jaoks.~~
	~~<source lang="bash">~~
	~~mkdir /etc/suricata/rules~~
	~~</source>~~

	3. Avame Suricata konfiguratsiooni faili /etc/suricata/suricata.yaml		2. Avame Suricata konfiguratsiooni faili /etc/suricata/suricata.yaml
	<source lang="bash">		<source lang="bash">
	nano /etc/suricata/suricata.yaml		nano /etc/suricata/suricata.yaml
	</source>		</source>

	4. Kirjeldame, millised operatsioonisüsteemid on meie võrgus seal, kus hakkab rida "host-os-policy" ja nimetame nende ip aadressid. <ref>Yamli Host-os-policy informatsioon, https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#Host-os-policy</ref>		3. Kirjeldame, millised operatsioonisüsteemid on meie võrgus seal, kus hakkab rida "host-os-policy" ja nimetame nende ip aadressid. <ref>Yamli Host-os-policy informatsioon, https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#Host-os-policy</ref>
	<source lang="bash">		<source lang="bash">
	host-os-policy:		host-os-policy:
Line 230:		Line 226:
	</source>		</source>

	5. Kirjeldame võrgu ip aadressi ja maski kohas, mis algab reaga "address-groups:" <ref>Yamli address-groups lahtiseletus, https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#Rule-vars</ref>		4. Kirjeldame võrgu ip aadressi ja maski kohas, mis algab reaga "address-groups:" <ref>Yamli address-groups lahtiseletus, https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#Rule-vars</ref>

	<source lang="bash">		<source lang="bash">
Line 240:		Line 236:
	</source>		</source>

	6. Võimalik on lisada konfiguratsiooni faili pordid kus meil teenused töötavad. Selleks leiame konfiguratsioonist rea, mis algab fraasiga "HTTP_PORTS: "80""		5. Võimalik on lisada konfiguratsiooni faili pordid kus meil teenused töötavad. Selleks leiame konfiguratsioonist rea, mis algab fraasiga "HTTP_PORTS: "80""
	<ref>Teenuste portide lisamine, http://www.linux.org/threads/suricata-the-snort-replacer-part-2-configure-test.4348/</ref>		<ref>Teenuste portide lisamine, http://www.linux.org/threads/suricata-the-snort-replacer-part-2-configure-test.4348/</ref>

Line 354:		Line 350:


			== Uue reegli tegemine: ==
			Suricatas saab ise reegleid teha vastavalt vajadustele. Näites teeme XSSi keelava reegli.

			1. Teeme /etc/suricata/rules kausta uue faili nimega xss.rules
			<source lang="bash">
			nano /etc/suricata/rules/xss.rules
			</source>

			2. Seejärel kirjutame reegli:
			<source lang="bash">
			drop http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"skripti tag avastatud URIs, voimalik xss runne"; flow:to_server,established; uricontent:"</script>"; nocase; reference:url,ha.ckers.org/xss.html; reference:url,doc.emergingthreats.net/2009714; classtype:web-application-attack; sid:2009714; rev:5;)
			</source>

			3. Kui reegel on tehtud, tuleb suricata uuesti käivitada:
			<source lang="bash">
			suricata -c /etc/suricata/suricata.yaml -i eth1
			</source>

	=Kokkuvõte=		=Kokkuvõte=

Rjuhanni at 11:15, 4 December 2014

2014-12-04T11:15:48Z

@@ Line 1: / Line 1: @@
 Autorid: Martin Leppik ja Randel Raidmets
 Rühm: A31
@@ Line 228: / Line 230: @@
 </source>
-. Kirjeldame võru ip aadressi ja maski kohas, mis algab reaga "address-groups:" <ref>Yamli address-groups lahtiseletus, https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#Rule-vars</ref>
+. Kirjeldame võrgu ip aadressi ja maski kohas, mis algab reaga "address-groups:" <ref>Yamli address-groups lahtiseletus, https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml#Rule-vars</ref>
 <source lang="bash">
@@ Line 326: / Line 328: @@
 . Edasi saab logi puhul kasutada mõnda sündmuste korreleerimise töörista nagu näiteks SEC, mille kohta saab lugeda siit: http://simple-evcorr.sourceforge.net/SEC-tutorial/article.html või uurida EIK enda wikist teemat [https://wiki.itcollege.ee/index.php/Keskne_logihaldus_Rsyslog_ja_SEC_n%C3%A4itel Keskne logihaldus Rsyslog ja SEC näitel].
 =Kokkuvõte=

Rraidmet: /* Esmane seadistamine */

2014-01-16T12:37:06Z

Esmane seadistamine

← Older revision		Revision as of 15:37, 16 January 2014
Line 256:		Line 256:
	Lisame HTTP_PORTS sektsiooni juurde näiteks pordi 8080:		Lisame HTTP_PORTS sektsiooni juurde näiteks pordi 8080:
	<source lang="bash">		<source lang="bash">
	HTTP_PORTS: "80, 8080"		HTTP_PORTS: "80,8080"

	SHELLCODE_PORTS: "!80"		SHELLCODE_PORTS: "!80"

Rraidmet: /* Esmane seadistamine */

2014-01-16T12:36:39Z

Esmane seadistamine

← Older revision		Revision as of 15:36, 16 January 2014
Line 254:		Line 254:
	</source>		</source>

			Lisame HTTP_PORTS sektsiooni juurde näiteks pordi 8080:
			<source lang="bash">
			HTTP_PORTS: "80, 8080"

			SHELLCODE_PORTS: "!80"

			ORACLE_PORTS: 1521

			SSH_PORTS: 22

			DNP3_PORTS: 20000

			</source>

	== Kiire testimine <ref>Suricata testimine ühe reegli abil, http://www.linux.org/threads/suricata-the-snort-replacer-part-2-configure-test.4348/</ref> ==		== Kiire testimine <ref>Suricata testimine ühe reegli abil, http://www.linux.org/threads/suricata-the-snort-replacer-part-2-configure-test.4348/</ref> ==