|
|
| Line 1: |
Line 1: |
| == Sissejuhatus ==
| | {{db-g7}} |
| Snort on tasuta vabavaraline võrgu sissetungi vältimise süsteem ja võrgu sissetungi avastamise süsteem,mis on loodud Martin Roesch´i poolt 1998. aastal. Snorti vabavaralisel võrgupõhisel sissetungi avastamise süsteemil on võime teostada reaalajas liikluse analüüsi ja pakettide logimist IP võrkudes. Snort teostab protokolli analüüsi, sisu otsimist ja sisu vastavust.
| |
| | |
| Programmi saab samuti kasutada, et avastada sonde või rünnakuid, kaasa arvatud operatsioonisüsteemi sõrmejälgede katseid,
| |
| juurdepääsu liideseid, puhvri ületäitumisi, serveri sõnumiploki sonde ja salajasi portide skaneerimisi.
| |
| | |
| Siin juhendis seadistame võrgu sissetungi vältimise süsteemi snort, milleks konfigureerime SNORT´i, Barnyard2´e, MySql´i ja BASE´i Ubuntu 14.04-le.
| |
| | |
| Seda konfiguratsiooni on natuke keeruline seadistada ja diagnoosida ning vajab mõningast tarkvara kompilatsiooni.
| |
| | |
| == SNORT installeerimine ja seadistamine ==
| |
| | |
| Siin juhendis teeme kõike sudo õigustes, selleks tuleb sisestada:
| |
| | |
| <pre> sudo -i </pre>
| |
| | |
| Esmalt tuleb teha tavaline apt-get update/upgrade:
| |
| | |
| <pre> apt-get update </pre>
| |
| | |
| <pre> apt-get upgrade </pre>
| |
| | |
| ning peale seda installeerime snort´i:
| |
| | |
| <pre> apt-get install snort </pre>
| |
| | |
| Snort´i installatsiooni ajal peab kirjutama enda koduvõrgu ehk kaitstud alamvõrgu:
| |
| | |
| <pre> 192.168.56.0/24 </pre>
| |
| | |
| Seejärel peab muutma snort.conf faili:
| |
| | |
| <pre> nano /etc/snort/snort.conf </pre>
| |
| | |
| NB: '''Selleks, et minna mingile kindlale reale nano-s, tuleb kasutada CTRL + W ja siis CTRL + T ning kirjutada vastav reanumber.'''
| |
| | |
| Muudame rida 51:
| |
| | |
| <pre> ipvar HOME_NET 192.168.56.0/24 </pre>
| |
| | |
| ning rida 536:
| |
| | |
| <pre> output unified2: filename snort.log, limit 128, mpls_event_types, vlan_event_types </pre>
| |
| | |
| Peale seda taaskäivitame snort´i:
| |
| | |
| <pre> service snort restart </pre>
| |
| | |
| Eemaldame eelmised logikirjed:
| |
| | |
| <pre> rm /var/log/snort/snort.log </pre>
| |
| | |
| Muudame /etc/snort/rules/local.rules faili:
| |
| | |
| <pre> nano /etc/snort/rules/local.rules </pre>
| |
| | |
| lisame sinna kaks reeglit testimise eesmärgil:
| |
| | |
| <pre>alert icmp any any -> $HOME_NET any (msg:"ICMP Test NOW!!!"; classtype:not-suspicious; sid:1000001; rev:1;)
| |
| alert tcp any any -> $HOME_NET 80 (msg:"HTTP Test NOW!!!"; classtype:not-suspicious; sid:1000002; rev:1;) </pre>
| |
| | |
| == Snort´i testimine ==
| |
| | |
| Testime snort´i:
| |
| | |
| <pre> snort -i eth1 -v </pre>
| |
| | |
| NB: '''CTRL + C, et peatada testimine.'''
| |
| | |
| Seejärel teeme konfiguratsiooni laadimise testi:
| |
| | |
| <pre> snort -A console -u snort -g snort -c /etc/snort/snort.conf -i eth1 -T </pre>
| |
| | |
| Käivitame snort´i otse hoiatuste konsoolirežiimis(kui serverit nüüd pingida, peaksid ilmuma hoiatused):
| |
| | |
| <pre> snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth1 </pre>
| |
| | |
| == Barnyard2 seadistamine ==
| |
| | |
| Esmalt me installeerime komilatsiooni sõltuvused ja barnyard2 sõltuvused:
| |
| | |
| <pre> apt-get install autoconf </pre>
| |
| <pre> apt-get install libtool </pre>
| |
| <pre> apt-get install libpcap-dev </pre>
| |
| <pre> apt-get install libmysqlclient-dev </pre>
| |
| <pre> apt-get install libdumbnet-dev </pre>
| |
| | |
| Tuleb teha ka nimeviit:
| |
| | |
| <pre> ln -s /usr/include/dumbnet.h /usr/include/dnet.h </pre>
| |
| | |
| Seejärel installeerime barnyard2´e:
| |
| | |
| <pre> cd /usr/src </pre>
| |
| <pre> wget https://github.com/firnsy/barnyard2/tarball/master </pre>
| |
| <pre> tar -zxf master </pre>
| |
| <pre> cd firnsy-barnyard2*</pre>
| |
| <pre> autoreconf -fvi -I ./m4 </pre>
| |
| <pre> ./configure --with-mysql --with-mysql-libraries=/usr/lib/x86_64-linux-gnu </pre>
| |
| <pre> make </pre>
| |
| <pre> make install </pre>
| |
| <pre> cp /usr/local/etc/barnyard2.conf /etc/snort </pre>
| |
| <pre> cp schemas/create_mysql /usr/src </pre>
| |
| <pre> mkdir /var/log/barnyard2 </pre>
| |
| | |
| Muudame Barnyard2.conf faili:
| |
| | |
| <pre> nano /etc/snort/barnyard2.conf </pre>
| |
| | |
| Muudame rida 226:
| |
| | |
| <pre> output alert_fast </pre>
| |
| | |
| Muudame rida 347, selleks kustutame kommentaari märgi ära ning muudame parooli:
| |
| | |
| <pre> output database: log, mysql, user=snort password=sinuvalitudparool dbname=snort host=localhost </pre>
| |
| | |
| == MySql´i seadistamine ==
| |
| | |
| Installeerime MySqli serveri:
| |
| | |
| <pre> apt-get install mysql-server </pre>
| |
| | |
| Installatsiooni käigus küsitakse Mysql´i serveri parooli, tuleb sisestada:
| |
| | |
| <pre> sinuvalitudparool </pre>
| |
| | |
| Seadistame andmebaasi:
| |
| | |
| <pre> mysql -u root -p </pre>
| |
| | |
| Sisestame need read SQL> konsooli:
| |
| | |
| <pre> create database snort; </pre>
| |
| <pre> create database archive; </pre>
| |
| | |
| <pre> grant usage on snort.* to snort@localhost; </pre>
| |
| <pre> grant usage on archive.* to snort@localhost; </pre>
| |
| | |
| <pre> set password for snort@localhost=PASSWORD('sinuvalitudparool'); </pre>
| |
| | |
| <pre> grant all privileges on snort.* to snort@localhost; </pre>
| |
| <pre> grant all privileges on archive.* to snort@localhost; </pre>
| |
| | |
| <pre> flush privileges; </pre>
| |
| | |
| <pre> exit </pre>
| |
| | |
| Seejärel kasutame Snort´i struktuuri MySqli´i andmebaasis:
| |
| | |
| <pre> mysql -u root -p </pre>
| |
| | |
| Sisestame:
| |
| | |
| <pre> use snort; </pre>
| |
| <pre> source /usr/src/create_mysql; </pre>
| |
| | |
| Selle päringuga näeme uusi tabeleid, mis me just importisime:
| |
| <pre> show tables; </pre>
| |
| | |
| <pre> exit </pre>
| |
| | |
| == Snort´i ja Barnyard´i testimine ==
| |
|
| |
| Kontrollime, kas snort teenus on käivitatud:
| |
| | |
| <pre> service snort restart </pre>
| |
| | |
| Manuaalselt käivitame Barnyard2´e:
| |
| | |
| <pre> /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/barnyard2/bylog.waldo -C /etc/snort/classification.config </pre>
| |
| | |
| Tuleb luua ka sid-msg-map fail:
| |
| | |
| <pre> cd /usr/share/oinkmaster </pre>
| |
| <pre> bash -c "sudo ./create-sidmap.pl /etc/snort/rules > /etc/snort/sid-msg.map" </pre>
| |
| | |
| == Barnyard2 alglaadimisel käivitamine ==
| |
| | |
| Tekitame faili:
| |
| | |
| <pre> touch /etc/init.d/runbarnyard2 </pre>
| |
| | |
| Kirjutame faili:
| |
| | |
| <pre> nano /etc/init.d/runbarnyard2 </pre>
| |
| | |
| <pre>
| |
| #!/bin/sh
| |
| | |
| case $1 in
| |
| start)
| |
| echo "Starting Barnyard2"
| |
| sudo bash -c "barnyard2 -D -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -n"
| |
| echo 'Barnyard2 started.'
| |
| ;;
| |
| stop)
| |
| echo "Stopping Barnyard2"
| |
| sudo killall barnyard2
| |
| echo 'Barnyard2 stopped.'
| |
| ;;
| |
| restart)
| |
| $0 stop
| |
| | |
| sleep 4
| |
| $0 start
| |
| ;;
| |
| *)
| |
| echo "usage: $0 (start|stop|restart)"
| |
| ;;
| |
| esac
| |
| | |
| exit 0 </pre>
| |
| | |
| Anname root kasutajale kõik õigused loodud failile:
| |
| | |
| <pre> chmod 700 /etc/init.d/runbarnyard2 </pre>
| |
| | |
| ning uuendame:
| |
| | |
| <pre> update-rc.d runbarnyard2 defaults 21 00 </pre>
| |
| | |
| Muudame Barnyard2 käivitatavaks deemonina(taustal käivitatav protsess):
| |
| | |
| <pre> nano /etc/snort/barnyard2.conf </pre>
| |
| | |
| Selleks võtame kommentaari märgi rea 84 eest ära(tulemus peaks olema selline):
| |
| | |
| <pre>
| |
| # enable daemon mode
| |
| #
| |
| config daemon
| |
| </pre>
| |
| | |
| Kasutus:
| |
| | |
| <pre> /etc/init.d/runbarnyard2 start/stop/restart </pre>
| |
| | |
| == Apache2 / BASE graafilise kasutajaliidese seadistamine ==
| |
| | |
| Apache2 seaditamine:
| |
| | |
| <pre> apt-get install apache2 </pre>
| |
| <pre> apt-get install libapache2-mod-php5 </pre>
| |
| <pre> apt-get install libphp-adodb </pre>
| |
| | |
| Muudame /etc/php5/apache2/php.ini faili:
| |
| | |
| <pre> nano /etc/php5/apache2/php.ini </pre>
| |
| | |
| ning muudame rida 462:
| |
| | |
| <pre> error_reporting = E_ALL & ~E_NOTICE </pre>
| |
| | |
| Seejärel muudame /etc/apache2/apache2.conf faili, et lisada autoriseerimine www/base jaoks:
| |
| | |
| <pre> <Directory /var/www/html/base>
| |
| AllowOverride All
| |
| Require all granted
| |
| </Directory> </pre>
| |
| | |
| Taaskäivitame apache2:
| |
| | |
| <pre> service apache2 restart </pre>
| |
| | |
| '''Installeerime BASE sõltuvused'''
| |
| | |
| <pre> apt-get install php-pear </pre>
| |
| <pre> apt-get install libwww-perl </pre>
| |
| <pre> apt-get install php5-gd </pre>
| |
| | |
| <pre> pear config-set preferred_state alpha </pre>
| |
| <pre> pear channel-update pear.php.net </pre>
| |
| <pre> pear install --alldeps Image_Color Image_Canvas Image_Graph </pre>
| |
| | |
| | |
| == Kasutatud kirjandus ==
| |
| #http://computer-outlines.over-blog.com/article-nids-snort-barnyard2-apache2-base-with-ubuntu-14-04-lts-123532107.html
| |
| | |
| == Autor ==
| |
| Veronia Lutter A31
| |
