MiracleLinux9.0 : Suricata , SNORT インストール

Contents

Suricata
SNORT

Suricata

SURICATA IDS/IPSはネットワーク上の通信を監視し、不審なトラフィックを検知するオープンソースのIDSです。基本的な仕組みはシグネチャ型であるため、あらかじめ設定した不正な通信を検知できます。また、Suricataは検知だけでなく防御も行えることが特徴です。

1.事前準備

①EPEL リポジトリをシステム上で有効化する

# dnf -y install epel-release

1	# dnf -y install epel-release

②システムのアップデート

# dnf update -y

1	# dnf update -y

2.Suricata のインストールと設定

①Suricata のインストール

#  dnf install suricata

バージョンの確認
# suricata -V
This is Suricata version 6.0.6 RELEASE

# dnf install suricata

バージョンの確認

# suricata -V

This is Suricata version 6.0.6 RELEASE

②Suricataがネットワークパケットを検査するインターフェースとIPアドレスを決定

# ip --brief add
lo               UNKNOWN        127.0.0.1/8 ::1/128
ens160           UP             192.168.11.83/24

# ip --brief add

lo UNKNOWN 127.0.0.1/8 ::1/128

ens160 UP 192.168.11.83/24

③設定ファイルを編集

#  vi /etc/suricata/suricata.yaml

# 15行目 : varsセクションで、ネットワークを定義する
HOME_NET: "[192.168.11.0/24]"
EXTRNAL_NET: "!$HOME_NET"

# 589行目 : af-packetセクションのインターフェース名を設定
af-packet:
    - interface: ens160

# vi /etc/suricata/suricata.yaml

# 15行目 : varsセクションで、ネットワークを定義する

HOME_NET: "[192.168.11.0/24]"

EXTRNAL_NET: "!$HOME_NET"

# 589行目 : af-packetセクションのインターフェース名を設定

af-packet:

- interface: ens160

# vi /etc/sysconfig/suricata

# 8行目 :インターフェイスを指定
# Add options to be passed to the daemon
OPTIONS="-i ens160 --user suricata "

# vi /etc/sysconfig/suricata

# 8行目 :インターフェイスを指定

# Add options to be passed to the daemon

OPTIONS="-i ens160 --user suricata "

④Suricataのルール更新

# suricata-update

1	# suricata-update

<Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol sip enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
上記のような警告が出るが無視できるものと思われるので、このまま進めます

⑤Suricataの起動

# systemctl enable --now suricata
Created symlink /etc/systemd/system/multiuser.target.wants/suricata.service → /usr/lib/systemd/system/suricata.service.

1 2	# systemctl enable --now suricata Created symlink /etc/systemd/system/multiuser.target.wants/suricata.service → /usr/lib/systemd/system/suricata.service.

⑥Suricataの起動確認

# systemctl status suricata
● suricata.service - Suricata Intrusion Detection Service
     Loaded: loaded (/usr/lib/systemd/system/suricata.service; enabled; vendor >
     Active: active (running) since Wed 2022-11-16 21:46:31 JST; 11s ago
       Docs: man:suricata(1)
    Process: 5389 ExecStartPre=/bin/rm -f /var/run/suricata.pid (code=exited, s>
   Main PID: 5390 (Suricata-Main)
      Tasks: 1 (limit: 10949)
     Memory: 327.8M
        CPU: 11.201s
     CGroup: /system.slice/suricata.service
             mq5390 /sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /va>

Nov 16 21:46:31 Lepard systemd[1]: Starting Suricata Intrusion Detection Servic>
Nov 16 21:46:31 Lepard systemd[1]: Started Suricata Intrusion Detection Service.
Nov 16 21:46:31 Lepard suricata[5390]: 16/11/2022 -- 21:46:31 - <Notice> - This>
Nov 16 21:46:31 Lepard suricata[5390]: 16/11/2022 -- 21:46:31 - <Warning> - [ER>
Nov 16 21:46:31 Lepard suricata[5390]: 16/11/2022 -- 21:46:31 - <Warning> - [ER>
Nov 16 21:46:31 Lepard suricata[5390]: 16/11/2022 -- 21:46:31 - <Warning> - [ER>

# systemctl status suricata

● suricata.service - Suricata Intrusion Detection Service

Loaded: loaded (/usr/lib/systemd/system/suricata.service; enabled; vendor >

Active: active (running) since Wed 2022-11-16 21:46:31 JST; 11s ago

Docs: man:suricata(1)

Process: 5389 ExecStartPre=/bin/rm -f /var/run/suricata.pid (code=exited, s>

Main PID: 5390 (Suricata-Main)

Tasks: 1 (limit: 10949)

Memory: 327.8M

CPU: 11.201s

CGroup: /system.slice/suricata.service

mq5390 /sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /va>

Nov 16 21:46:31 Lepard systemd[1]: Starting Suricata Intrusion Detection Servic>

Nov 16 21:46:31 Lepard systemd[1]: Started Suricata Intrusion Detection Service.

Nov 16 21:46:31 Lepard suricata[5390]: 16/11/2022 -- 21:46:31 - <Notice> - This>

Nov 16 21:46:31 Lepard suricata[5390]: 16/11/2022 -- 21:46:31 - <Warning> - [ER>

ログを確認

# tail /var/log/suricata/suricata.log
16/11/2022 -- 21:46:31 - <Info> - stats output device (regular) initialized: stats.log
16/11/2022 -- 21:46:31 - <Info> - Running in live mode, activating unix socket
16/11/2022 -- 21:46:42 - <Info> - 1 rule files processed. 28936 rules successfully loaded, 0 rules failed
16/11/2022 -- 21:46:42 - <Info> - Threshold config parsed: 0 rule(s) found
16/11/2022 -- 21:46:42 - <Info> - 28939 signatures processed. 1179 are IP-only rules, 5171 are inspecting packet payload, 22386 inspect application layer, 108 are decoder event only
16/11/2022 -- 21:46:50 - <Info> - Going to use 2 thread(s)
16/11/2022 -- 21:46:50 - <Info> - Running in live mode, activating unix socket
16/11/2022 -- 21:46:50 - <Info> - Using unix socket file '/var/run/suricata/suricata-command.socket'
16/11/2022 -- 21:46:50 - <Notice> - all 2 packet processing threads, 4 management threads initialized, engine started.
16/11/2022 -- 21:46:50 - <Info> - All AFP capture threads are running.

# tail /var/log/suricata/suricata.log

16/11/2022 -- 21:46:31 - <Info> - stats output device (regular) initialized: stats.log

16/11/2022 -- 21:46:31 - <Info> - Running in live mode, activating unix socket

16/11/2022 -- 21:46:42 - <Info> - 1 rule files processed. 28936 rules successfully loaded, 0 rules failed

16/11/2022 -- 21:46:42 - <Info> - Threshold config parsed: 0 rule(s) found

16/11/2022 -- 21:46:42 - <Info> - 28939 signatures processed. 1179 are IP-only rules, 5171 are inspecting packet payload, 22386 inspect application layer, 108 are decoder event only

16/11/2022 -- 21:46:50 - <Info> - Going to use 2 thread(s)

16/11/2022 -- 21:46:50 - <Info> - Running in live mode, activating unix socket

16/11/2022 -- 21:46:50 - <Info> - Using unix socket file '/var/run/suricata/suricata-command.socket'

16/11/2022 -- 21:46:50 - <Notice> - all 2 packet processing threads, 4 management threads initialized, engine started.

16/11/2022 -- 21:46:50 - <Info> - All AFP capture threads are running.

統計情報を確認するには、stats.log ファイルを確認します(デフォルトで8秒ごとに更新)

# tail -f /var/log/suricata/stats.log

1	# tail -f /var/log/suricata/stats.log

より高度な出力であるEVE JSONは、以下のコマンドで生成することができる

# tail -f /var/log/suricata/eve.json

1	# tail -f /var/log/suricata/eve.json

3.Suricata のテスト

①curl ユーティリティで ping テストを実行

# curl http://testmynids.org/uid/index.html
uid=0(root) gid=0(root) groups=0(root)

1 2	# curl http://testmynids.org/uid/index.html uid=0(root) gid=0(root) groups=0(root)

②ログに記録されたかどうかを調べるため、アラートログを確認

# cat /var/log/suricata/fast.log
11/16/2022-21:48:54.113066  [**] [1:2013028:7] ET POLICY curl User-Agent Outbound [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.11.83:33120 -> 54.230.130.56:80
11/16/2022-21:48:54.116653  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 54.230.130.56:80 -> 192.168.11.83:33120

# cat /var/log/suricata/fast.log

11/16/2022-21:48:54.113066 [**] [1:2013028:7] ET POLICY curl User-Agent Outbound [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.11.83:33120 -> 54.230.130.56:80

11/16/2022-21:48:54.116653 [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 54.230.130.56:80 -> 192.168.11.83:33120

4.Suricata Rulesの設定

①Suricataにパッケージされているルールセットの表示

# ls -al /var/lib/suricata/rules/
total 20876
drwxr-s---. 2 root     suricata     4096 Nov 16 21:45 .
drwxrws---. 4 suricata suricata     4096 Nov 16 21:45 ..
-rw-r--r--. 1 root     suricata     3228 Nov 16 21:45 classification.config
-rw-r--r--. 1 root     suricata 21364694 Nov 16 21:45 suricata.rules

# ls -al /var/lib/suricata/rules/

total 20876

drwxr-s---. 2 root suricata 4096 Nov 16 21:45 .

drwxrws---. 4 suricata suricata 4096 Nov 16 21:45 ..

-rw-r--r--. 1 root suricata 3228 Nov 16 21:45 classification.config

-rw-r--r--. 1 root suricata 21364694 Nov 16 21:45 suricata.rules

②ルールセットを提供するソースのインデックス一覧

# suricata-update list-sources

Name: et/open
  Vendor: Proofpoint
  Summary: Emerging Threats Open Ruleset
  License: MIT
Name: et/pro
  Vendor: Proofpoint
  Summary: Emerging Threats Pro Ruleset
  License: Commercial
  Replaces: et/open
  Parameters: secret-code
  Subscription: https://www.proofpoint.com/us/threat-insight/et-pro-ruleset
Name: oisf/trafficid
  Vendor: OISF
  Summary: Suricata Traffic ID ruleset
  License: MIT
Name: scwx/enhanced
  Vendor: Secureworks
  Summary: Secureworks suricata-enhanced ruleset
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)
Name: scwx/malware
  Vendor: Secureworks
  Summary: Secureworks suricata-malware ruleset
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)
Name: scwx/security
  Vendor: Secureworks
  Summary: Secureworks suricata-security ruleset
  License: Commercial
  Parameters: secret-code
  Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)
Name: sslbl/ssl-fp-blacklist
  Vendor: Abuse.ch
  Summary: Abuse.ch SSL Blacklist
  License: Non-Commercial
Name: sslbl/ja3-fingerprints
  Vendor: Abuse.ch
  Summary: Abuse.ch Suricata JA3 Fingerprint Ruleset
  License: Non-Commercial
Name: etnetera/aggressive
  Vendor: Etnetera a.s.
  Summary: Etnetera aggressive IP blacklist
  License: MIT
Name: tgreen/hunting
  Vendor: tgreen
  Summary: Threat hunting rules
  License: GPLv3
Name: malsilo/win-malware
  Vendor: malsilo
  Summary: Commodity malware rules
  License: MIT
Name: stamus/lateral
  Vendor: Stamus Networks
  Summary: Lateral movement rules
  License: GPL-3.0-only

# suricata-update list-sources

Name: et/open

Vendor: Proofpoint

Summary: Emerging Threats Open Ruleset

License: MIT

Name: et/pro

Vendor: Proofpoint

Summary: Emerging Threats Pro Ruleset

License: Commercial

Replaces: et/open

Parameters: secret-code

Subscription: https://www.proofpoint.com/us/threat-insight/et-pro-ruleset

Name: oisf/trafficid

Vendor: OISF

Summary: Suricata Traffic ID ruleset

License: MIT

Name: scwx/enhanced

Vendor: Secureworks

Summary: Secureworks suricata-enhanced ruleset

License: Commercial

Parameters: secret-code

Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)

Name: scwx/malware

Vendor: Secureworks

Summary: Secureworks suricata-malware ruleset

License: Commercial

Parameters: secret-code

Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)

Name: scwx/security

Vendor: Secureworks

Summary: Secureworks suricata-security ruleset

License: Commercial

Parameters: secret-code

Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures)

Name: sslbl/ssl-fp-blacklist

Vendor: Abuse.ch

Summary: Abuse.ch SSL Blacklist

License: Non-Commercial

Name: sslbl/ja3-fingerprints

Vendor: Abuse.ch

Summary: Abuse.ch Suricata JA3 Fingerprint Ruleset

License: Non-Commercial

Name: etnetera/aggressive

Vendor: Etnetera a.s.

Summary: Etnetera aggressive IP blacklist

License: MIT

Name: tgreen/hunting

Vendor: tgreen

Summary: Threat hunting rules

License: GPLv3

Name: malsilo/win-malware

Vendor: malsilo

Summary: Commodity malware rules

License: MIT

Name: stamus/lateral

Vendor: Stamus Networks

Summary: Lateral movement rules

License: GPL-3.0-only

③ソースを有効にする(et/openを有効にする場合)

# suricata-update enable-source et/open
16/11/2022 -- 21:52:49 - <Info> -- Using data-directory /var/lib/suricata.
16/11/2022 -- 21:52:49 - <Info> -- Using Suricata configuration /etc/suricata/suricata.yaml
16/11/2022 -- 21:52:49 - <Info> -- Using /usr/share/suricata/rules for Suricata provided rules.
16/11/2022 -- 21:52:49 - <Info> -- Found Suricata version 6.0.6 at /usr/sbin/suricata.
16/11/2022 -- 21:52:49 - <Info> -- Creating directory /var/lib/suricata/update/sources
16/11/2022 -- 21:52:49 - <Info> -- Source et/open enabled

# suricata-update enable-source et/open

16/11/2022 -- 21:52:49 - <Info> -- Using data-directory /var/lib/suricata.

16/11/2022 -- 21:52:49 - <Info> -- Using Suricata configuration /etc/suricata/suricata.yaml

16/11/2022 -- 21:52:49 - <Info> -- Using /usr/share/suricata/rules for Suricata provided rules.

16/11/2022 -- 21:52:49 - <Info> -- Found Suricata version 6.0.6 at /usr/sbin/suricata.

16/11/2022 -- 21:52:49 - <Info> -- Creating directory /var/lib/suricata/update/sources

16/11/2022 -- 21:52:49 - <Info> -- Source et/open enabled

アップデートを実行

# suricata-update

1	# suricata-update

Suricata service再起動

# systemctl restart suricata

1	# systemctl restart suricata

5.Suricata Custom Rulesの作成

①カスタマールールを含むファイルを作成

# vi /etc/suricata/rules/local.rules
下記内容を記載
alert icmp any any -> $HOME_NET any (msg:"ICMP Ping"; sid:1; rev:1;)

# vi /etc/suricata/rules/local.rules

下記内容を記載

alert icmp any any -> $HOME_NET any (msg:"ICMP Ping"; sid:1; rev:1;)

②設定ファイルを編集(新しいルールのパスを定義)

# vi /etc/suricata/suricata.yaml

# 1897行目あたりに追記
default-rule-path: /var/lib/suricata/rules

rule-files:
  - suricata.rules
  - /etc/suricata/rules/local.rules

# vi /etc/suricata/suricata.yaml

# 1897行目あたりに追記

default-rule-path: /var/lib/suricata/rules

rule-files:

- suricata.rules

- /etc/suricata/rules/local.rules

③設定ファイルのテスト

# suricata -T -c /etc/suricata/suricata.yaml -v
16/11/2022 -- 21:55:10 - <Info> - fast output device (regular) initialized: fast.log
16/11/2022 -- 21:55:10 - <Info> - eve-log output device (regular) initialized: eve.json
16/11/2022 -- 21:55:10 - <Info> - stats output device (regular) initialized: stats.log
16/11/2022 -- 21:55:21 - <Info> - 2 rule files processed. 28937 rules successfully loaded, 0 rules failed
16/11/2022 -- 21:55:21 - <Info> - Threshold config parsed: 0 rule(s) found
16/11/2022 -- 21:55:21 - <Info> - 28940 signatures processed. 1180 are IP-only rules, 5171 are inspecting packet payload, 22386 inspect application layer, 108 are decoder event only
16/11/2022 -- 21:55:29 - <Notice> - Configuration provided was successfully loaded. Exiting.
16/11/2022 -- 21:55:29 - <Info> - cleaning up signature grouping structure... complete

# suricata -T -c /etc/suricata/suricata.yaml -v

16/11/2022 -- 21:55:10 - <Info> - fast output device (regular) initialized: fast.log

16/11/2022 -- 21:55:10 - <Info> - eve-log output device (regular) initialized: eve.json

16/11/2022 -- 21:55:10 - <Info> - stats output device (regular) initialized: stats.log

16/11/2022 -- 21:55:21 - <Info> - 2 rule files processed. 28937 rules successfully loaded, 0 rules failed

16/11/2022 -- 21:55:21 - <Info> - Threshold config parsed: 0 rule(s) found

16/11/2022 -- 21:55:21 - <Info> - 28940 signatures processed. 1180 are IP-only rules, 5171 are inspecting packet payload, 22386 inspect application layer, 108 are decoder event only

16/11/2022 -- 21:55:29 - <Notice> - Configuration provided was successfully loaded. Exiting.

16/11/2022 -- 21:55:29 - <Info> - cleaning up signature grouping structure... complete

Suricat service再起動

# systemctl restart suricata

1	# systemctl restart suricata

④Custom Rulesの適用テスト
同一ローカルネットワーク上の別のデバイスでpingを実行し、ログに記録されたかどうかを確認する

# cat /var/log/suricata/fast.log

11/16/2022-21:48:54.113066  [**] [1:2013028:7] ET POLICY curl User-Agent Outbound [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.11.83:33120 -> 54.230.130.56:80
11/16/2022-21:48:54.116653  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 54.230.130.56:80 -> 192.168.11.83:33120

# cat /var/log/suricata/fast.log

11/16/2022-21:48:54.113066 [**] [1:2013028:7] ET POLICY curl User-Agent Outbound [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.11.83:33120 -> 54.230.130.56:80

11/16/2022-21:48:54.116653 [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 54.230.130.56:80 -> 192.168.11.83:33120

JSON形式のログを取得するには、システムにjqをインストールする

# dnf install jq

1	# dnf install jq

# systemctl restart suricata

1	# systemctl restart suricata

下記コマンドを実行し、同一ローカルネットワーク上の別のデバイスでpingを実行する

# tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'
pingを実行するとコンソールに下記のように表示される
{
  "timestamp": "2022-11-16T21:59:00.411240+0900",
  "flow_id": 339087107311208,
  "in_iface": "ens160",
  "event_type": "alert",
  "src_ip": "192.168.11.22",
  "src_port": 0,
  "dest_ip": "192.168.11.83",
  "dest_port": 0,
  "proto": "ICMP",
  "icmp_type": 8,
  "icmp_code": 0,
  "alert": {
    "action": "allowed",
    "gid": 1,
    "signature_id": 1,
    "rev": 1,
    "signature": "ICMP Ping",
    "category": "",
    "severity": 3
  },
  "flow": {
    "pkts_toserver": 1,
    "pkts_toclient": 0,
    "bytes_toserver": 74,
    "bytes_toclient": 0,
    "start": "2022-11-16T21:59:00.411240+0900"
  }
}
{
  "timestamp": "2022-11-16T21:59:00.411290+0900",
  "flow_id": 339087107311208,
  "in_iface": "ens160",
  "event_type": "alert",
  "src_ip": "192.168.11.83",
  "src_port": 0,
  "dest_ip": "192.168.11.22",
  "dest_port": 0,
  "proto": "ICMP",
  "icmp_type": 0,
  "icmp_code": 0,
  "alert": {
    "action": "allowed",
    "gid": 1,
    "signature_id": 1,
    "rev": 1,
    "signature": "ICMP Ping",
    "category": "",
    "severity": 3
  },
  "flow": {
    "pkts_toserver": 1,
    "pkts_toclient": 1,
    "bytes_toserver": 74,
    "bytes_toclient": 74,
    "start": "2022-11-16T21:59:00.411240+0900"
  }
}

# tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'

pingを実行するとコンソールに下記のように表示される

{

"timestamp": "2022-11-16T21:59:00.411240+0900",

"flow_id": 339087107311208,

"in_iface": "ens160",

"event_type": "alert",

"src_ip": "192.168.11.22",

"src_port": 0,

"dest_ip": "192.168.11.83",

"dest_port": 0,

"proto": "ICMP",

"icmp_type": 8,

"icmp_code": 0,

"alert": {

"action": "allowed",

"gid": 1,

"signature_id": 1,

"rev": 1,

"signature": "ICMP Ping",

"category": "",

"severity": 3

"flow": {

"pkts_toserver": 1,

"pkts_toclient": 0,

"bytes_toserver": 74,

"bytes_toclient": 0,

"start": "2022-11-16T21:59:00.411240+0900"

}

{

"timestamp": "2022-11-16T21:59:00.411290+0900",

"flow_id": 339087107311208,

"in_iface": "ens160",

"event_type": "alert",

"src_ip": "192.168.11.83",

"src_port": 0,

"dest_ip": "192.168.11.22",

"dest_port": 0,

"proto": "ICMP",

"icmp_type": 0,

"icmp_code": 0,

"alert": {

"action": "allowed",

"gid": 1,

"signature_id": 1,

"rev": 1,

"signature": "ICMP Ping",

"category": "",

"severity": 3

"flow": {

"pkts_toserver": 1,

"pkts_toclient": 1,

"bytes_toserver": 74,

"bytes_toclient": 74,

"start": "2022-11-16T21:59:00.411240+0900"

}

SNORT

Snortは、IPネットワーク上でリアルタイムのトラフィック分析とパケットロギングを実行できるオープンソースのネットワーク侵入検知システムです。

「プロトコル分析」「コンテンツ検索」「マッチング」を実行でき、「バッファオーバーフロー」「ステルスポートスキャン」「CGI攻撃」「SMBプローブ」「OSフィンガープリント試行」「セマンティックURL攻撃」「サーバメッセージブロック探査」など、さまざまな攻撃検出に使用できます。

1.事前準備

①必要なソフトウェアをインストールする

# dnf -y install bison flex libpcap-devel pcre-devel openssl-devel libdnet-devel libtirpc-devel libtool nghttp2 libnghttp2-devel
# mkdir /var/src

1 2	# dnf -y install bison flex libpcap-devel pcre-devel openssl-devel libdnet-devel libtirpc-devel libtool nghttp2 libnghttp2-devel # mkdir /var/src

②DAQ のンストール

# cd /var/src
# wget https://snort.org/downloads/snort/daq-2.0.7.tar.gz
# tar zxvf daq-2.0.7.tar.gz
# cd daq-2.0.7
# autoreconf -f -i
# ./configure
# make
# make install

# cd /var/src

# wget https://snort.org/downloads/snort/daq-2.0.7.tar.gz

# tar zxvf daq-2.0.7.tar.gz

# cd daq-2.0.7

# autoreconf -f -i

# ./configure

# make

# make install

③Lua のインストール

# cd /var/src
# wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz
# tar -zxvf LuaJIT-2.0.5.tar.gz
# cd LuaJIT-2.0.5
# make
# make install

# cd /var/src

# wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz

# tar -zxvf LuaJIT-2.0.5.tar.gz

# cd LuaJIT-2.0.5

# make

# make install

④偽のリリースファイルを作成

# /bin/cat << EOT >/etc/fedora-release
Fedora release 28 (Rawhide)
EOT

# /bin/cat << EOT >/etc/fedora-release

Fedora release 28 (Rawhide)

EOT

2. Snort をダウンロード、コンパイル、インストール

# cd /var/src
# wget https://snort.org/downloads/archive/snort/snort-2.9.18.1.tar.gz
# tar -zxvf snort-2.9.18.1.tar.gz
# cd snort-2.9.18.1
# ./configure --enable-sourcefire
# make
# make install
# ldconfig
# ln -s /usr/local/bin/snort /usr/sbin/snort

# cd /var/src

# wget https://snort.org/downloads/archive/snort/snort-2.9.18.1.tar.gz

# tar -zxvf snort-2.9.18.1.tar.gz

# cd snort-2.9.18.1

# ./configure --enable-sourcefire

# make

# make install

# ldconfig

# ln -s /usr/local/bin/snort /usr/sbin/snort

偽のリリースファイルを削除

# rm /etc/fedora-release

1	# rm /etc/fedora-release

3.グルーブとユーザー作成、必要なディレクトリー、ファイル作成

# groupadd snort
# useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort

1 2	# groupadd snort # useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort

# mkdir /etc/snort
# mkdir -p /etc/snort/rules
# mkdir /var/log/snort
# mkdir /usr/local/lib/snort_dynamicrules
# mkdir /etc/snort/preproc_rules

# chmod -R 5775 /etc/snort
# chmod -R 5775 /var/log/snort
# chmod -R 5775 /usr/local/lib/snort_dynamicrules
# chown -R snort:snort /etc/snort
# chown -R snort:snort /var/log/snort
# chown -R snort:snort /usr/local/lib/snort_dynamicrules

下記ファイル作成
# touch /etc/snort/rules/white_list.rules
# touch /etc/snort/rules/black_list.rules
# touch /etc/snort/rules/local.rules

# mkdir /etc/snort

# mkdir -p /etc/snort/rules

# mkdir /var/log/snort

# mkdir /usr/local/lib/snort_dynamicrules

# mkdir /etc/snort/preproc_rules

# chmod -R 5775 /etc/snort

# chmod -R 5775 /var/log/snort

# chmod -R 5775 /usr/local/lib/snort_dynamicrules

# chown -R snort:snort /etc/snort

# chown -R snort:snort /var/log/snort

# chown -R snort:snort /usr/local/lib/snort_dynamicrules

下記ファイル作成

# touch /etc/snort/rules/white_list.rules

# touch /etc/snort/rules/black_list.rules

# touch /etc/snort/rules/local.rules

設定ファイルのセットアップ・・・すべてのファイルを構成ディレクトリにコピーします。

# cp /var/src/snort-2.9.18.1/etc/*.conf* /etc/snort
# cp /var/src/snort-2.9.18.1/etc/*.map* /etc/snort

1 2	# cp /var/src/snort-2.9.18.1/etc/.conf /etc/snort # cp /var/src/snort-2.9.18.1/etc/.map /etc/snort

4.コミュニティルールの使用

①コミュニティルールを取得

# wget https://www.snort.org/rules/community -O ~/community.tar.gz

1	# wget https://www.snort.org/rules/community -O ~/community.tar.gz

②ルールを抽出し、構成フォルダーにコピー

# tar -xvf ~/community.tar.gz -C ~/
# cp ~/community-rules/* /etc/snort/rules

1 2	# tar -xvf ~/community.tar.gz -C ~/ # cp ~/community-rules/* /etc/snort/rules

コミュニティルールに含まれていないさまざまなルールファイルがある。
sedコマンドを使用して、不要な行をコメントアウトする。

# sed -i 's/include \$RULE\_PATH/#include \$RULE\_PATH/' /etc/snort/snort.conf

1	# sed -i 's/include \$RULE\_PATH/#include \$RULE\_PATH/' /etc/snort/snort.conf

5. 登録済みユーザールールの取得

Snortのウェブサイトに登録すると、Oink コードを使用して登録済みユーザールールをダウンロードできます。Oink コードは Snort ユーザーアカウントの詳細にあります。
次のコマンドのoinkcode を個人コードに置き換えます。

# wget https://www.snort.org/rules/snortrules-snapshot-29181.tar.gz?oinkcode=<oink-code> -O ~/registered.tar.gz

1	# wget https://www.snort.org/rules/snortrules-snapshot-29181.tar.gz?oinkcode=<oink-code> -O ~/registered.tar.gz

ダウンロードが完了したら、構成ディレクトリにルールを抽出

# tar -xvf ~/registered.tar.gz -C /etc/snort

1	# tar -xvf ~/registered.tar.gz -C /etc/snort

6. ネットワークおよびルールの構成

# vi /etc/snort/snort.conf
●45行目
# Setup the network addresses you are protecting
ipvar HOME_NET 192.168.11.0/24　←各自の環境に合わす
●48行目
# Set up the external network addresses. Leave as "any" in most situations
ipvar EXTERNAL_NET !$HOME_NET
●104-106行目　コメントアウトして下に追加
# Path to your rules files (this can be a relative path)
# var RULE_PATH ../rules
# var SO_RULE_PATH ../so_rules
# var PREPROC_RULE_PATH ../preproc_rules
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
●116行目あたりコメントアウトして下に追加
# Set the absolute path appropriately
#var WHITE_LIST_PATH ../rules
#var BLACK_LIST_PATH ../rules
var WHITE_LIST_PATH /etc/snort/rules
var BLACK_LIST_PATH /etc/snort/rules
●526行目あたり追加
# unified2
# Recommended for most installs
output unified2: filename snort.log, limit 128
●550行目 カスタム ルールを読み込むようにするには、local.rules のコメントを解除する必要があります
include $RULE_PATH/local.rules
●コミュニティ ルールを使用している場合はlocal.rules 行のすぐ下などに次の行も追加
include $RULE_PATH/community.rules

# vi /etc/snort/snort.conf

●45行目

# Setup the network addresses you are protecting

ipvar HOME_NET 192.168.11.0/24　←各自の環境に合わす

●48行目

# Set up the external network addresses. Leave as "any" in most situations

ipvar EXTERNAL_NET !$HOME_NET

●104-106行目　コメントアウトして下に追加

# Path to your rules files (this can be a relative path)

# var RULE_PATH ../rules

# var SO_RULE_PATH ../so_rules

# var PREPROC_RULE_PATH ../preproc_rules

var RULE_PATH /etc/snort/rules

var SO_RULE_PATH /etc/snort/so_rules

var PREPROC_RULE_PATH /etc/snort/preproc_rules

●116行目あたりコメントアウトして下に追加

# Set the absolute path appropriately

#var WHITE_LIST_PATH ../rules

#var BLACK_LIST_PATH ../rules

var WHITE_LIST_PATH /etc/snort/rules

var BLACK_LIST_PATH /etc/snort/rules

●526行目あたり追加

# unified2

# Recommended for most installs

output unified2: filename snort.log, limit 128

●550行目カスタムルールを読み込むようにするには、local.rules のコメントを解除する必要があります

include $RULE_PATH/local.rules

●コミュニティルールを使用している場合はlocal.rules 行のすぐ下などに次の行も追加

include $RULE_PATH/community.rules

7. 設定の検証

パラメーター -T を使用して構成をテストし、テスト・モードを使用可能にします

# snort -T -c /etc/snort/rules/snort.conf

MaxRss at the end of detection rules:809420

--== Initialization Complete ==--

,,_       -*> Snort! <*-
o" )~    Version 2.9.18.1 GRE (Build 1005)
''''       By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
Copyright (C) 2014-2021 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using libpcap version 1.9.1 (with TPACKET_V3)
Using PCRE version: 8.45 2021-06-15
Using ZLIB version: 1.2.11

Rules Engine: SF_SNORT_DETECTION_ENGINE Version 3.2 <Build 1>
Preprocessor Object: SF_DNS Version 1.1 <Build 4>
Preprocessor Object: appid Version 1.1 <Build 5>
Preprocessor Object: SF_S7COMMPLUS Version 1.0 <Build 1>
Preprocessor Object: SF_FTPTELNET Version 1.2 <Build 13>
Preprocessor Object: SF_POP Version 1.0 <Build 1>
Preprocessor Object: SF_SSLPP Version 1.1 <Build 4>

Total snort Fixed Memory Cost - MaxRss:809420
Snort successfully validated the configuration!
Snort exiting

# snort -T -c /etc/snort/rules/snort.conf

MaxRss at the end of detection rules:809420

--== Initialization Complete ==--

,,_ -*> Snort! <*-

o" )~ Version 2.9.18.1 GRE (Build 1005)

'''' By Martin Roesch & The Snort Team: http://www.snort.org/contact#team

Using libpcap version 1.9.1 (with TPACKET_V3)

Using PCRE version: 8.45 2021-06-15

Using ZLIB version: 1.2.11

Rules Engine: SF_SNORT_DETECTION_ENGINE Version 3.2 <Build 1>

Preprocessor Object: SF_DNS Version 1.1 <Build 4>

Preprocessor Object: appid Version 1.1 <Build 5>

Preprocessor Object: SF_S7COMMPLUS Version 1.0 <Build 1>

Preprocessor Object: SF_FTPTELNET Version 1.2 <Build 13>

Preprocessor Object: SF_POP Version 1.0 <Build 1>

Preprocessor Object: SF_SSLPP Version 1.1 <Build 4>

Total snort Fixed Memory Cost - MaxRss:809420

Snort successfully validated the configuration!

Snort exiting

エラーが出た場合該当のファイルを　/etc/snort/rulesにコピーする
当方の場合、下記のファイルでエラーが出た

# cp /var/src/snort-2.9.18.1/etc/classification.config /etc/snort/rules
# cp /var/src/snort-2.9.18.1/etc/reference.config /etc/snort/rules
# cp /var/src/snort-2.9.18.1/etc/threshold.conf /etc/snort/rules
# cp /var/src/snort-2.9.18.1/etc/unicode.map /etc/snort/rules/

# cp /var/src/snort-2.9.18.1/etc/classification.config /etc/snort/rules

# cp /var/src/snort-2.9.18.1/etc/reference.config /etc/snort/rules

# cp /var/src/snort-2.9.18.1/etc/threshold.conf /etc/snort/rules

# cp /var/src/snort-2.9.18.1/etc/unicode.map /etc/snort/rules/

unicode.mapエラーが出る場合は

# cp /usr/local/src/snort-2.9.18.1/etc/unicode.map /etc/snort/rules

1	# cp /usr/local/src/snort-2.9.18.1/etc/unicode.map /etc/snort/rules

8. 構成のテスト

①Snort がアラートをログに記録しているかどうかをテストするには、着信 ICMP 接続に関するカスタム検出ルールアラートを local.rules ファイルに追加します。

# vi /etc/snort/rules/local.rules
●次の行を最終行に追加します
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:001;)

# vi /etc/snort/rules/local.rules

●次の行を最終行に追加します

alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:001;)

②コンソールで Snort を起動し、アラートを stdout に出力します。正しいネットワークインターフェイス(ens160 など)を選択する必要があります

# snort -A console -i ens160 -u snort -g snort -c /etc/snort/snort.conf

Snortを起動して実行した状態で、他のコンピューターから ping を実行します。Snort を実行しているターミナルに ICMP 呼び出しごとに次のような通知が表示されます
Commencing packet processing (pid=59595)
11/16-17:10:01.755142  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83
11/16-17:10:01.755185  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22
11/16-17:10:02.762365  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83
11/16-17:10:02.762397  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22
11/16-17:10:03.772385  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83
11/16-17:10:03.772419  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22
11/16-17:10:04.777683  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83
11/16-17:10:04.777716  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22

# snort -A console -i ens160 -u snort -g snort -c /etc/snort/snort.conf

Snortを起動して実行した状態で、他のコンピューターから ping を実行します。Snort を実行しているターミナルに ICMP 呼び出しごとに次のような通知が表示されます

Commencing packet processing (pid=59595)

11/16-17:10:01.755142 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83

11/16-17:10:01.755185 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22

11/16-17:10:02.762365 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83

11/16-17:10:02.762397 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22

11/16-17:10:03.772385 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83

11/16-17:10:03.772419 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22

11/16-17:10:04.777683 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.22 -> 192.168.11.83

11/16-17:10:04.777716 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 192.168.11.83 -> 192.168.11.22

Snort は、/var/log/snort/snort.log.<timestamp> の下のログにアラートを記録します。ログは、下のコマンドで読み取ることができます。

# snort -r /var/log/snort/snort.log.<id_number>

1	# snort -r /var/log/snort/snort.log.<id_number>

ログには、送信元と宛先の IP、時刻と日付、および次の例に示すように、いくつかの追加情報を含む各 ICMP 呼び出しに対する警告が表示されます。

Running in packet dump mode

--== Initializing Snort ==--
Initializing Output Plugins!
pcap DAQ configured to read-file.
Acquiring network traffic from "/var/log/snort/snort.log.1668586181".

--== Initialization Complete ==--

,,_ -*> Snort! <*-
o" )~ Version 2.9.18.1 GRE (Build 1005)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
Copyright (C) 2014-2021 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using libpcap version 1.10.0 (with TPACKET_V3)
Using PCRE version: 8.44 2020-02-12
Using ZLIB version: 1.2.11

Commencing packet processing (pid=59610)
WARNING: No preprocessors configured for policy 0.
11/16-17:10:01.755142 192.168.11.22 -> 192.168.11.83
ICMP TTL:128 TOS:0x0 ID:5798 IpLen:20 DgmLen:60
Type:8 Code:0 ID:1 Seq:14 ECHO
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
11/16-17:10:01.755185 192.168.11.83 -> 192.168.11.22
ICMP TTL:64 TOS:0x0 ID:31315 IpLen:20 DgmLen:60
Type:0 Code:0 ID:1 Seq:14 ECHO REPLY
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
11/16-17:10:02.762365 192.168.11.22 -> 192.168.11.83
ICMP TTL:128 TOS:0x0 ID:5800 IpLen:20 DgmLen:60
Type:8 Code:0 ID:1 Seq:15 ECHO
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
11/16-17:10:02.762397 192.168.11.83 -> 192.168.11.22
ICMP TTL:64 TOS:0x0 ID:31462 IpLen:20 DgmLen:60
Type:0 Code:0 ID:1 Seq:15 ECHO REPLY
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
11/16-17:10:03.772385 192.168.11.22 -> 192.168.11.83
ICMP TTL:128 TOS:0x0 ID:5802 IpLen:20 DgmLen:60
Type:8 Code:0 ID:1 Seq:16 ECHO
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
11/16-17:10:03.772419 192.168.11.83 -> 192.168.11.22
ICMP TTL:64 TOS:0x0 ID:31976 IpLen:20 DgmLen:60
Type:0 Code:0 ID:1 Seq:16 ECHO REPLY
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
11/16-17:10:04.777683 192.168.11.22 -> 192.168.11.83
ICMP TTL:128 TOS:0x0 ID:5804 IpLen:20 DgmLen:60
Type:8 Code:0 ID:1 Seq:17 ECHO
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
11/16-17:10:04.777716 192.168.11.83 -> 192.168.11.22
ICMP TTL:64 TOS:0x0 ID:32532 IpLen:20 DgmLen:60
Type:0 Code:0 ID:1 Seq:17 ECHO REPLY
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

==============================================================
---中略---
==============================================================

Memory Statistics for File at:Wed Nov 16 17:11:16 2022

Total buffers allocated: 0
Total buffers freed: 0
Total buffers released: 0
Total file mempool: 0
Total allocated file mempool: 0
Total freed file mempool: 0
Total released file mempool: 0

Heap Statistics of file:
Total Statistics:
Memory in use: 0 bytes
No of allocs: 0
No of frees: 0
==============================================================
Snort exiting

Running in packet dump mode

--== Initializing Snort ==--

Initializing Output Plugins!

pcap DAQ configured to read-file.

Acquiring network traffic from "/var/log/snort/snort.log.1668586181".

--== Initialization Complete ==--

,,_ -*> Snort! <*-

o" )~ Version 2.9.18.1 GRE (Build 1005)

'''' By Martin Roesch & The Snort Team: http://www.snort.org/contact#team

Using libpcap version 1.10.0 (with TPACKET_V3)

Using PCRE version: 8.44 2020-02-12

Using ZLIB version: 1.2.11

Commencing packet processing (pid=59610)