Contents
Suricata
SURICATA IDS/IPSはネットワーク上の通信を監視し、不審なトラフィックを検知するオープンソースのIDSです。基本的な仕組みはシグネチャ型であるため、あらかじめ設定した不正な通信を検知できます。また、Suricataは検知だけでなく防御も行えることが特徴です。
1.Suricata のインストールと設定
①Suricata のインストール
|
1 2 3 4 5 6 7 8 9 |
# dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm # dnf install yum-plugin-copr # dnf copr enable @oisf/suricata-7.0 # dnf install suricata -y バージョンチェック # suricata -V This is Suricata version 7.0.10 RELEASE |
②Suricataがネットワークパケットを検査するインターフェースとIPアドレスを決定
|
1 2 3 |
# ip --brief add lo UNKNOWN 127.0.0.1/8 ::1/128 enp3s0f0 UP 192.168.11.83/24 fe80::6a5b:35ff:feb5:ed04/64 |
③設定ファイルを編集
|
1 2 3 4 5 6 7 8 9 |
# vi /etc/suricata/suricata.yaml # 15行目 : varsセクションで、ネットワークを定義する HOME_NET: "[192.168.11.0/24]" EXTRNAL_NET: "!$HOME_NET" # 622行目 : af-packetセクションのインターフェース名を設定 af-packet: - interface: enp3s0f0 |
|
1 2 3 4 5 |
# vi /etc/sysconfig/suricata # 8行目 :インターフェイスを指定 # Add options to be passed to the daemon OPTIONS="-i enp3s0f0 --user suricata " |
④Suricataのルール更新
|
1 |
# suricata-update |
⑤Suricataの起動
|
1 2 |
# systemctl enable --now suricata Created symlink /etc/systemd/system/multiuser.target.wants/suricata.service → /usr/lib/systemd/system/suricata.service. |
⑥Suricataの起動確認
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# systemctl status suricata ● suricata.service - Suricata Intrusion Detection Service Loaded: loaded (/usr/lib/systemd/system/suricata.service; enabled; preset: disabled) Active: active (running) since Wed 2025-06-25 13:19:02 JST; 40s ago Invocation: 83a77e093966496a84d0354c9cf3c935 Docs: man:suricata(1) Process: 18470 ExecStartPre=/bin/rm -f /var/run/suricata.pid (code=exited, status=0/SUCCESS) Main PID: 18474 (Suricata-Main) Tasks: 10 (limit: 46859) Memory: 926.4M (peak: 968.4M) CPU: 4.623s CGroup: /system.slice/suricata.service mq18474 /sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid -i enp3s0f0 --user suricata Jun 25 13:19:02 Lepard systemd[1]: Starting suricata.service - Suricata Intrusion Detection Service... Jun 25 13:19:02 Lepard systemd[1]: Started suricata.service - Suricata Intrusion Detection Service. Jun 25 13:19:02 Lepard suricata[18474]: i: suricata: This is Suricata version 7.0.10 RELEASE running in SYSTEM mode Jun 25 13:19:06 Lepard suricata[18474]: W: af-packet: enp3s0f0: AF_PACKET tpacket-v3 is recommended for non-inline operation Jun 25 13:19:07 Lepard suricata[18474]: i: threads: Threads created -> W: 4 FM: 1 FR: 1 Engine started. |
ログを確認
|
1 2 3 4 5 6 7 8 9 10 11 |
# tail /var/log/suricata/suricata.log [18474 - Suricata-Main] 2025-06-25 13:19:02 Info: logopenfile: fast output device (regular) initialized: fast.log [18474 - Suricata-Main] 2025-06-25 13:19:02 Info: logopenfile: eve-log output device (regular) initialized: eve.json [18474 - Suricata-Main] 2025-06-25 13:19:02 Info: logopenfile: stats output device (regular) initialized: stats.log [18474 - Suricata-Main] 2025-06-25 13:19:03 Info: detect: 1 rule files processed. 44260 rules successfully loaded, 0 rules failed, 0 [18474 - Suricata-Main] 2025-06-25 13:19:03 Info: threshold-config: Threshold config parsed: 0 rule(s) found [18474 - Suricata-Main] 2025-06-25 13:19:03 Info: detect: 44263 signatures processed. 1232 are IP-only rules, 4363 are inspecting packet payload, 38446 inspect application layer, 109 are decoder event only [18474 - Suricata-Main] 2025-06-25 13:19:06 Warning: af-packet: enp3s0f0: AF_PACKET tpacket-v3 is recommended for non-inline operation [18474 - Suricata-Main] 2025-06-25 13:19:06 Info: runmodes: enp3s0f0: creating 4 threads [18474 - Suricata-Main] 2025-06-25 13:19:06 Info: unix-manager: unix socket '/var/run/suricata/suricata-command.socket' [18474 - Suricata-Main] 2025-06-25 13:19:07 Notice: threads: Threads created -> W: 4 FM: 1 FR: 1 Engine started. |
統計情報を確認するには、stats.log ファイルを確認します(デフォルトで8秒ごとに更新)
|
1 |
# tail -f /var/log/suricata/stats.log |
より高度な出力であるEVE JSONは、以下のコマンドで生成することができる
|
1 |
# tail -f /var/log/suricata/eve.json |
3.Suricata のテスト
①curl ユーティリティで ping テストを実行
|
1 2 |
# curl http://testmynids.org/uid/index.html uid=0(root) gid=0(root) groups=0(root) |
②ログに記録されたかどうかを調べるため、アラートログを確認
|
1 2 |
# cat /var/log/suricata/fast.log 06/25/2025-13:21:48.612239 [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 54.239.168.3:80 -> 192.168.11.83:35498 |
4.Suricata Rulesの設定
①Suricataにパッケージされているルールセットの表示
|
1 2 3 4 5 6 |
# ls -al /var/lib/suricata/rules/ total 37024 drwxr-s--- 2 root suricata 57 Jun 25 13:18 . drwxrws--- 4 suricata suricata 33 Jun 25 13:18 .. -rw-r--r-- 1 root suricata 3228 Jun 25 13:18 classification.config -rw-r--r-- 1 root suricata 37904857 Jun 25 13:18 suricata.rules |
②ルールセットを提供するソースのインデックス一覧
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 |
# suricata-update list-sources Name: abuse.ch/feodotracker Vendor: Abuse.ch Summary: Abuse.ch Feodo Tracker Botnet C2 IP ruleset License: CC0-1.0 Name: abuse.ch/sslbl-blacklist Vendor: Abuse.ch Summary: Abuse.ch SSL Blacklist License: CC0-1.0 Replaces: sslbl/ssl-fp-blacklist Name: abuse.ch/sslbl-c2 Vendor: Abuse.ch Summary: Abuse.ch Suricata Botnet C2 IP Ruleset License: CC0-1.0 Name: abuse.ch/sslbl-ja3 Vendor: Abuse.ch Summary: Abuse.ch Suricata JA3 Fingerprint Ruleset License: CC0-1.0 Replaces: sslbl/ja3-fingerprints Name: abuse.ch/urlhaus Vendor: abuse.ch Summary: Abuse.ch URLhaus Suricata Rules License: CC0-1.0 Name: aleksibovellan/nmap Vendor: aleksibovellan Summary: Suricata IDS/IPS Detection Rules Against NMAP Scans License: MIT Name: et/open Vendor: Proofpoint Summary: Emerging Threats Open Ruleset License: MIT Name: et/pro Vendor: Proofpoint Summary: Emerging Threats Pro Ruleset License: Commercial Replaces: et/open Parameters: secret-code Subscription: https://www.proofpoint.com/us/threat-insight/et-pro-ruleset Name: etnetera/aggressive Vendor: Etnetera a.s. Summary: Etnetera aggressive IP blacklist License: MIT Name: oisf/trafficid Vendor: OISF Summary: Suricata Traffic ID ruleset License: MIT Name: pawpatrules Vendor: pawpatrules Summary: PAW Patrules is a collection of rules for IDPS / NSM Suricata engine License: CC-BY-SA-4.0 Name: ptrules/open Vendor: Positive Technologies Summary: Positive Technologies Open Ruleset License: Custom Name: scwx/enhanced Vendor: Secureworks Summary: Secureworks suricata-enhanced ruleset License: Commercial Parameters: secret-code Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures) Name: scwx/malware Vendor: Secureworks Summary: Secureworks suricata-malware ruleset License: Commercial Parameters: secret-code Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures) Name: scwx/security Vendor: Secureworks Summary: Secureworks suricata-security ruleset License: Commercial Parameters: secret-code Subscription: https://www.secureworks.com/contact/ (Please reference CTU Countermeasures) Name: stamus/lateral Vendor: Stamus Networks Summary: Lateral movement rules License: GPL-3.0-only Name: stamus/nrd-14-open Vendor: Stamus Networks Summary: Newly Registered Domains Open only - 14 day list, complete License: Commercial Parameters: secret-code Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed Name: stamus/nrd-30-open Vendor: Stamus Networks Summary: Newly Registered Domains Open only - 30 day list, complete License: Commercial Parameters: secret-code Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed Name: stamus/nrd-entropy-14-open Vendor: Stamus Networks Summary: Newly Registered Domains Open only - 14 day list, high entropy License: Commercial Parameters: secret-code Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed Name: stamus/nrd-entropy-30-open Vendor: Stamus Networks Summary: Newly Registered Domains Open only - 30 day list, high entropy License: Commercial Parameters: secret-code Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed Name: stamus/nrd-phishing-14-open Vendor: Stamus Networks Summary: Newly Registered Domains Open only - 14 day list, phishing License: Commercial Parameters: secret-code Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed Name: stamus/nrd-phishing-30-open Vendor: Stamus Networks Summary: Newly Registered Domains Open only - 30 day list, phishing License: Commercial Parameters: secret-code Subscription: https://www.stamus-networks.com/stamus-labs/subscribe-to-threat-intel-feed Name: tgreen/hunting Vendor: tgreen Summary: Threat hunting rules License: GPLv3 |
③ソースを有効にする(et/openを有効にする場合)
|
1 2 3 4 5 6 7 8 9 |
# suricata-update enable-source et/open 25/6/2025 -- 13:23:57 - <Info> -- Using data-directory /var/lib/suricata. 25/6/2025 -- 13:23:57 - <Info> -- Using Suricata configuration /etc/suricata/suricata.yaml 25/6/2025 -- 13:23:57 - <Info> -- Using /usr/share/suricata/rules for Suricata provided rules. 25/6/2025 -- 13:23:57 - <Info> -- Found Suricata version 7.0.10 at /usr/sbin/suricata. 25/6/2025 -- 13:23:57 - <Warning> -- Source index does not exist, will use bundled one. 25/6/2025 -- 13:23:57 - <Warning> -- Please run suricata-update update-sources. 25/6/2025 -- 13:23:57 - <Info> -- Creating directory /var/lib/suricata/update/sources 25/6/2025 -- 13:23:57 - <Info> -- Source et/open enabled |
アップデートを実行
|
1 |
# suricata-update |
Suricata service再起動
|
1 |
# systemctl restart suricata |
5.Suricata Custom Rulesの作成
①カスタマールールを含むファイルを作成
|
1 2 3 4 5 |
# mkdir /etc/suricata/rules/ # vi /etc/suricata/rules/local.rules 下記内容を記載 alert icmp any any -> $HOME_NET any (msg:"ICMP Ping"; sid:1; rev:1;) |
②設定ファイルを編集(新しいルールのパスを定義)
|
1 2 3 4 5 6 7 8 |
# vi /etc/suricata/suricata.yaml # 2192行目あたりに追記 default-rule-path: /var/lib/suricata/rules rule-files: - suricata.rules - /etc/suricata/rules/local.rules |
③設定ファイルのテスト
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# suricata -T -c /etc/suricata/suricata.yaml -v Notice: suricata: This is Suricata version 7.0.10 RELEASE running in SYSTEM mode Info: cpu: CPUs/cores online: 4 Info: suricata: Running suricata under test mode Info: suricata: Setting engine mode to IDS mode by default Info: exception-policy: master exception-policy set to: auto Info: logopenfile: fast output device (regular) initialized: fast.log Info: logopenfile: eve-log output device (regular) initialized: eve.json Info: logopenfile: stats output device (regular) initialized: stats.log Info: detect: 2 rule files processed. 44261 rules successfully loaded, 0 rules failed, 0 Info: threshold-config: Threshold config parsed: 0 rule(s) found Info: detect: 44264 signatures processed. 1233 are IP-only rules, 4363 are inspecting packet payload, 38446 inspect application layer, 109 are decoder event only Notice: suricata: Configuration provided was successfully loaded. Exiting. |
Suricat service再起動
|
1 |
# systemctl restart suricata |
④Custom Rulesの適用テスト
同一ローカルネットワーク上の別のデバイスでpingを実行し、ログに記録されたかどうかを確認する
|
1 2 3 4 |
# cat /var/log/suricata/fast.log 06/25/2025-13:32:18.562218 [**] [1:1:1] ICMP Ping [**] [Classification: (null)] [Priority: 3] {ICMP} 192.168.11.8:8 -> 192.168.11.83:0 06/25/2025-13:32:18.562276 [**] [1:1:1] ICMP Ping [**] [Classification: (null)] [Priority: 3] {ICMP} 192.168.11.83:0 -> 192.168.11.8:0 |
JSON形式のログを取得するには、システムにjqをインストールする
|
1 |
# dnf install jq |
|
1 |
# systemctl restart suricata |
下記コマンドを実行し、同一ローカルネットワーク上の別のデバイスでpingを実行する
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
# tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")' pingを実行するとコンソールに下記のように表示される { "timestamp": "2025-06-25T13:33:57.291607+0900", "flow_id": 1533727191912656, "in_iface": "enp3s0f0", "event_type": "alert", "src_ip": "192.168.11.83", "dest_ip": "192.168.11.8", "proto": "ICMP", "icmp_type": 0, "icmp_code": 0, "pkt_src": "wire/pcap", "alert": { "action": "allowed", "gid": 1, "signature_id": 1, "rev": 1, "signature": "ICMP Ping", "category": "", "severity": 3 }, "direction": "to_client", "flow": { "pkts_toserver": 1, "pkts_toclient": 1, "bytes_toserver": 74, "bytes_toclient": 74, "start": "2025-06-25T13:33:57.291562+0900", "src_ip": "192.168.11.8", "dest_ip": "192.168.11.83" } } |
6. Elastic Stackでログの可視化とモニタリング
Filebeat
ログデータを転送し、一元管理するための軽量なシッパーです
Elasticsearch
あらゆる種類のデータを対象とした検索・分析エンジン
Kibana
Elasticsearch にインデックスされたデータの検索とデータ可視化機能を提供します
上記を利用してログの可視化とモニタリングする場合は下記ページを参照してください
SNORT3
Snortは、IPネットワーク上でリアルタイムのトラフィック分析とパケットロギングを実行できるオープンソースのネットワーク侵入検知システムです。
「プロトコル分析」「コンテンツ検索」「マッチング」を実行でき、「バッファオーバーフロー」「ステルスポートスキャン」「CGI攻撃」「SMBプローブ」「OSフィンガープリント試行」「セマンティックURL攻撃」「サーバメッセージブロック探査」など、さまざまな攻撃検出に使用できます。
1.事前準備
1.1 必須パッケージのインストール
1.openssl-develのインストール
|
1 |
# dnf install openssl-devel |
2.cmakeのインストール
|
1 2 3 4 5 6 7 |
# dnf install cmake バージョン確認 # cmake --version cmake version 3.30.5 CMake suite maintained and supported by Kitware (kitware.com/cmake). |
1.2 必要なパッケージのインストール
|
1 2 3 |
# dnf install libpcap-devel pcre2-devel hwloc-devel openssl-devel zlib-devel luajit-devel pkgconf libmnl-devel libunwind-devel # dnf install libnfnetlink-devel libnetfilter_queue g++ |
|
1 2 3 4 5 6 7 |
# wget https://dl.fedoraproject.org/pub/epel/10/Everything/x86_64/Packages/l/libdnet-1.18.0-1.el10_1.x86_64.rpm # rpm -Uvh libdnet-1.18.0-1.el10_1.x86_64.rpm # dnf install libdnet # wget https://dl.fedoraproject.org/pub/epel/10/Everything/x86_64/Packages/l/libdnet-devel-1.18.0-1.el10_1.x86_64.rpm # rpm -Uvh libdnet-devel-1.18.0-1.el10_1.x86_64.rpm # dnf install libdnet-devel |
1.3 LibDAQのインストール
|
1 2 3 4 5 6 7 8 9 10 11 |
# cd # dnf install git # git clone https://github.com/snort3/libdaq.git Cloning into 'libdaq'... remote: Enumerating objects: 2584, done. remote: Counting objects: 100% (177/177), done. remote: Compressing objects: 100% (72/72), done. remote: Total 2584 (delta 126), reused 117 (delta 105), pack-reused 2407 (from 2) Receiving objects: 100% (2584/2584), 1.28 MiB | 14.41 MiB/s, done. Resolving deltas: 100% (1834/1834), done. |
|
1 2 3 |
# cd libdaq/ # dnf install autoconf # ./bootstrap |
|
1 2 |
# ./configure # make && make install |
|
1 2 3 4 5 6 |
# ln -s /usr/local/lib/libdaq.so.3 /lib/ 共有ライブラリの追加 # ldconfig ライブラリの確認 # ldconfig -p|grep daq libdaq.so.3 (libc6,x86-64) => /lib/libdaq.so.3 |
1.4 オプションパッケージのインストール
1.LZMAとUUIDのインストール
|
1 |
# dnf install xz-devel libuuid-devel |
2.Tcmallocのインストール
|
1 |
# dnf install gperftools-devel |
2. Snort3のインストール
|
1 2 3 4 5 6 |
# git clone https://github.com/snort3/snort3.git # cd snort3/ # export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH # export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig:$PKG_CONFIG_PATH # export CFLAGS="-O3" # export CXXFLAGS="-O3 -fno-rtti" |
configureの実行
|
1 2 3 4 5 6 7 8 |
# dnf install flex # ./configure_cmake.sh --prefix=/usr/local/snort --enable-tcmalloc ------------------------------------------------------- -- Configuring done -- Generating done -- Build files have been written to: /root/snort3/build |
ビルド、コンパイル、インストール
|
1 2 3 4 5 6 |
# cd build/ # pwd /root/snort3/build # make -j$(nproc) # make -j$(nproc) install |
バージョン確認
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
# /usr/local/snort/bin/snort -V ,,_ -*> Snort++ <*- o" )~ Version 3.8.1.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2025 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.19 Using libpcap version 1.10.4 (with TPACKET_V3) Using LuaJIT version 2.1.1720049189 Using LZMA version 5.6.2 Using OpenSSL 3.2.2 4 Jun 2024 Using PCRE2 version 10.44 2024-06-07 Using ZLIB version 1.3.1.zlib-ng |
テスト実行
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -------------------------------------------------- search engine (ac_bnfa) instances: 2 patterns: 438 pattern chars: 2602 num states: 1832 num match states: 392 memory scale: KB total memory: 71.2812 pattern memory: 19.6484 match list memory: 28.4375 transition memory: 22.9453 appid: MaxRss diff: 3840 appid: patterns loaded: 300 -------------------------------------------------- pcap DAQ configured to passive. Snort successfully validated the configuration (with 0 warnings). o")~ Snort exiting |
ネットワークインターフェースの設定
ネットワーク インタフェースを確認
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: enp3s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 68:5b:35:b5:ed:04 brd ff:ff:ff:ff:ff:ff altname enx685b35b5ed04 inet 192.168.11.83/24 brd 192.168.11.255 scope global noprefixroute enp3s0f0 valid_lft forever preferred_lft forever inet6 fe80::6a5b:35ff:feb5:ed04/64 scope li |
ネットワーク・インターフェース名はenp3s0f0である
ネットワークインターフェイスをプロミスキャスモードに設定する。こうすることで、ネットワークデバイスはすべてのネットワークパケットをキャプチャし、検査できるようになる。
|
1 |
# ip link set dev enp3s0f0 promisc on |
設定を確認
|
1 2 3 |
# ip a | grep enp3s0f0 | grep mtu 2: enp3s0f0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 |
ネットワーク・インタフェースのオフロード・ステータスを確認。インタフェースのネッ トワーク・トラフィックを監視する必要がある場合は、オフロードを無効にする必要がある
|
1 2 3 |
# ethtool -k enp3s0f0 | grep receive-offload generic-receive-offload: off large-receive-offload: off [fixed] |
LROとGROのオフロードステータスはオフ状態になっている
Snortネットワークインターフェース用のsystemdサービスを作成する
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
# touch /etc/systemd/system/snort3-nic.service # vi /etc/systemd/system/snort3-nic.service 下記内容を記載 [Unit] Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot After=network.target [Service] Type=oneshot ExecStart=/usr/sbin/ip link set dev enp3s0f0 promisc on ExecStart=/usr/sbin/ethtool -K enp3s0f0 gro off lro off TimeoutStartSec=0 RemainAfterExit=yes [Install] WantedBy=default.target |
systemd デーモンが変更を適用する
|
1 2 3 4 |
# systemctl daemon-reload # systemctl enable snort3-nic.service Created symlink /etc/systemd/system/default.target.wants/snort3-nic.service → /etc/systemd/system/snort3-nic.service. # systemctl start snort3-nic.service |
Snort NICサービスのステータスを確認
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# systemctl status snort3-nic.service ● snort3-nic.service - Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot Loaded: loaded (/etc/systemd/system/snort3-nic.service; enabled; preset: disabled) Active: active (exited) since Wed 2025-06-25 14:22:48 JST; 13s ago Invocation: 343871773dbe4454907e9262e185748c Process: 35873 ExecStart=/usr/sbin/ip link set dev enp3s0f0 promisc on (code=exited, status=0/SUCCESS) Process: 35875 ExecStart=/usr/sbin/ethtool -K enp3s0f0 gro off lro off (code=exited, status=0/SUCCESS) Main PID: 35875 (code=exited, status=0/SUCCESS) Mem peak: 1.1M CPU: 7ms Jun 25 14:22:48 Lepard systemd[1]: Starting snort3-nic.service - Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot... Jun 25 14:22:48 Lepard systemd[1]: Finished snort3-nic.service - Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot. |
Snortコミュニティ・ルールセットを追加
1.Snortルール用のフォルダを作成し、SnortのWebサイトからコミュニティルールセットをダウンロードし、所定のルールディレクトリーに配置
|
1 2 |
# mkdir /usr/local/snort/etc/snort/rules # wget -qO- https://www.snort.org/downloads/community/snort3-community-rules.tar.gz | tar xz -C /usr/local/snort/etc/snort/rules/ |
2.Snortメイン設定ファイルを編集
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
# vi /usr/local/snort/etc/snort/snort.lua 24行目変更 HOME_NET = '192.168.11.0/24' 28行目変更 EXTERNAL_NET = '!$HOME_NET' 183行目当たりのips項目の最後に追加 ips = { -- use this to enable decoder and inspector alerts -- enable_builtin_rules = true, -- use include for rules files; be sure to set your path -- note that rules files can include other rules files -- (see also related path vars at the top of snort_defaults.lua) variables = default_variables, rules = [[ include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules ]] } |
3.Snortのメインコンフィグレーションの変更をテスト
|
1 2 3 4 5 6 7 8 |
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua 正常であれば最後に次が表示される -------------------------------------------------- pcap DAQ configured to passive. Snort successfully validated the configuration (with 0 warnings). o")~ Snort exiting |
カスタムルールの追加
1.Snort rulesディレクトリにファイルを作成する
|
1 2 3 |
# touch /usr/local/snort/etc/snort/rules/local.rules # vi /usr/local/snort/etc/snort/rules/local.rules alert icmp any any -> $HOME_NET any (msg:"Incoming ICMP"; sid:1000001; rev:1;) |
2.Snortメイン設定ファイルを編集
カスタム ルール ファイル ディレクトリをメイン構成に含めるためSnortメイン設定ファイルを編集
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
# vi /usr/local/snort/etc/snort/snort.lua 195行目当たりに追加 ips = { -- use this to enable decoder and inspector alerts --enable_builtin_rules = true, -- use include for rules files; be sure to set your path -- note that rules files can include other rules files -- (see also related path vars at the top of snort_defaults.lua) variables = default_variables, rules = [[ include /usr/local/snort/etc/snort/rules/local.rules include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules ]] } |
3.Snortのメインコンフィグレーションの変更をテスト
|
1 2 3 4 5 6 7 8 |
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua 正常であれば最後に次が表示される -------------------------------------------------- pcap DAQ configured to passive. Snort successfully validated the configuration (with 0 warnings). o")~ Snort exiting |
OpenAppIDエクステンションをインストール
OpenAppIDエクステンションをインストールすると、Snortはアプリケーションレイヤーレベルでネットワーク脅威を検出できるようになります
1.OpenAppIDエクステンションダウンロードと展開
|
1 2 |
# wget https://www.snort.org/downloads/openappid/33380 -O OpenAppId-33380.tgz # tar -xzvf OpenAppId-33380.tgz |
2.解凍したフォルダ(odp)を以下のディレクトリにコピー
|
1 |
# cp -R odp /usr/local/lib/ |
3.Snortメイン設定ファイルを編集し、OpenAppIDフォルダの場所を定義
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# vi /usr/local/snort/etc/snort/snort.lua 98行目appidセクションに追加 appid = { -- appid requires this to use appids in rules --app_detector_dir = 'directory to load appid detectors from' app_detector_dir = '/usr/local/lib', log_stats = true, } appid_listener = { json_logging = true, file = "/var/log/snort/appid-output.log", } --[[ reputation = |
4.Snortのメインコンフィグレーションの変更をテスト
|
1 2 3 4 5 6 7 8 |
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua 正常であれば最後に次が表示される -------------------------------------------------- pcap DAQ configured to passive. Snort successfully validated the configuration (with 0 warnings). o")~ Snort exiting |
すべてのコンフィギュレーションが正しくセットアップされていることを確認する
|
1 |
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -R /usr/local/snort/etc/snort/rules/local.rules -i enp3s0f0 -A alert_fast -s 65535 -k none |
リモートコンピュータからサーバのIPアドレスにpingコマンドを送信します。これにより、ホストサーバーのコンソールウィンドウにアラートログが表示されます
|
1 2 3 4 5 6 7 8 9 10 11 12 |
-------------------------------------------------- pcap DAQ configured to passive. Commencing packet processing ++ [0] enp3s0f0 06/25-14:32:34.404506 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.8 -> 192.168.11.83 06/25-14:32:34.404550 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.8 06/25-14:32:35.420172 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.8 -> 192.168.11.83 06/25-14:32:35.420211 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.8 06/25-14:32:36.431360 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.8 -> 192.168.11.83 06/25-14:32:36.431404 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.8 06/25-14:32:37.440743 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.8 -> 192.168.11.83 06/25-14:32:37.440788 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.8 |
Snort systemdサービスの設定
1.Snortサービス用のユーザの作成
|
1 |
# useradd -r -s /usr/sbin/nologin -M snort |
2.ログフォルダの作成とパーミッションの設定
Snortログ用のディレクトリフォルダを作成し、フォルダパーミッションを設定
|
1 2 3 |
# mkdir /var/log/snort # chmod -R 5775 /var/log/snort # chown -R snort:snort /var/log/snort |
3.Systemdサービスファイルの作成
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# touch /etc/systemd/system/snort3.service # vi /etc/systemd/system/snort3.service [Unit] Description=Snort3 IDS Daemon Service After=syslog.target network.target [Service] Type=simple ExecStart=/usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i enp3s0f0 -m 0x1b -u snort -g snort ExecStop=/bin/kill -9 $MAINPID [Install] WantedBy=multi-user.target |
Snortサービスをリロードして有効にする
|
1 2 3 |
# systemctl daemon-reload # systemctl enable --now snort3 Created symlink /etc/systemd/system/multi-user.target.wants/snort3.service → /etc/systemd/system/snort3.service. |
Snortサービスを開始
|
1 |
# systemctl restart snort3 |
ステータスを確認
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
# systemctl status snort3 ● snort3.service - Snort3 IDS Daemon Service Loaded: loaded (/etc/systemd/system/snort3.service; enabled; preset: disabled) Active: active (running) since Wed 2025-06-25 14:37:51 JST; 12s ago Invocation: a628985e67ef47529bee98b2b14dc786 Main PID: 37186 (snort3) Tasks: 2 (limit: 46859) Memory: 271.8M (peak: 271.9M) CPU: 872ms CGroup: /system.slice/snort3.service mq37186 /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i enp3s0f0 -m> Jun 25 14:37:52 Lepard snort[37186]: any: 8 Jun 25 14:37:52 Lepard snort[37186]: to_server: 69 Jun 25 14:37:52 Lepard snort[37186]: to_client: 48 Jun 25 14:37:52 Lepard snort[37186]: -------------------------------------------------- Jun 25 14:37:52 Lepard snort[37186]: search engine (ac_bnfa) Jun 25 14:37:52 Lepard snort[37186]: instances: 334 Jun 25 14:37:52 Lepard snort[37186]: patterns: 10779 Jun 25 14:37:52 Lepard snort[37186]: pattern chars: 175198 Jun 25 14:37:52 Lepard snort[37186]: num states: 123200 Jun 25 14:37:52 Lepard snort[37186]: num match states: 10502 |
Snort IDS ロギング
1.Snort JSONロギングの設定
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
# vi /usr/local/snort/etc/snort/snort.lua 258行目当たりの-- 7. configure outputsセクションの最後にalert_jsonを追加 --------------------------------------------------------------------------- -- 7. configure outputs --------------------------------------------------------------------------- -- event logging -- you can enable with defaults from the command line with -A <alert_type> -- uncomment below to set non-default configs --alert_csv = { } --alert_fast = { } --alert_full = { } --alert_sfsocket = { } --alert_syslog = { } --unified2 = { } -- packet logging -- you can enable with defaults from the command line with -L <log_type> --log_codecs = { } --log_hext = { } --log_pcap = { } -- additional logs --packet_capture = { } --file_log = { } alert_json = { file = true, limit = 50, fields = 'timestamp msg pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule priority class action b64_data' } |
2.Snortを再起動
|
1 |
# systemctl restart snort3 |
3.ログファイルを確認
リモートコンピュータからサーバにpingコマンドを実行する。Snort alert_json.txtファイルに保存されます。
|
1 2 3 4 5 6 7 8 9 10 |
# tail -f /var/log/snort/alert_json.txt { "timestamp" : "06/25-14:39:50.905283", "msg" : "Incoming ICMP", "pkt_num" : 17, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.8", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" } { "timestamp" : "06/25-14:39:50.905318", "msg" : "Incoming ICMP", "pkt_num" : 18, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.8", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" } { "timestamp" : "06/25-14:39:51.910923", "msg" : "Incoming ICMP", "pkt_num" : 20, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.8", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" } { "timestamp" : "06/25-14:39:51.910960", "msg" : "Incoming ICMP", "pkt_num" : 21, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.8", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" } { "timestamp" : "06/25-14:39:52.923402", "msg" : "Incoming ICMP", "pkt_num" : 24, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.8", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" } { "timestamp" : "06/25-14:39:52.923431", "msg" : "Incoming ICMP", "pkt_num" : 25, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.8", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" } { "timestamp" : "06/25-14:39:53.935179", "msg" : "Incoming ICMP", "pkt_num" : 26, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.8", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" } { "timestamp" : "06/25-14:39:53.935221", "msg" : "Incoming ICMP", "pkt_num" : 27, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.8", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" } |
以上でSnort 3のインストールと設定が完了