Debian13.6 : SNORT3 インストール

Contents

Snort3

1.必要なパッケージをインストール

# apt -y install build-essential libpcap-dev libpcre2-dev libnet1-dev zlib1g-dev luajit hwloc libdumbnet-dev bison flex liblzma-dev openssl libssl-dev pkg-config libhwloc-dev cmake cpputest libsqlite3-dev uuid-dev libcmocka-dev libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev libunwind-dev libfl-dev git

2. DAQライブラリをインストール

DAQライブラリをダウンロードしてインストール

# git clone https://github.com/snort3/libdaq.git
# cd libdaq/
~/libdaq# ./bootstrap
~/libdaq# ./configure
~/libdaq# make
~/libdaq# make install

3. Gperftoolsをインストール

複数のインスタンスにおけるメモリ処理を改善することで、特定のアプリケーションやサービスのパフォーマンスを向上させるために使用されるプロファイラツール

# cd
# wget https://github.com/gperftools/gperftools/releases/download/gperftools-2.18.1/gperftools-2.18.1.tar.gz
# tar xzf gperftools-2.18.1.tar.gz
# cd gperftools-2.18.1
~/gperftools-2.18.1# ./configure
~/gperftools-2.18.1# make
~/gperftools-2.18.1# make install

4. SNORT3のインストール

①SNORT3のダウンロードとインストール

# cd
# wget https://github.com/snort3/snort3/archive/refs/tags/3.12.2.0.tar.gz
# tar zxvf 3.12.2.0.tar.gz
# cd snort3-3.12.2.0
# ./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc
# cd build
# make
# make install

➁共有ライブラリを更新

# ldconfig

➂バージョンを確認

# snort -V

   ,,_     -*> Snort++ <*-
  o"  )~   Version 3.12.2.0
   ''''    By Martin Roesch & The Snort Team
           http://snort.org/contact#team
           Copyright (C) 2014-2026 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using DAQ version 3.0.27
           Using libpcap version 1.10.5 (with TPACKET_V3)
           Using LuaJIT version 2.1.1737090214
           Using LZMA version 5.8.1
           Using OpenSSL 3.5.6 7 Apr 2026
           Using PCRE2 version 10.46 2025-08-27
           Using ZLIB version 1.3.1

⑥デフォルト設定をテスト

# snort -c /usr/local/etc/snort/snort.lua

正常であれば下記のように表示される
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

5. ネットワークインタフェースを特定し、設定

①ネットワーク・インターフェースを確認

# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000  
    link/ether 00:0c:29:8e:7c:10 brd ff:ff:ff:ff:ff:ff
    altname enp2s1
    altname enx000c298e7c10
    inet 192.168.11.83/24 brd 192.168.11.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe8e:7c10/64 scope link proto kernel_ll
       valid_lft forever preferred_lft forever

ネットワーク・インターフェース名はens33

➁ネットワークインターフェースをプロミスキャスモードに設定

# ip link set dev ens33 promisc on

設定を確認

# ip addr | grep ens33 | grep mtu
2: ens33: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000

➂ラージ・レシーブ・オフロード（LRO）とジェネリック・レシーブ・オフロード（GRO）をオフ状態に設定

現在の状態を確認

# ethtool -k ens33 | grep receive-offload
generic-receive-offload: on
large-receive-offload: off [fixed]

LROとGROのオフロードステータスをオフ状態に設定

# ethtool -K ens33 gro off lro off

6. ネットワークインターフェース用のsystemdサービスを作成

# vi /etc/systemd/system/snort3-nic.service

下記内容を記述
[Unit]
Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/ip link set dev ens33 promisc on
ExecStart=/usr/sbin/ethtool -K ens33 gro off lro off
TimeoutStartSec=0
RemainAfterExit=yes

[Install]
WantedBy=default.target

systemd デーモンをリロードし、変更を適用

# systemctl daemon-reload

snort3-nic.serviceを起動し、有効にします

# systemctl start snort3-nic.service
# systemctl enable snort3-nic.service

snort3-nic.serviceのステータスを確認

# systemctl status snort3-nic.service

● snort3-nic.service - Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot
     Loaded: loaded (/etc/systemd/system/snort3-nic.service; enabled; preset: enabled)
     Active: active (exited) since Fri 2026-07-24 13:40:32 JST; 28s ago
 Invocation: 7eeea35fe69c479fa7f96ebaac062724
   Main PID: 42972 (code=exited, status=0/SUCCESS)
   Mem peak: 1.7M
        CPU: 19ms

Jul 24 13:40:31 Lepard systemd[1]: Starting snort3-nic.service - Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot...
Jul 24 13:40:32 Lepard systemd[1]: Finished snort3-nic.service - Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot.

7. Snort Rulesの追加

7.1 コミュニティ・ルールセットを追加

①Snortルール用のフォルダを作成し、SnortのWebサイトからコミュニティルールセットをダウンロード

# mkdir /usr/local/etc/snort/rules
# wget -qO- https://www.snort.org/downloads/community/snort3-community-rules.tar.gz | tar xz -C /usr/local/etc/snort/rules/

➁ Snortメイン設定ファイルを編集

# vi /usr/local/etc/snort/snort.lua

24行目 : 自ネットワークに変更
HOME_NET = '192.168.11.0/24'

28行目 : 変更
EXTERNAL_NET = '!$HOME_NET'

197行目当たりに追加
ips =
{
    -- use this to enable decoder and inspector alerts
    -- enable_builtin_rules = true,
    

    -- use include for rules files; be sure to set your path
    -- note that rules files can include other rules files
    -- (see also related path vars at the top of snort_defaults.lua)

    variables = default_variables,
    rules = [[
      include /usr/local/etc/snort/rules/snort3-community-rules/snort3-community.rules
    ]]

}

➂ メイン構成の変更をテスト

# snort -c /usr/local/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

7.2 カスタムルールを追加

①Snort rulesディレクトリにファイルを作成

# vi  /usr/local/etc/snort/rules/local.rules

下記内容を記述
alert icmp any any -> $HOME_NET any (msg:"Incoming ICMP"; sid:1000001; rev:1;)

➁Snortメイン構成を編集

# vi /usr/local/etc/snort/snort.lua

199行目当たりに追加
ips =
{
    -- use this to enable decoder and inspector alerts
    -- enable_builtin_rules = true,
    
    -- use include for rules files; be sure to set your path
    -- note that rules files can include other rules files
    -- (see also related path vars at the top of snort_defaults.lua)

    variables = default_variables,
    rules = [[
      include /usr/local/etc/snort/rules/local.rules
      include /usr/local/etc/snort/rules/snort3-community-rules/snort3-community.rules
    ]]
}

➂ メイン構成の変更をテスト

# snort -c /usr/local/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

8. OpenAppIDインストール

OpenAppIDエクステンションをインストールすると、Snortはアプリケーションレイヤーレベルでネットワーク脅威を検出できるようになります

①OpenAppIDをダウンロードし、展開

# wget https://www.snort.org/downloads/openappid/33380 -O OpenAppId-33380.tgz
# tar -xzvf  OpenAppId-33380.tgz

➁解凍したフォルダ（odp）を以下のディレクトリにコピー

# cp -R odp /usr/local/lib/

➂メイン設定ファイルを編集し、OpenAppIDフォルダの場所を定義

# vi /usr/local/etc/snort/snort.lua

104行目当たりに追加
appid =
{
    -- appid requires this to use appids in rules
    --app_detector_dir = 'directory to load appid detectors from'
    app_detector_dir = '/usr/local/lib',
    log_stats = true,

}

appid_listener =
{
    json_logging = true,
    file = "/var/log/snort/appid-output.log",
}
--[[
reputation =

④ メイン構成の変更をテスト

# snort -c /usr/local/etc/snort/snort.lua

--------------------------------------------------
pcap DAQ configured to passive.

Snort successfully validated the configuration (with 0 warnings).
o")~   Snort exiting

9. Snort用のsystemdサービスを作成

9.1 すべてのセットアップの確認

local.rulesを使ってネットワークインターフェース上でSnortを実行

# snort -c /usr/local/etc/snort/snort.lua -R /usr/local/etc/snort/rules/local.rules -i ens33 -A alert_fast -s 65535 -k none

同一ネットワークの別のPCからDebianサーバのIPアドレスにpingコマンドを送信
ホストサーバーのコンソールウィンドウに次のようなアラートログが表示されます

++ [0] ens33
07/24-13:56:36.940068 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:36.940068 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:36.940294 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:37.955186 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:37.955186 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:37.955398 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:37.955512 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:38.972951 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:38.972951 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:38.973351 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:38.973455 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:39.987318 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:39.987318 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.14 -> 192.168.11.83
07/24-13:56:39.987780 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14
07/24-13:56:39.987940 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.14

9.2 Snort用のsystemdサービスを作成

①Snortサービス用のユーザ（snort）を作成

# useradd -r -s /usr/sbin/nologin -M snort

➁ログフォルダの作成と権限の設定

# mkdir /var/log/snort
# chmod -R 5775 /var/log/snort
# chown -R snort:snort /var/log/snort

➂SNORT systemdサービスファイルを作成

# vi /etc/systemd/system/snort3.service

下記内容を記述
[Unit]
Description=Snort3 IDS Daemon Service
After=syslog.target network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens33 -m 0x1b -u snort -g snort
ExecStop=/bin/kill -9 $MAINPID

[Install]
WantedBy=multi-user.target

④Snortサービスをリロードして有効

# systemctl daemon-reload
# systemctl enable --now snort3

⑤Snortサービスを起動し、ステータスを確認

# systemctl start snort3
# systemctl status snort3
● snort3.service - Snort3 IDS Daemon Service
     Loaded: loaded (/etc/systemd/system/snort3.service; enabled; preset: enabled)
     Active: active (running) since Fri 2026-07-24 14:00:32 JST; 31s ago
 Invocation: f1af56d5f4ff4e72ad0d1274b0532a81
   Main PID: 43312 (snort3)
      Tasks: 2 (limit: 4553)
     Memory: 216.2M (peak: 216.6M)
        CPU: 1.060s
     CGroup: /system.slice/snort3.service
             └─43312 /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens33 -m 0x1b -u snort -g >

Jul 24 14:00:32 Lepard snort[43312]:                 to_server: 69
Jul 24 14:00:32 Lepard snort[43312]:                 to_client: 48
Jul 24 14:00:32 Lepard snort[43312]: --------------------------------------------------
Jul 24 14:00:32 Lepard snort[43312]: search engine (ac_bnfa)
Jul 24 14:00:32 Lepard snort[43312]:                 instances: 334
Jul 24 14:00:32 Lepard snort[43312]:                  patterns: 10779
Jul 24 14:00:32 Lepard snort[43312]:             pattern chars: 175202
Jul 24 14:00:32 Lepard snort[43312]:                num states: 123205
Jul 24 14:00:32 Lepard snort[43312]:          num match states: 10502
Jul 24 14:00:32 Lepard snort[43312]:              memory scale: MB

10. Snort JSONロギング設定

①Snort設定ファイルを編集

# vi /usr/local/etc/snort/snort.lua

261行目 --7. configure outputsセクションの最後に追加

---------------------------------------------------------------------------
-- 7. configure outputs
---------------------------------------------------------------------------

--------------- 

-- additional logs
--packet_capture = { }
--file_log = { }

alert_json =
{
    file = true,
    limit = 50,
    fields = 'timestamp msg pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule priority class action b64_data'
}

➁Snortを再起動

# systemctl restart snort3

➂設定の確認
同一ネットワーク上の別のPCからホストサーバにpingコマンドを実行
ログが記録され、Snort alert_json.txtファイルに保存されます。ログファイルを確認

# tail -f /var/log/snort/alert_json.txt 

次のようなログ結果が表示される
{ "timestamp" : "07/24-14:04:33.524087", "msg" : "Incoming ICMP", "pkt_num" : 791, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:33.524215", "msg" : "Incoming ICMP", "pkt_num" : 792, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:34.537199", "msg" : "Incoming ICMP", "pkt_num" : 842, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:34.537199", "msg" : "Incoming ICMP", "pkt_num" : 843, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:34.537362", "msg" : "Incoming ICMP", "pkt_num" : 844, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:34.537485", "msg" : "Incoming ICMP", "pkt_num" : 845, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:35.552620", "msg" : "Incoming ICMP", "pkt_num" : 889, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:35.552620", "msg" : "Incoming ICMP", "pkt_num" : 890, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "C2S", "src_addr" : "192.168.11.14", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:35.552867", "msg" : "Incoming ICMP", "pkt_num" : 891, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }
{ "timestamp" : "07/24-14:04:35.552993", "msg" : "Incoming ICMP", "pkt_num" : 892, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 60, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.14", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dndhYmNkZWZnaGk=" }

11.ルールファイルの自動更新

Snort が不正アクセスの判断をするために参照するルールファイルを自動で最新化するoinkmaster をインストールする

11.1 Oinkmasterインストール

# wget http://prdownloads.sourceforge.net/oinkmaster/oinkmaster-2.0.tar.gz
# tar zxvf oinkmaster-2.0.tar.gz

下記ファイルを所定のディレクトリへコピー
# cp oinkmaster-2.0/oinkmaster.pl /usr/local/bin/
# cp oinkmaster-2.0/oinkmaster.conf /etc/
# cp oinkmaster-2.0/oinkmaster.1 /usr/share/man/man1/

下記ファイル、ディレクトリーを削除

# rm -rf oinkmaster-2.0
# rm -f oinkmaster-2.0.tar.gz

11.2 Oink Codeの取得

Snortルールファイル(Sourcefire VRT Certified Rules)をダウンロードするには「Oink Code」が必要なので、「Oink Code」を取得する。
まず、SNORT公式ページにアクセスしユーザー登録を行い、登録したアカウント、パスワードでSign in後"Oinkcode"を表示し、コピーする。

11.3 Oinkmaster設定
Oinkmaster設定ファイルを編集
取得したOinkcodeを貼り付ける

# vi /etc/oinkmaster.conf
56行目当たり : 下記を追加
<file_name>の箇所にはSNORTにサインイン後、使用しているSNORTバージョンに一致する最新のsnortrules-snapshot-xxxxx.tar.gzを貼り付ける
<oinkcode>の箇所に取得したoinkcodeを貼り付ける

url = http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode>/<file_name>

11.4 ダウンロードする(Oinkmaster実行)

# oinkmaster.pl -o /usr/local/etc/snort/rules/

下記のように表示される
[***] Results from Oinkmaster started 20260724 14:23:06 [***]

[*] Rules modifications: [*]
    None.

[*] Non-rule line modifications: [*]
    None.

[+] Added files (consider updating your snort.conf to include them if needed): [+]

    -> includes.rules
    -> snort3-app-detect.rules
    -> snort3-browser-chrome.rules
    -> snort3-browser-firefox.rules
    -> snort3-browser-ie.rules
    -> snort3-browser-other.rules
    -> snort3-browser-plugins.rules
    -> snort3-browser-webkit.rules
    -> snort3-content-replace.rules
    -> snort3-exploit-kit.rules
    -> snort3-file-executable.rules
    -> snort3-file-flash.rules
    -> snort3-file-identify.rules
    -> snort3-file-image.rules
    -> snort3-file-java.rules
    -> snort3-file-multimedia.rules
    -> snort3-file-office.rules
    -> snort3-file-other.rules
    -> snort3-file-pdf.rules
    -> snort3-indicator-compromise.rules
    -> snort3-indicator-obfuscation.rules
    -> snort3-indicator-scan.rules
    -> snort3-indicator-shellcode.rules
    -> snort3-malware-backdoor.rules
    -> snort3-malware-cnc.rules
    -> snort3-malware-other.rules
    -> snort3-malware-tools.rules
    -> snort3-netbios.rules
    -> snort3-os-linux.rules
    -> snort3-os-mobile.rules
    -> snort3-os-other.rules
    -> snort3-os-solaris.rules
    -> snort3-os-windows.rules
    -> snort3-policy-multimedia.rules
    -> snort3-policy-other.rules
    -> snort3-policy-social.rules
    -> snort3-policy-spam.rules
    -> snort3-protocol-dns.rules
    -> snort3-protocol-finger.rules
    -> snort3-protocol-ftp.rules
    -> snort3-protocol-icmp.rules
    -> snort3-protocol-imap.rules
    -> snort3-protocol-nntp.rules
    -> snort3-protocol-other.rules
    -> snort3-protocol-pop.rules
    -> snort3-protocol-rpc.rules
    -> snort3-protocol-scada.rules
    -> snort3-protocol-services.rules
    -> snort3-protocol-snmp.rules
    -> snort3-protocol-telnet.rules
    -> snort3-protocol-tftp.rules
    -> snort3-protocol-voip.rules
    -> snort3-pua-adware.rules
    -> snort3-pua-other.rules
    -> snort3-pua-p2p.rules
    -> snort3-pua-toolbars.rules
    -> snort3-server-apache.rules
    -> snort3-server-iis.rules
    -> snort3-server-mail.rules
    -> snort3-server-mssql.rules
    -> snort3-server-mysql.rules
    -> snort3-server-oracle.rules
    -> snort3-server-other.rules
    -> snort3-server-samba.rules
    -> snort3-server-webapp.rules
    -> snort3-sql.rules
    -> snort3-x11.rules
    -> VRT-License.txt

11.5 Oinkmaster定期自動実行設定

Oinkmaster定期自動実行スクリプト作成

# vi /etc/cron.daily/snort-rule-update

下記内容を記述
#!/bin/bash
/usr/local/bin/oinkmaster.pl -o  /usr/local/etc/snort/rules/ 2>&1 | logger -t oinkmaster
systemctl restart snort3 > /dev/null

スクリプトに実行権限

# chmod +x /etc/cron.daily/snort-rule-update

ページのトップへ

WordPressが利用できる代表的なレンタルサーバー