Contents
SNORT3
Snort is an open source network intrusion detection system capable of performing real-time traffic analysis and packet logging on IP networks。
It can perform “protocol analysis,” “content search,” and “matching,” and can be used to detect various attacks such as “buffer overflows,” “stealth port scans,” “CGI attacks,” “SMB probes,” “OS fingerprinting attempts,” “semantic URL attacks,” and “server message block probes. The system can be used to detect a variety of attacks, such as
1.advance preparation
1.1 Installing Required Packages
1.Installing openssl-devel
|
1 |
# dnf install openssl-devel |
2.Enabling codeready repositories
|
1 |
# dnf config-manager --set-enabled ol9_codeready_builder |
Check the repository
|
1 2 |
# dnf repolist|grep ol9_codeready_builder ol9_codeready_builder Oracle Linux 9 CodeReady Builder (x86_64) - (Unsupported) |
3.Installing cmake
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
# wget https://gitlab.kitware.com/cmake/cmake/-/archive/master/cmake-master.tar.gz Extracting a file # tar xvf cmake-master.tar.gz Compile cmake # cd cmake-master # ./bootstrap && make && make install Version Check # cmake --version cmake version 3.31.20241130-g7f830c5 CMake suite maintained and supported by Kitware (kitware.com/cmake) |
1.2 Install required packages
|
1 2 3 |
# dnf install libpcap-devel pcre-devel libdnet-devel hwloc-devel openssl-devel zlib-devel luajit-devel pkgconf libmnl-devel libunwind-devel # dnf install libnfnetlink-devel libnetfilter_queue |
1.3 Installing LibDAQ
|
1 2 3 4 5 6 7 8 9 10 |
# cd # git clone https://github.com/snort3/libdaq.git Cloning into 'libdaq'... remote: Enumerating objects: 2517, done. remote: Counting objects: 100% (252/252), done. remote: Compressing objects: 100% (111/111), done. remote: Total 2517 (delta 178), reused 190 (delta 141), pack-reused 2265 (from 1) Receiving objects: 100% (2517/2517), 1.16 MiB | 7.13 MiB/s, done. Resolving deltas: 100% (1811/1811), done. |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
# cd libdaq/ # ./bootstrap + autoreconf -ivf --warnings=all autoreconf: Entering directory `.' autoreconf: configure.ac: not using Gettext autoreconf: running: aclocal --force --warnings=all -I m4 autoreconf: configure.ac: tracing autoreconf: running: libtoolize --copy --force libtoolize: putting auxiliary files in '.'. libtoolize: copying file './ltmain.sh' libtoolize: putting macros in AC_CONFIG_MACRO_DIRS, 'm4'. libtoolize: copying file 'm4/libtool.m4' libtoolize: copying file 'm4/ltoptions.m4' libtoolize: copying file 'm4/ltsugar.m4' libtoolize: copying file 'm4/ltversion.m4' libtoolize: copying file 'm4/lt~obsolete.m4' autoreconf: running: /usr/bin/autoconf --force --warnings=all autoreconf: running: /usr/bin/autoheader --force --warnings=all autoreconf: running: automake --add-missing --copy --force-missing --warnings=all configure.ac:29: installing './ar-lib' configure.ac:26: installing './compile' configure.ac:34: installing './config.guess' configure.ac:34: installing './config.sub' configure.ac:19: installing './install-sh' configure.ac:19: installing './missing' api/Makefile.am: installing './depcomp' parallel-tests: installing './test-driver' autoreconf: Leaving directory `.' |
|
1 2 |
# ./configure # make && make install |
|
1 2 3 4 5 6 |
# ln -s /usr/local/lib/libdaq.so.3 /lib/ Add Shared Library # ldconfig Check the library # ldconfig -p|grep daq libdaq.so.3 (libc6,x86-64) => /lib/libdaq.so.3 |
1.4 Installing Optional Packages
1.Installation of LZMA and UUID
|
1 |
# dnf install xz-devel libuuid-devel |
2.Installing Hyperscan
|
1 |
# dnf install hyperscan hyperscan-devel |
3.Installing Tcmalloc
|
1 |
# dnf install gperftools-devel |
2. Installing Snort3
|
1 2 3 4 5 6 |
# git clone https://github.com/snort3/snort3.git # cd snort3/ # export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH # export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig:$PKG_CONFIG_PATH # export CFLAGS="-O3" # export CXXFLAGS="-O3 -fno-rtti" |
Running configure
|
1 2 3 4 5 6 |
# ./configure_cmake.sh --prefix=/usr/local/snort --enable-tcmalloc ------------------------------------------------------- -- Configuring done -- Generating done -- Build files have been written to: /root/snort3/build |
Build, compile, and install
|
1 2 3 4 5 6 |
# cd build/ # pwd /root/snort3/build # make -j$(nproc) # make -j$(nproc) install |
Version Check
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
# /usr/local/snort/bin/snort -V ,,_ -*> Snort++ <*- o" )~ Version 3.5.2.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.17 Using Hyperscan version 5.4.1 2023-04-14 Using libpcap version 1.10.0 (with TPACKET_V3) Using LuaJIT version 2.1.0-beta3 Using LZMA version 5.2.5 Using OpenSSL 3.2.2 4 Jun 2024 Using PCRE version 8.44 2020-02-12 Using ZLIB version 1.2.11 |
test run
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -------------------------------------------------- search engine (ac_bnfa) instances: 2 patterns: 438 pattern chars: 2602 num states: 1832 num match states: 392 memory scale: KB total memory: 71.2812 pattern memory: 19.6484 match list memory: 28.4375 transition memory: 22.9453 appid: MaxRss diff: 3720 appid: patterns loaded: 300 -------------------------------------------------- pcap DAQ configured to passive. Snort successfully validated the configuration (with 0 warnings). o")~ Snort exiting |
Network interface settings
Check network interface
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 00:0c:29:80:4b:68 brd ff:ff:ff:ff:ff:ff altname enp3s0 inet 192.168.11.83/24 brd 192.168.11.255 scope global noprefixroute ens160 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe80:4b68/64 scope link noprefixroute valid_lft forever preferred_lft foreve |
The network interface name is ens160
Set the network interface to promiscuous mode. This way, the network device can capture and inspect all network packets.
|
1 |
# ip link set dev ens160 promisc on |
Check settings
|
1 2 3 |
# ip a | grep ens160 | grep mtu 2: ens160: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 |
Check the offload status of the network interface.
If you need to monitor network traffic on an interface, you must disable offloading
|
1 2 3 |
# ethtool -k ens160 | grep receive-offload generic-receive-offload: off large-receive-offload: off |
If it is on and you want to set the LRO and GRO offload status to off state
|
1 |
# ethtool -K ens160 gro off lro off |
Create systemd service for snort network interface
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
# touch /etc/systemd/system/snort3-nic.service # vi /etc/systemd/system/snort3-nic.service Include the following information [Unit] Description=Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot After=network.target [Service] Type=oneshot ExecStart=/usr/sbin/ip link set dev ens160 promisc on ExecStart=/usr/sbin/ethtool -K ens160 gro off lro off TimeoutStartSec=0 RemainAfterExit=yes [Install] WantedBy=default.target |
systemd daemon applies changes
|
1 2 3 4 |
# systemctl daemon-reload # systemctl enable snort3-nic.service Created symlink /etc/systemd/system/default.target.wants/snort3-nic.service → /etc/systemd/system/snort3-nic.service. # systemctl start snort3-nic.service |
Check Snort NIC Service Status
|
1 2 3 4 5 6 7 8 9 10 11 |
# systemctl status snort3-nic.service ● snort3-nic.service - Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot Loaded: loaded (/etc/systemd/system/snort3-nic.service; enabled; preset: disabled) Active: active (exited) since Sun 2024-12-01 15:18:12 JST; 8s ago Process: 56500 ExecStart=/usr/sbin/ip link set dev ens160 promisc on (code=exited, status=0/SUCCESS) Process: 56501 ExecStart=/usr/sbin/ethtool -K ens160 gro off lro off (code=exited, status=0/SUCCESS) Main PID: 56501 (code=exited, status=0/SUCCESS) CPU: 7ms Dec 01 15:18:12 Lepard systemd[1]: Starting Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot... Dec 01 15:18:12 Lepard systemd[1]: Finished Set Snort 3 NIC in promiscuous mode and Disable GRO, LRO on boot. |
Added Snort Community Ruleset
1.Create a folder for Snort rules, download the community ruleset from the Snort website, and place it in the designated rules directory
|
1 2 |
# mkdir /usr/local/snort/etc/snort/rules # wget -qO- https://www.snort.org/downloads/community/snort3-community-rules.tar.gz | tar xz -C /usr/local/snort/etc/snort/rules/ |
2.Edit Snort main configuration file
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
# vi /usr/local/snort/etc/snort/snort.lua Line 24 : change HOME_NET = '192.168.11.0/24' Line 28 : change EXTERNAL_NET = '!$HOME_NET' Add to the end of the ips item per line 183 ips = { -- use this to enable decoder and inspector alerts -- enable_builtin_rules = true, -- use include for rules files; be sure to set your path -- note that rules files can include other rules files -- (see also related path vars at the top of snort_defaults.lua) variables = default_variables, rules = [[ include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules ]] } |
3.Test Snort's main configuration changes
|
1 2 3 4 5 6 7 8 |
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua If all is well, the next is displayed at the end. -------------------------------------------------- pcap DAQ configured to passive. Snort successfully validated the configuration (with 0 warnings). o")~ Snort exiting |
Add custom rule
1.Create a file in the Snort rules directory
|
1 2 3 |
# touch /usr/local/snort/etc/snort/rules/local.rules # vi /usr/local/snort/etc/snort/rules/local.rules alert icmp any any -> $HOME_NET any (msg:"Incoming ICMP"; sid:1000001; rev:1;) |
2.Edit Snort main configuration file
Edit Snort main configuration file to include custom rules file directory in main configuration
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
# vi /usr/local/snort/etc/snort/snort.lua Add per line 195 ips = { -- use this to enable decoder and inspector alerts --enable_builtin_rules = true, -- use include for rules files; be sure to set your path -- note that rules files can include other rules files -- (see also related path vars at the top of snort_defaults.lua) variables = default_variables, rules = [[ include /usr/local/snort/etc/snort/rules/local.rules include /usr/local/snort/etc/snort/rules/snort3-community-rules/snort3-community.rules ]] } |
3.Test Snort's main configuration changes
|
1 2 3 4 5 6 7 8 |
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua If all is well, the next is displayed at the end. -------------------------------------------------- pcap DAQ configured to passive. Snort successfully validated the configuration (with 0 warnings). o")~ Snort exiting |
Install OpenAppID extension
Once the OpenAppID extension is installed, Snort can detect network threats at the application layer level
1.OpenAppID Extension Download and Deployment
|
1 2 |
# wget https://www.snort.org/downloads/openappid/33380 -O OpenAppId-33380.tgz # tar -xzvf OpenAppId-33380.tgz |
2.Copy the extracted folder (odp) to the following directory
|
1 |
# cp -R odp /usr/local/lib/ |
3.Edit the Snort main configuration file to define the location of the OpenAppID folder
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# vi /usr/local/snort/etc/snort/snort.lua Add per line 98 appid = { -- appid requires this to use appids in rules --app_detector_dir = 'directory to load appid detectors from' app_detector_dir = '/usr/local/lib', log_stats = true, } appid_listener = { json_logging = true, file = "/var/log/snort/appid-output.log", } --[[ reputation = |
4.Test Snort's main configuration changes
|
1 2 3 4 5 6 7 8 |
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua If all is well, the next is displayed at the end. -------------------------------------------------- pcap DAQ configured to passive. Snort successfully validated the configuration (with 0 warnings). o")~ Snort exiting |
Verify that all configurations are set up correctly
|
1 |
# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -R /usr/local/snort/etc/snort/rules/local.rules -i ens160 -A alert_fast -s 65535 -k none |
Send a ping command from a remote computer to the IP address of the server. This will cause an alert log to appear in the console window of the host server
|
1 2 3 4 5 6 |
Commencing packet processing ++ [0] ens160 12/01-15:25:38.384252 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.45 -> 192.168.11.83 12/01-15:25:38.388669 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.45 12/01-15:25:39.388502 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.45 -> 192.168.11.83 12/01-15:25:39.388560 [**] [1:1000001:1] "Incoming ICMP" [**] [Priority: 0] [AppID: ICMP] {ICMP} 192.168.11.83 -> 192.168.11.45 |
Configure Snort systemd service
1.Creating Users for the Snort Service
|
1 |
# useradd -r -s /usr/sbin/nologin -M snort |
2.Create log folder and set permissions
Create directory folder for Snort logs and set folder permissions
|
1 2 3 |
# mkdir /var/log/snort # chmod -R 5775 /var/log/snort # chown -R snort:snort /var/log/snort |
3.Create Systemd service file
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# touch /etc/systemd/system/snort3.service # vi /etc/systemd/system/snort3.service [Unit] Description=Snort3 IDS Daemon Service After=syslog.target network.target [Service] Type=simple ExecStart=/usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens160 -m 0x1b -u snort -g snort ExecStop=/bin/kill -9 $MAINPID [Install] WantedBy=multi-user.target |
Reload and activate the Snort service.
|
1 2 3 |
# systemctl daemon-reload # systemctl enable --now snort3 Created symlink /etc/systemd/system/multi-user.target.wants/snort3.service → /etc/systemd/system/snort3.service. |
Launched Snort service
|
1 |
# systemctl restart snort3 |
Check Status
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
# systemctl status snort3 ● snort3.service - Snort3 IDS Daemon Service Loaded: loaded (/etc/systemd/system/snort3.service; enabled; preset: disabled) Active: active (running) since Sun 2024-12-01 15:27:58 JST; 9s ago Main PID: 57986 (snort3) Tasks: 2 (limit: 15828) Memory: 274.7M CPU: 1.038s CGroup: /system.slice/snort3.service └─57986 /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort -D -i ens160 -m 0x1b -u snort -g snort Dec 01 15:27:58 Lepard snort[57986]: any: 8 Dec 01 15:27:58 Lepard snort[57986]: to_server: 69 Dec 01 15:27:58 Lepard snort[57986]: to_client: 48 Dec 01 15:27:58 Lepard snort[57986]: -------------------------------------------------- Dec 01 15:27:58 Lepard snort[57986]: search engine (ac_bnfa) Dec 01 15:27:58 Lepard snort[57986]: instances: 334 Dec 01 15:27:58 Lepard snort[57986]: patterns: 10776 Dec 01 15:27:58 Lepard snort[57986]: pattern chars: 175132 Dec 01 15:27:58 Lepard snort[57986]: num states: 123161 Dec 01 15:27:58 Lepard snort[57986]: num match states: 10496 |
Snort IDS Logging
1.Configure Snort JSON logging
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
# vi /usr/local/snort/etc/snort/snort.lua Per line 258 -- 7. Add alert_json at the end of the configure outputs section --------------------------------------------------------------------------- -- 7. configure outputs --------------------------------------------------------------------------- -- event logging -- you can enable with defaults from the command line with -A <alert_type> -- uncomment below to set non-default configs --alert_csv = { } --alert_fast = { } --alert_full = { } --alert_sfsocket = { } --alert_syslog = { } --unified2 = { } -- packet logging -- you can enable with defaults from the command line with -L <log_type> --log_codecs = { } --log_hext = { } --log_pcap = { } -- additional logs --packet_capture = { } --file_log = { } alert_json = { file = true, limit = 50, fields = 'timestamp msg pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule priority class action b64_data' } |
2.Restart Snort
|
1 |
# systemctl restart snort3 |
3.Check log files
Ping command from a remote computer to the server, stored in the Snort alert_json.txt file.
|
1 2 3 4 5 6 |
# tail -f /var/log/snort/alert_json.txt { "timestamp" : "12/01-15:30:50.558233", "msg" : "Incoming ICMP", "pkt_num" : 720, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 84, "dir" : "C2S", "src_addr" : "192.168.11.45", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "Z0wCmgAFs7AICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc=" } { "timestamp" : "12/01-15:30:50.558294", "msg" : "Incoming ICMP", "pkt_num" : 721, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 84, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.45", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "Z0wCmgAFs7AICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc=" } { "timestamp" : "12/01-15:30:51.563056", "msg" : "Incoming ICMP", "pkt_num" : 728, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 84, "dir" : "C2S", "src_addr" : "192.168.11.45", "dst_addr" : "192.168.11.83", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "Z0wCmwAFwoMICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc=" } { "timestamp" : "12/01-15:30:51.563132", "msg" : "Incoming ICMP", "pkt_num" : 729, "proto" : "ICMP", "pkt_gen" : "raw", "pkt_len" : 84, "dir" : "S2C", "src_addr" : "192.168.11.83", "dst_addr" : "192.168.11.45", "service" : "unknown", "rule" : "1:1000001:1", "priority" : 0, "class" : "none", "action" : "allow", "b64_data" : "Z0wCmwAFwoMICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc=" } |
This completes the installation and configuration of Snort 3.