{"id":515,"date":"2010-06-18T15:08:25","date_gmt":"2010-06-18T20:08:25","guid":{"rendered":"http:\/\/it.thelibrarie.com\/weblog\/?p=515"},"modified":"2010-07-13T09:58:36","modified_gmt":"2010-07-13T14:58:36","slug":"installing-snort-on-ubuntu-10-04","status":"publish","type":"post","link":"https:\/\/it.thelibrarie.com\/weblog\/2010\/06\/installing-snort-on-ubuntu-10-04\/","title":{"rendered":"Installing SNORT on Ubuntu 10.04"},"content":{"rendered":"

My company recently removed a Cisco IPS device (pile of crap) along with a Microsoft 2006 ISA Server (more of a pile of crap) from the network infrastructure. It cost too much to maintain licensing, and it was starting to become a huge headache for company growth.<\/p>\n

However, the director of IT requested that we still have some sort of logging for potential breaches. Every firewall block in\/out is sent to us via email, and every firewall action is kept in a syslog server (and backed up to another syslog server and NAS system), but it would be nice to see the packets and payloads of every network transaction.<\/p>\n

Snort to the rescue! Snort is free (well, if you don’t mind having to setup\/maintain\/administer it without a ton of help and really don’t mind having slightly older rules than paying customers), and doesn’t really require a lot of hardware to get it to work. Our production Snort is running on an HP DL320 1U with a 3.2GHz Pentium 4, 2GB RAM, and a mirror of 80GB SATA. For testing I used VMWare Workstation 7, but I’m sure you can use VMWare Server\/ESX\/ESXi or Xenapp etc.<\/p>\n

The settings I used for VMWare:<\/p>\n

I named it SNORT
\n1 processor, 2 cores
\n512MB RAM
\nBridged Networking single interface (eth0)
\nSCSI LSI Logic I\/O
\nSCSI 20GB HD Partition Split into 2GB Files
\nRemoved the Floppy Disk
\n\"\"<\/a><\/p><\/blockquote>\n

I’m also using Ubuntu Server 10.04 LTS 32bit. Grab that ISO if you don’t already have it. Oh, and since some of my “readers” want me to put this: I grabbed the information used in this post from the ubuntuforums, from bil at play, and from Nick Moore.<\/p>\n

I assume that you already know how to load Ubuntu Server. If not, then Snort will probably be a little bit over your head. http:\/\/linux.insanelan.com. Ubuntu was loaded with the following settings:<\/p>\n

Language – English
\nHostname – snortsvr
\nTime Zone – CDT
\nPartitioning method – Guided used entire disk
\nFull name for new user – buddy
\nUsername for account – buddy
\nPassword – buddy (I know it’s weak)
\nEncrypt home directory – no
\nAutomatic Updates – no
\n\"\"<\/a><\/p>\n

I always install LAMP, Mail, and OpenSSH. Just a standard setup for me.<\/p>\n

MySQL Root Password – password
\nPostfix configuration – internet site
\nSystem mail name – snortsvr.local
\nLoad Grub to MBR – yes
\nContinue, and then it’ll reboot your system.\n<\/p><\/blockquote>\n

Login as buddy\/buddy. Now I dislike the whole “sudo” crap. It’s my server, I don’t want to have to ask for permission to use it. If this is a shared server – sure go ahead – otherwise do the following:
\nsudo passwd root<\/code>
\nEnter your buddy password
\nEnter your root password (I put in “password”)
\nsu<\/code>
\nEnter your root password<\/p>\n

This is optional but I find it a lot easier to SSH via putty to my system than to control it via the VMWare interface.
\nifconfig eth0<\/code>
\nMake note of your IP address
\nOpen Putty and SSH to your Server (in my case it’s 10.4.0.54)
\nLogin as root<\/p>\n

You’ll notice that there will be several packages to update. Update them.
\n\"\"<\/a>
\napt-get update<\/code>
\napt-get upgrade<\/code><\/p>\n

Depending on the speed of your internet connection, you may have time to watch a movie – or maybe it’s already done and you’re wondering why I typed this sentence. Either way, keep reading:<\/p>\n

DOWNLOADS AND INSTALLATIONS<\/strong>
\nInstall the following on your Ubuntu system:
\napt-get install libpcap0.8-dev libmysqlclient15-dev bison flex apache2 php5 libapache2-mod-php5 php5-gd php5-mysql libtool libpcre3-dev php-pear<\/code><\/p>\n

Make a directory for you to download stuff:
\nmkdir ~\/snortfiles<\/code>
\ncd ~\/snortfiles<\/code><\/p>\n

You’ll need to download the following:
\nBase 1.4.5
\nwget http:\/\/downloads.sourceforge.net\/project\/secureideas\/BASE\/base-1.4.5\/base-1.4.5.tar.gz?use_mirror=voxel<\/code><\/p>\n

ADOdb 4991
\nwget http:\/\/downloads.sourceforge.net\/project\/adodb\/adodb-php-4-and-5\/adodb-4991-for-php\/adodb4991.tgz?use_mirror=voxel<\/code><\/p>\n

Barnyard2 1.7
\nwget http:\/\/www.securixlive.com\/download\/barnyard2\/barnyard2-1.7.tar.gz<\/code><\/p>\n

Setup Snort<\/strong>
\napt-get install snort-mysql<\/code>
\nI used my local LAN (10.4.0.0\/24)
\nClick OK
\nYES – you do want to setup a database for snort-mysql
\nClick OK
\n\"\"<\/a><\/p>\n

mysql -u root -p<\/code>
\nMy password is still password<\/p>\n

create database snort;<\/code>
\ngrant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort@localhost;<\/code>
\nSET PASSWORD FOR snort@localhost=PASSWORD('yourpasswordhere');<\/code>
\nexit<\/code>
\nI used password once again for the password.<\/p>\n

cd \/usr\/share\/doc\/snort-mysql\/<\/code>
\nImport the snort DB schema
\nzcat create_mysql.gz | mysql -u root -p snort<\/code><\/p>\n

Verify that the import went well
\nmysql -u root -ppassword<\/code>
\nSHOW DATABASES;<\/code>
\nuse snort;<\/code>
\nSHOW TABLES;<\/code>
\nYou should see 16 rows in the set. If not, then you did something wrong.
\nexit<\/code>
\n
\nEdit snort.conf<\/strong>
\nnano \/etc\/snort\/snort.conf<\/code><\/p>\n

Find “var HOME_NET any”, and change it to “var HOME_NET $eth0_ADDRESS<\/code>”
\nFind “Output log_tcpdump: tcpdump.log” and change it to “#Output log_tcpdump: tcpdump.log<\/code>”
\nFind “output log_unified” and insert “output unified2: filename snort.log, limit 128<\/code>” below it.
\nsave and exit<\/p><\/blockquote>\n

You’re now done installing snort!<\/p>\n

Setting up BASE and ABOdb<\/strong>
\npear install --alldeps Mail<\/code>
\npear install --alldeps Mail_Mime<\/code>
\npear install --alldeps Image_Canvas-0.3.2<\/code>
\npear install --alldeps Image_Graph-0.7.2<\/code><\/p>\n

Navigate to your snortfiles folder
\ncd<\/code>
\ncd snortfiles<\/code>
\ntar -zxvf adodb4991.tgz<\/code>
\ntar -zxvf base-1.4.5.tar.gz<\/code>
\nmv adodb \/var\/www<\/code>
\nmv base-1.4.5 \/var\/www<\/code><\/p>\n

nano \/etc\/php5\/apache2\/php.ini<\/code><\/p>\n

Find “Dynamic Extensions” and add the following to the end of that section:
\nextension=mysql.so<\/code>
\nextension=gd.so<\/code>
\nFind “error_reporting = E_ALL & ~E_DEPRECATED”
\nReplace with error_reporting = E_ALL & ~E_NOTICE<\/code>
\nsave and exit<\/p><\/blockquote>\n

nano \/etc\/apache2\/apache2.conf<\/code>
\nInsert the following at the very bottom of the file: “servername snortsvr.local<\/code>”
\nsave and exit<\/p>\n

apache2ctl restart<\/code><\/p>\n

cd \/var\/www<\/code>
\nln -s base-1.4.5 .\/base<\/code>
\nchmod a+w base<\/code><\/p>\n

Open up a web browser and navigate to http:\/\/IPADDRESSOFYOURSERVER\/base<\/p>\n

1.) Set the path to adodb to \/var\/www\/adodb
\n2.) Database Name=snort
\nDatabase Host=localhost
\nDatabase User=snort,
\nDatabase Password=yourpassword
\n3.) check use authentication system
\nAdmin User Name=snort
\nPassword=yourpassword
\nFull Name=snort
\n4.) Click \u00e2\u20ac\u0153Create BASE AG\u00e2\u20ac\u009d and click on “step 5”
\n5.) Test your login and password and verify everything is working OK<\/p><\/blockquote>\n

chmod og-w base<\/code><\/p>\n

Setting up Barnyard2<\/strong><\/p>\n

Find where you downloaded Barnyard2-1.7.tar.gz (Home directory anyone? cd ~)<\/p>\n

tar -zxvf barnyard2-1.7.tar.gz<\/code>
\ncd barnyard2-1.7<\/code>
\n.\/configure --with-mysql && make && make install<\/code>
\ncp etc\/barnyard2.conf \/etc\/snort<\/code>
\nmkdir \/var\/log\/barnyard2<\/code><\/p>\n

nano \/etc\/snort\/barnyard2.conf<\/code>
\nFind “#config hostname: thor” and change it to “config hostname: localhost<\/code>”
\nFind “#config interface: eth0” and change it to “config interface: eth0<\/code>”
\nFind “output database” and insert below that line “output database: alert, mysql, user=snort password=password dbname=snort host=localhost<\/code>”
\nSave and exit<\/p>\n

Starting Snort\/Barnyard<\/strong>
\nsnort -c \/etc\/snort\/snort.conf -i eth0<\/code>
\nIf you see “Not Using PCAP_FRAMES” you’re doing OK!<\/p>\n

Open up another Putty session and SSH to your server as root.
\nls -la \/var\/log\/snort<\/code>
\nLook for a 10 digit suffix on snort.log. If you have more than one file with digits, look at the timestamp and grab the newest one!
\n\"\"<\/a>
\nnano \/var\/log\/snort\/barnyard.waldo<\/code>
\nPaste in the following:<\/p>\n

\/var\/log\/snort<\/code>
\nsnort.log<\/code?\n10DIGIT NUMBER FROM YOUR SNORT LOG STEP ABOVE<\/code>
\n0<\/code>
\n\"\"<\/a>
\nsave and exit\n<\/p><\/blockquote>\n

Run this SINGLE LINE command:
\n\/usr\/local\/bin\/barnyard2 -c \/etc\/snort\/barnyard2.conf -G \/etc\/snort\/gen-msg.map -S \/etc\/snort\/sid-msg.map -d \/var\/log\/snort -f snort.log -w \/var\/log\/snort\/barnyard.waldo<\/code><\/p>\n

Ping your server a few times. Then open up your browser to http:\/\/YOURSERVERIPADDRESS\/base and see if anything shows up.<\/p>\n

Auto Starting Snort<\/Strong>
\nControl + C out of either Snort or Barnyard. Then reboot the server.
\nreboot<\/code><\/p>\n

Log back into your server as root using SSH\/Putty.
\nps -A | grep snort<\/code>
\nIf nothing shows up (which nothing should), then continue on.
\n\/etc\/init.d\/snort start<\/code>
\n\"\"<\/a><\/p>\n

mv \/etc\/snort\/db-pending-config \/etc\/snort\/db-pending-config.orig<\/code>
\n\/etc\/init.d\/snort start<\/code>
\n\"\"<\/a><\/p>\n

nano \/etc\/init\/barnyard2.conf<\/code><\/p>\n

# rc - System V runlevel compatibility<\/code>
\n# This task runs the old System V-style rc script when changing between<\/code>
\n# runlevels.<\/code>
\ndescription \"Barnyard2 for Snort support\"<\/code>
\nauthor \"bil b@unc.edu\"<\/code>
\nstart on started networking<\/code>
\n#start on startup<\/code>
\n#start on (startup<\/code>
\n# and filesystem<\/code>
\n# and started udev)<\/code>
\n#stop on runlevel [!023456]<\/code>
\nrespawn<\/code>
\nexec \/usr\/local\/bin\/barnyard2 \\<\/code>
\n -c \/etc\/snort\/barnyard2.conf \\<\/code>
\n -G \/etc\/snort\/gen-msg.map \\<\/code>
\n -S \/etc\/snort\/sid-msg.map \\<\/code>
\n -d \/var\/log\/snort -f snort.log \\<\/code>
\n -w \/var\/log\/snort\/barnyard.waldo<\/code>
\nsave and exit
\nreboot<\/code>\n<\/p><\/blockquote>\n

\"\"<\/a><\/p>\n

Verify Everything Is Working<\/strong><\/p>\n

After your server reboots, log back into it via SSH as root.<\/p>\n

ps -A | grep snort
\nps -A | grep barnyard
\nAs long as you see the process ID and the name, you should be OK. You can check that barnyard will auto restart by killing the process ID and then checking to see if it's running. It should have a new ID afterwards.
\n\"\"<\/a><\/p>\n

***EDIT***
\nI found a much easier solution - install Snorby. Snorby is a pretty nice front-end for Snort. Barnyard is still utilized to take the load off of Snort.
\nYou can grab the All In One solution (installs the OS, MySQL, Snort, Apache, Barnyard, Snorby, Etc) here:
\nhttp:\/\/bailey.st\/blog\/snorby-spsa\/<\/a>
\nSupposedly it auto updates once a day with Oinkmaster, but I haven't really gone through to verify yet. It'd be nice if some of the options were included in the GUI, but for free who am I to complain?<\/p>\n","protected":false},"excerpt":{"rendered":"

My company recently removed a Cisco IPS device (pile of crap) along with a Microsoft 2006 ISA Server (more of a pile of crap) from the network infrastructure. It cost too much to maintain licensing, and it was starting to become a huge headache for company growth. However, the director of IT requested that we … Continue reading Installing SNORT on Ubuntu 10.04<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-515","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts\/515","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/comments?post=515"}],"version-history":[{"count":20,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts\/515\/revisions"}],"predecessor-version":[{"id":521,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts\/515\/revisions\/521"}],"wp:attachment":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/media?parent=515"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/categories?post=515"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/tags?post=515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}