ROWAREZ
rowarez hacking forum
|
Lista Forumurilor Pe Tematici
|
ROWAREZ | Reguli | Inregistrare | Login
POZE ROWAREZ
Nu sunteti logat.
|
Nou pe simpatie:
Isabela_9my
 | Femeie
24 ani
Constanta
cauta Barbat
32 - 48 ani |
|
Zaishen
Resident Elite
 Inregistrat: acum 14 ani
Postari: 449
|
|
This tutorial shows how to install and configure BASE (Basic Analysis and Security Engine) and the Snort intrusion detection system (IDS) on a Debian Sarge system. BASE provides a web front-end to query and analyze the alerts coming from a Snort IDS system. With BASE you can perform analysis of intrusions that Snort has detected on your network.
Scenario: A linux server running Debian Sarge 3.1 setup according to Falko's - The Perfect Setup - Debian Sarge (3.1).
Let's assume we have one working website ) and that the document root is: /var/www/www.example.com/web
The IP of the server is 192.168.0.5 and it's using eth0 as network interface name.
Needed programs and files
Snort
Snort rules
PCRE (Perl Compatible Regular Expressions)
LIBPCAP
BASE (Basic Analysis and Security Engine)
ADOdb (ADOdb Database Abstraction Library for PHP (and Python).)
Downloading and untaring
We need a temporary place for all the files that we are going to download, and untar.
To keep things simple we will create a directory in the /root named snorttemp. (It's obvious that this download directory can be any name and in anyplace)
Code:
cd /root
mkdir snorttemp
cd snorttemp |
Now you need to get Snort.
The latest version at the time of writing this is 2.6.0
Code:
wget http://www.snort.org/dl/current/snort-2.6.0.tar.gz |
When the download is finished untar the file:
Code:
tar -xvzf snort-2.6.0.tar.gz |
And let’s remove the tar file:
Code:
rm snort-2.6.0.tar.gz |
We also need the Snort rules!
Go to: and scroll down till you see the "Sourcefire VRT Certified Rules - The Official Snort Ruleset (unregistered user release)" rules
(If you are a member of the forum you can also download the - registered user release):
Code:
wget http://www.snort.org/pub-bin/downloads.cgi/Download/vrt_pr/snortrules-pr-2.4.tar.gz |
Move the snortrules-pr-2.4.tar.gz into the snort-2.6.0 map:
Code:
mv snortrules-pr-2.4.tar.gz /root/snorttemp/snort-2.6.0 |
and cd into snort-2.6.0:
Untar the snortrules-pr-2.4.tar.gz file:
Code:
tar -xvzf snortrules-pr-2.4.tar.gz |
Remove the tar file:
Code:
rm snortrules-pr-2.4.tar.gz |
We are done downloading the files needed to get Snort to work.
To make snort work with BASE, we need more!
PCRE - Perl Compatible Regular Expressions.
Go to: and select a download link for the pcre-6.3tar.gz file to download PCRE (at time of writing this it is pcre-6.3.tar.gz)
cd back to the snorttemp map:
and download the pcre-6.3.tar.gz file:
Code:
wget http://surfnet.dl.sourceforge.net/sourceforge/pcre/pcre-6.3.tar.gz |
Untar the file:
Code:
tar -xvzf pcre-6.3.tar.gz |
Remove the tar:
LIBPCAP
Go to: and select a download link for Libpcap (at time of writing this it is libpcap-0.9.4.tar.gz)
cd back to the snorttemp map:
and download the libpcap-0.9.4.tar.gz file:
Code:
wget http://www.tcpdump.org/release/libpcap-0.9.4.tar.gz |
Untar the file:
Code:
tar -xvzf libpcap-0.9.4.tar.gz |
Remove the file:
Code:
rm libpcap-0.9.4.tar.gz |
BASE (Basic Analysis and Security Engine )
Go to: and download the latest release (at time of writing BASE 1.2.5 (sarah))
cd back to the snorttemp map:
and download the base-1.2.5.tar.gz file:
wget
Untar the file:
Code:
tar -xvzf base-1.2.5.tar.gz |
Remove the file:
Code:
rm base-1.2.5.tar.gz |
ADOdb: (ADOdb Database Abstraction Library for PHP (and Python).)
Go to: and download the latest release (at time of writing adodb-490-for-php)
cd back to the snorttemp map:
and download the adodb490.tgz file:
Code:
wget http://surfnet.dl.sourceforge.net/sourceforge/adodb/adodb490.tgz |
Untar the file:
Code:
tar -xvzf adodb490.tgz |
Remove the file:
ls should now show the following directorys in /root/snorttemp:
adodb, base-1.2.5, libpcap-0.9.4, pcre-6.3 and snort-2.6.0
Lets start with: LIBPCAP.
Make sure that you are in the directory that you downloaded all files.
cd into the libcap map:
and make / install LIBPCAP:
Code:
./configure
make
make install |
Next is PCRE.
Again, make sure that you are in the directory that you downloaded all files.
cd into the PCRE map:
and make / install pce-6.3
Code:
./configure
make
make install |
Now it time for Snort:
Make sure that you are in the directory that you downloaded all files.
cd into the snort map:
and make / install Snort with some extra needed options!
Code:
./configure --enable-dynamicplugin --with-mysql
make
make install |
Snort needs some maps, so let’s create them:
Code:
mkdir /etc/snort
mkdir /etc/snort/rules
mkdir /var/log/snort |
Moving the Snort files from the installation map to the just created maps.
Make sure that you are in the directory that you downloaded all files.
and cd into snort-2.6.0:
and into the rules
now we copy all files from the /rules into /etc/snort/rules
Code:
cp * /etc/snort/rules |
We will do the same for the files in the install /etc folder:
Code:
cd ../etc
cp * /etc/snort |
Fixing the snort.conf
The /etc/snort/snort.conf needs some tuning to get it to work on your system!
So cd into /etc/snort:
and open snort.conf with nano (or any other 'text' editor)
change "var HOME_NET any" to "var HOME_NET 192.168.0.5/32"
change "var EXTERNAL_NET any" to "var EXTERNAL_NET !$HOME_NET"
change "var RULE_PATH ../rules" to "var RULE_PATH /etc/snort/rules"
As we made snort with the '--with-mysql' option and as BASE needs it, we also need to tell Snort what database to use.
Scroll down till you see "# output database", and remove the # in front of the line for the MySQL.
Now also change the "user", "password" and "dbname". Make a note of this as you will need it later!
Save the file and close 'nano'
Setting up the MySQL Database for Snort.
There are many ways to create the snort database.
The table layout can be found in the file create_mysql in the /root/snorttemp/snort-2.6.0/schemas directory.
Whichever way you create the database, make sure the 'user', 'password' and 'dbame' are the same as the one you set in the /etc/snort/snort.conf file!
After creating you can test snort and see if you get any errors with:
Code:
snort -c /etc/snort/snort.conf |
Exit the test with Ctrl+C
If you get no error's Snort is setup correct.
Moving ADOdb and BASE
Moving ADOdb:
cd back to the download dir
and move adodb it to the root of the www map:
Next: BASE (Basic Analysis and Security Engine )
Still in the download dir, we move the base dir into the 1st website map that you create with ISPconfig.
Code:
mv base-1.2.5 /var/www/www.example.com/web |
and cd into /var/www/www.example.com/web
Code:
cd /var/www/www.example.com/web |
To enable BASE to write the setup file we need to chmod the base-1.2.5 folder to 757:
chmod 757 base-1.2.5
BASE web page setup
Open your favorite web browser and go to:
If all is setup okay you should see the BASE Setup Program page:
Click on Continue
step 1 of 5:
Enter the path to ADODB (/var/www/adodb):
click on Submit Query
step 2 of 5:
Enter the needed info on the next screen: (leave the Use Archive Database as is):
click on Submit Query
step 3 of 5:
If you want to Use Authentication for the Base page you can do so here:
click on Submit Query
step 4 of 5:
Click on Create BASE AG to create the database.
and after Create BASE AG
Once done, click on Now continue to step 5...
To make the Graph's from BASE work you will also need to install Image_Color, Image_Canvas and Image_Graph.
To do this do:
Code:
pear install Image_Color
pear install Image_Canvas-alpha
pear install Image_Graph-alpha |
That it for BASE!
If you want you can chmod the base-1.2.5 dir back to 775:
Code:
chmod 775 base-1.2.5 |
You can also delete the snorttemp directory, and all the files in it.
Starting Snort
To start SNORT and make BASE show you the Snort's logged info, you will need to run:
Code:
/usr/local/bin/snort -c /etc/snort/snort.conf -i eth0 -g root -D |
Now wait some time and see all the Snort alerts show up in BASE.
Now wait some time and see all the Snort alerts show up in BASE.
|
|
| pus acum 14 ani |
|
