[Day 8] 2. SNORT on Linux (LAB 2)

1. Installing Dependencies

Run the following command to install necessary dependencies:

bash
sudo apt-get install -y bison ca-certificates flex gcc libdumbnet-dev libluajit-5.1-dev libnghttp2-dev libpcap-dev libpcre3-dev libssl-dev make openssl wget zlib1g-dev

2. Install DAQ Library

The

DAQ

library is required for Snort. Install it as follows:

bash
sudo mkdir -p /usr/src/snort_src
sudo cp daq-2.0.7.tar.gz /usr/src/snort_src/
cd /usr/src/snort_src
sudo tar -zxf daq-2.0.7.tar.gz
cd daq-2.0.7
sudo ./configure
sudo make
sudo make install
sudo ldconfig

3. Snort Installation Preparation

Create a soft link for the

netconfig.h

file:

bash
sudo ln -s /usr/include/tirpc/netconfig.h /usr/include

4. Install Required Header Files

The following header files are needed for Snort:

plaintext
rpc.h
types.h
xdr.h
auth.h
clnt_stat.h
clnt.h
clnt_soc.h
rpc_msg.h
auth_unix.h
auth_des.h
svc_auth.h
svc.h
svc_soc.h
pmap_clnt.h
pmap_prot.h
rpcb_clnt.h
rpcb_prot.h
svc_mt.h
rpcent.h

You can either link each file individually or use:

bash
sudo ln -s /usr/include/tirpc/rpc/*.h /usr/include/rpc

5. Download and Install Snort

Download the Snort installer:

bash
cd
wget http://192.168.0.52/sw/security_tools/ids/snort/snort-2.9.20.tar.gz
sudo cp snort-2.9.20.tar.gz /usr/src/snort_src
cd /usr/src/snort_src
sudo tar -zxf snort-2.9.20.tar.gz
cd snort-2.9.20
ls
sudo ./configure
sudo make 
sudo make install

6. Verify Snort Installation

Check the installation of Snort:

bash
snort -V

7. Running Snort in Packet Capture Mode

Run Snort in capture mode on interface

ens33

bash
sudo snort -i ens33

8. Create Snort Group and User

Create a user and group for Snort:

bash
sudo groupadd snort
sudo useradd snort -r -s /usr/sbin/nologin -c SNORT_IDS -g snort
sudo mkdir -p /etc/snort/rules
sudo mkdir /var/log/snort
sudo mkdir /usr/local/lib/snort_dynamicrules

9. Copy Configuration Files

Copy the necessary configuration files from the Snort source:

bash
sudo cp /usr/src/snort_src/snort-2.9.20/etc/*.conf* /etc/snort/
sudo cp /usr/src/snort_src/snort-2.9.20/etc/*.map /etc/snort/

10. Create Rule Files

Create the necessary rule files:

bash
sudo touch /etc/snort/rules/{white_list,black_list,local}.rules
tree /etc/snort/rules

11. Set Permissions

Set permissions for the Snort directories and files:

bash
sudo chmod -R 5775 /etc/snort/
sudo chmod -R 5775 /var/log/snort
sudo chmod -R 5775 /usr/local/lib/snort_dynamicrules

sudo chown -R snort:snort /etc/snort/
sudo chown -R snort:snort /var/log/snort
sudo chown -R snort:snort /usr/local/lib/snort_dynamicrules/

12. Edit Snort Configuration File

Edit the Snort configuration file:

bash
sudo vim /etc/snort/snort.conf

Make the following changes:

plaintext
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules

And define the list paths:

plaintext
var WHITE_LIST_PATH /etc/snort/rules
var BLACK_LIST_PATH /etc/snort/rules

Include these rules in the Snort configuration file:

plaintext
include $RULE_PATH/local.rules
include $RULE_PATH/white_list.rules
include $RULE_PATH/black_list.rules

Comment all the other lines starting with

include $RULE_PATH

13. Test Configuration Files

Test the Snort configuration:

bash
sudo snort -T -c /etc/snort/snort.conf

14. Add a Local Rule

Edit the

local.rules