Lastly, scroll down towards the bottom of the file to find the list of included rule sets. You will need to uncomment the local.rules<\/tt> to allow Snort to load any custom rules.<\/p>\r\n\r\n\r\n\r\n

include $RULE_PATH\/local.rules<\/pre>\r\n\r\n\r\n\r\n
If you are using the community rules, add the line underneath to your ruleset as well, for example just below your local.rules<\/tt> line.<\/p>\r\n\r\n\r\n\r\n
include $RULE_PATH\/community.rules<\/pre>\r\n\r\n\r\n\r\n
Once you are done with the configuration file, save the changes and exit the editor.<\/p>\r\n\r\n\r\n\r\n
Validating settings<\/h2>\r\n\r\n\r\n\r\n
Your Snort should now be ready to run. Test the configuration using the parameter -T<\/tt> to enable test mode.<\/p>\r\n\r\n\r\n\r\n
sudo snort -T -c \/etc\/snort\/snort.conf<\/pre>\r\n\r\n\r\n\r\n
After running the Snort configuration test, you should get a message like this example below.<\/p>\r\n\r\n\r\n\r\n
        --== Initialization Complete ==--\r\n\r\n   ,,_     -*> Snort! <*-\r\n  o\"  )~   Version 2.9.16 GRE (Build 118) \r\n   ''''    By Martin Roesch & The Snort Team: http:\/\/www.snort.org\/contact#team\r\n           Copyright (C) 2014-2020 Cisco and\/or its affiliates. All rights reserved.\r\n           Copyright (C) 1998-2013 Sourcefire, Inc., et al.\r\n           Using libpcap version 1.8.1\r\n           Using PCRE version: 8.39 2016-06-14\r\n           Using ZLIB version: 1.2.11\r\n\r\n           Rules Engine: SF_SNORT_DETECTION_ENGINE  Version 3.1  \r\n           Preprocessor Object: SF_DCERPC2  Version 1.0  \r\n           Preprocessor Object: SF_SSH  Version 1.1  \r\n           Preprocessor Object: SF_FTPTELNET  Version 1.2  \r\n           Preprocessor Object: SF_SDF  Version 1.1  \r\n           Preprocessor Object: SF_DNP3  Version 1.1  \r\n           Preprocessor Object: SF_REPUTATION  Version 1.1  \r\n           Preprocessor Object: SF_IMAP  Version 1.0  \r\n           Preprocessor Object: SF_SMTP  Version 1.1  \r\n           Preprocessor Object: SF_GTP  Version 1.1  \r\n           Preprocessor Object: appid  Version 1.1  \r\n           Preprocessor Object: SF_MODBUS  Version 1.1  \r\n           Preprocessor Object: SF_POP  Version 1.0  \r\n           Preprocessor Object: SF_DNS  Version 1.1  \r\n           Preprocessor Object: SF_SSLPP  Version 1.1  \r\n           Preprocessor Object: SF_SIP  Version 1.1  \r\n\r\nSnort successfully validated the configuration!\r\nSnort exiting<\/pre>\r\n\r\n\r\n\r\n
In case you get an error, the printout should tell you what the problem was and where to fix it. Most likely problems are missing files or folders, which you can usually resolve by either adding any you might have missed in the setup above or by commenting out unnecessary inclusion lines in the snort.conf<\/tt>\u00a0file. Check the configuration part and try again.<\/p>\r\n\r\n\r\n\r\n
Testing the configuration<\/h2>\r\n\r\n\r\n\r\n
To test if Snort is logging alerts as intended, add a custom detection rule alert on incoming ICMP connections to the local.rules<\/tt> file. Open your local rules in a text editor.<\/p>\r\n\r\n\r\n\r\n
sudo nano \/etc\/snort\/rules\/local.rules<\/pre>\r\n\r\n\r\n\r\n
Then add the following line to the file.<\/p>\r\n\r\n\r\n\r\n
alert icmp any any -> $HOME_NET any (msg:\"ICMP test\"; sid:10000001; rev:001;)<\/pre>\r\n\r\n\r\n\r\n
The rule consists of the following parts:<\/p>\r\n\r\n\r\n\r\n
\r\n
action for traffic matching the rule, alert in this case<\/li>\r\n\r\n\r\n\r\n
traffic protocol like TCP, UDP or ICMP like here<\/li>\r\n\r\n\r\n\r\n
the source address and port, simply marked as any to include all addresses and ports<\/li>\r\n\r\n\r\n\r\n
the destination address and port, $HOME_NET<\/tt> as declared in the configuration and any port<\/li>\r\n\r\n\r\n\r\n
some additional bits\r\n
\r\n
log message<\/li>\r\n\r\n\r\n\r\n
unique rule identifier (sid) which for local rules needs to be 1000001 or higher<\/li>\r\n\r\n\r\n\r\n
rule version number.<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n
Save the local.rules<\/tt> and exit the editor.<\/p>\r\n\r\n\r\n\r\n
Start Snort with -A console<\/tt>\u00a0option to print the alerts to stdout<\/tt>.\u00a0You will need to select the correct network interface with the public IP address of your server, for example, eth0<\/tt>.<\/p>\r\n\r\n\r\n\r\n
sudo snort\u00a0-A console\u00a0-i eth0\u00a0-u snort -g snort -c \/etc\/snort\/snort.conf<\/pre>\r\n\r\n\r\n\r\n
If you are not sure which interface to use, check your UpCloud control panel<\/a> for the public IPv4 address of your server in the Network settings<\/a>. You can also use the following command on your server.<\/p>\r\n\r\n\r\n\r\n
ip addr<\/pre>\r\n\r\n\r\n\r\n
The output will list all of your currently configured network interfaces. Find the one with the same public IP address as shown in the Network settings, commonly eth0<\/tt>.<\/p>\r\n\r\n\r\n\r\n
With Snort up and running, ping your cloud server from any other computer. You should see a notice for each ICMP call in the terminal running Snort.<\/p>\r\n\r\n\r\n\r\n
07\/12-11:20:33.501624 \u00a0[**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 83.136.252.118 -> 80.69.173.202<\/pre>\r\n\r\n\r\n\r\n
After the alerts show up you can stop Snort with ctrl+C<\/tt>.<\/p>\r\n\r\n\r\n\r\n
Snort records the alerts to a log under \/var\/log\/snort\/snort.log.timestamp<\/span><\/tt>, where the timestamp is the point in time when Snort was started marked in Unix time. You can read the logs with the command underneath. Since you have only run Snort once, there is only one log, complete your command by pressing TAB.<\/p>\r\n\r\n\r\n\r\n
snort -r \/var\/log\/snort\/snort.log.<\/pre>\r\n\r\n\r\n\r\n
The log shows a warning for each ICMP call with source and destination IPs, time and date, plus some additional info as shown in the example below.<\/p>\r\n\r\n\r\n\r\n
WARNING: No preprocessors configured for policy 0.\r\n07\/12-11:20:33.501624 83.136.252.118 -> 80.69.173.202\r\nICMP TTL:63 TOS:0x0 ID:20187 IpLen:20 DgmLen:84 DF\r\nType:8 Code:0 ID:13891 Seq:1 ECHO<\/pre>\r\n\r\n\r\n\r\n
Running Snort in the background<\/h2>\r\n\r\n\r\n\r\n
To run Snort on Debian as a service in the background you will need to add a startup script for Snort. Open a new file in a text editor for example with the next command.<\/p>\r\n\r\n\r\n\r\n
sudo nano \/lib\/systemd\/system\/snort.service<\/pre>\r\n\r\n\r\n\r\n
Enter the following to the file, save and exit the editor.<\/p>\r\n\r\n\r\n\r\n
[Unit]\r\nDescription=Snort NIDS Daemon\r\nAfter=syslog.target network.target\r\n\r\n[Service]\r\nType=simple\r\nExecStart=\/usr\/local\/bin\/snort -q -u snort -g snort -c \/etc\/snort\/snort.conf -i eth0\r\n\r\n[Install]\r\nWantedBy=multi-user.target<\/pre>\r\n\r\n\r\n\r\n
With the service defined, reload the\u00a0systemctl<\/tt>\u00a0daemon.<\/p>\r\n\r\n\r\n\r\n
sudo systemctl daemon-reload<\/pre>\r\n\r\n\r\n\r\n
Snort can then be run with the configuration you set up using the command below.<\/p>\r\n\r\n\r\n\r\n
sudo systemctl start snort<\/pre>\r\n\r\n\r\n\r\n
The startup script also includes other usual\u00a0systemctl<\/tt> commands: stop<\/tt>, restart<\/tt>, and status<\/tt>. For example, you can check the status of the service with the following command.<\/p>\r\n\r\n\r\n\r\n
sudo systemctl status snort<\/pre>\r\n\r\n\r\n\r\n
Conclusions<\/h2>\r\n\r\n\r\n\r\n
Congratulations, you should have now successfully configured and tested a network-based intrusion detection system. This guide however only covers the very basics with an introduction to Snort and NIDS in general. To get more out of your installation, check out the deployment guides over at the Snort documents page<\/a>, or jump right into writing your own detection rules with their helpful Snort rules info graph<\/a>.<\/p>\r\n","protected":false},"featured_media":27367,"comment_status":"open","ping_status":"closed","template":"","community-category":[111,113,121],"class_list":["post-24610","tutorial","type-tutorial","status-publish","has-post-thumbnail","hentry","community-category-networking","community-category-integrations","community-category-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial\/24610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial"}],"about":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/types\/tutorial"}],"replies":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/comments?post=24610"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media\/27367"}],"wp:attachment":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media?parent=24610"}],"wp:term":[{"taxonomy":"community-category","embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/community-category?post=24610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}