Test hosting on UpCloud!<\/a><\/div>\n<\/div>\n\n\n\n
Setting up a basic configuration of Snort on CentOS is fairly simple but takes a few steps to complete. You will first need to install all the prerequisite software to ready your cloud server for installing Snort itself. Install the required libraries with the following command.<\/p>\n\n\n\n
sudo yum install -y gcc flex bison zlib libpcap pcre libdnet tcpdump<\/pre>\n\n\n\nThe latest Snort version at this time also requires libnghttp2<\/tt> which can be downloaded from the Extra Packages for Enterprise Linux (EPEL) and installed using the commands underneath.<\/p>\n\n\n\nsudo yum install -y https:\/\/dl.fedoraproject.org\/pub\/epel\/epel-release-latest-7.noarch.rpm\nsudo yum install -y libnghttp2<\/pre>\n\n\n\nWith the prerequisites fulfilled, next up is how to install Snort on CentOS 7. Snort can be installed with ready-built packages, which simplifies the setup process considerably, and allows you to install Snort easily with yum<\/tt>. Alternatively, you can download and install the Snort on CentOS manually from the source. Below you will find instructions for both of these methods.<\/p>\n\n\n\nOption 1. Installing with yum<\/h2>\n\n\n\nSnort provides convenient rpm<\/tt> packets for CentOS 7, which can be installed simply with the commands below. Snort itself uses something called a Data Acquisition library (DAQ) to make abstract calls to packet capture libraries. Check the latest version number on the Snort front page<\/a>, if a newer version of DAQ or Snort is available simply replace the version number in the following commands with the latest option.<\/p>\n\n\n\n
sudo yum install https:\/\/www.snort.org\/downloads\/snort\/daq-2.0.6-1.centos7.x86_64.rpm<\/pre>\n\n\n\nsudo yum install https:\/\/www.snort.org\/downloads\/snort\/snort-2.9.12-1.centos7.x86_64.rpm<\/pre>\n\n\n\nOnce you are done with the installation, jump forward to the configuration to continue.<\/p>\n\n\n\nOption 2. Installing from the source<\/h2>\n\n\n\nSetting up Snort on CentOS from the source code consists of a couple of steps: downloading the code, configuring it, compiling the code, installing it to an appropriate directory, and lastly configuring the detection rules.<\/p>\n\n\n\n
Before getting started, you will also need the following development packages in addition to the already install prerequisites.<\/p>\n\n\n\nsudo yum install -y zlib-devel libpcap-devel pcre-devel libdnet-devel openssl-devel libnghttp2-devel luajit-devel\n<\/pre>\n\n\n\nWhen ready, make a temporary download folder to your home directory and then change into it with the command below.<\/p>\n\n\n\nmkdir ~\/snort_src && cd ~\/snort_src<\/pre>\n\n\n\nDownload the latest DAQ source package from the Snort website with the wget<\/tt> command underneath. Replace the version number in the command if a newer source is available.<\/p>\n\n\n\nwget https:\/\/www.snort.org\/downloads\/snort\/daq-2.0.6.tar.gz<\/pre>\n\n\n\nThe download will only take a few seconds when complete extract the source code and jump into the new directory with the following commands.<\/p>\n\n\n\ntar -xvzf daq-2.0.6.tar.gz\ncd daq-2.0.6<\/pre>\n\n\n\nRun the configuration script using its default values, then compile the program with make and finally install DAQ.<\/p>\n\n\n\n.\/configure && make && sudo make install<\/pre>\n\n\n\nWith the DAQ installed, you can get started with Snort, change back to the download folder.<\/p>\n\n\n\ncd ~\/snort_src<\/pre>\n\n\n\nNext, download the Snort source code with wget<\/tt>. Check the latest version number from the Snort website and replace it in the following command if necessary.<\/p>\n\n\n\n
wget https:\/\/www.snort.org\/downloads\/snort\/snort-2.9.12.tar.gz<\/pre>\n\n\n\nOnce the download is complete, extract the source and change into the new directory with these commands.<\/p>\n\n\n\n
tar -xvzf snort-2.9.12.tar.gz\ncd snort-2.9.12<\/pre>\n\n\n\nThen configure the installation with sourcefire<\/tt> enabled, run make and make install.<\/p>\n\n\n\n
.\/configure --enable-sourcefire && make && sudo make install<\/pre>\n\n\n\nWith that done, continue below on how to set up the configuration files.<\/p>\n\n\n\n
Configuring Snort to run in NIDS mode<\/h2>\n\n\n\nNext, you will need to set up Snort for your system. This includes editing some configuration files, downloading the rules that Snort will follow, and taking Snort for a test run.<\/p>\n\n\n\n
Start with updating the shared libraries using the command underneath.<\/p>\n\n\n\n
sudo ldconfig<\/pre>\n\n\n\nSnort on CentOS gets installed to \/usr\/local\/bin\/snort<\/tt> directory, it is good practice to create a symbolic link to \/usr\/sbin\/snort<\/tt>.<\/p>\n\n\n\n
If you installed Snort with yum<\/tt> you can skip this command.<\/p>\n\n\n\n
sudo ln -s \/usr\/local\/bin\/snort \/usr\/sbin\/snort<\/pre>\n\n\n\nSetting up username and folder structure<\/h2>\n\n\n\nTo run Snort on CentOS safely without root access, you should create a new unprivileged user and a new user group for the daemon to run under.<\/p>\n\n\n\n
sudo groupadd snort\nsudo useradd snort -r -s \/sbin\/nologin -c SNORT_IDS -g snort<\/pre>\n\n\n\nThen create the folder structure to house the Snort configuration, just copy over the commands below. If you installed Snort using yum<\/tt>\u00a0these directories should have already been added at installation, but check to make sure.<\/p>\n\n\n\n
sudo mkdir -p \/etc\/snort\/rules\nsudo mkdir \/var\/log\/snort\nsudo mkdir \/usr\/local\/lib\/snort_dynamicrules<\/pre>\n\n\n\nSet the permissions for the new directories accordingly.<\/p>\n\n\n\n
sudo chmod -R 5775 \/etc\/snort\nsudo chmod -R 5775 \/var\/log\/snort\nsudo chmod -R 5775 \/usr\/local\/lib\/snort_dynamicrules\nsudo chown -R snort:snort \/etc\/snort\nsudo chown -R snort:snort \/var\/log\/snort\nsudo chown -R snort:snort \/usr\/local\/lib\/snort_dynamicrules<\/pre>\n\n\n\nCreate new files for the white and blacklists as well as the local rules.<\/p>\n\n\n\n
sudo touch \/etc\/snort\/rules\/white_list.rules\nsudo touch \/etc\/snort\/rules\/black_list.rules\nsudo touch \/etc\/snort\/rules\/local.rules<\/pre>\n\n\n\nThen if you installed Snort from the source code, copy over the configuration files from the download folder. Skip this if you installed Snort with yum<\/tt>.<\/p>\n\n\n\n
sudo cp ~\/snort_src\/snort-2.9.12\/etc\/*.conf* \/etc\/snort\nsudo cp ~\/snort_src\/snort-2.9.12\/etc\/*.map \/etc\/snort<\/pre>\n\n\n\nNext up, you will need to download the detection rules Snort will follow to identify potential threats. Snort provides three tiers of rule sets, community, registered and subscriber rules.<\/p>\n\n\n\n
\nCommunity rules are freely available though slightly limited.<\/li>\n\n\n\n
By registering for free on their website you get access to your Oink code, which lets you download the registered user’s rule sets.<\/li>\n\n\n\n
Lastly, subscriber rules are just that, available to users with an active subscription to Snort services.<\/li>\n<\/ul>\n\n\n\nUnderneath you can find instructions for downloading both community rules and registered user rule sets.<\/p>\n\n\n\n
Option 1. Using community rules<\/h2>\n\n\n\nIf you just want to quickly test out Snort, grab the community rules using wget<\/tt> with the command below.<\/p>\n\n\n\n
wget https:\/\/www.snort.org\/rules\/community -O ~\/community.tar.gz<\/pre>\n\n\n\nExtract the rules and copy them to your configuration folder.<\/p>\n\n\n\n
sudo tar -xvf ~\/community.tar.gz -C ~\/<\/pre>\n\n\n\nsudo cp ~\/community-rules\/* \/etc\/snort\/rules<\/pre>\n\n\n\nBy default, Snort on CentOS expects to find a number of different rule files which are not included in the community rules. Comment out the unnecessary lines using the next command.<\/p>\n\n\n\n
sudo sed -i 's\/include $RULE_PATH\/#include $RULE_PATH\/' \/etc\/snort\/snort.conf<\/pre>\n\n\n\nOption 2. Obtaining registered user rules<\/h2>\n\n\n\nYou can also take a moment and register<\/a> on the Snort website. Registering gives you access to use their Oink code to download the registered user rules. You can find the code in the Snort user account details.<\/p>\n\n\n\n
Replace the oinkcode<\/tt><\/span> in the following command with your personal code.<\/p>\n\n\n\n
wget https:\/\/www.snort.org\/rules\/snortrules-snapshot-29120.tar.gz?oinkcode=oinkcode<\/span> -O ~\/registered.tar.gz<\/pre>\n\n\n\nOnce downloaded, extract the rules and copy them over to your configuration directory.<\/p>\n\n\n\nsudo tar -xvf ~\/registered.tar.gz -C \/etc\/snort<\/pre>\n\n\n\nThe rule sets for the registered users include an extensive amount of useful preconfigured detection rules. If you tried out Snort with the community rules first, you can enable additional rules by uncommenting their inclusions towards the end of the snort.conf<\/tt> file.<\/p>\n\n\n\nConfiguring the network and rule sets<\/h2>\n\n\n\nWith the configuration and rule files in place, edit the snort.conf<\/tt> to modify a few parameters. Open the configuration file for editing with the following command.<\/p>\n\n\n\nsudo vi \/etc\/snort\/snort.conf<\/pre>\n\n\n\nFind these sections shown below in the configuration file and change the parameters to reflect the examples here.<\/p>\n\n\n\n# Setup the network addresses you are protecting\nipvar HOME_NET server_public_ip<\/span>\/32<\/pre>\n\n\n\n# Set up the external network addresses. Leave as \"any\" in most situations\nipvar EXTERNAL_NET !$HOME_NET\n<\/pre>\n\n\n\n# Path to your rules files (this can be a relative path)\nvar RULE_PATH \/etc\/snort\/rules\nvar SO_RULE_PATH \/etc\/snort\/so_rules\nvar PREPROC_RULE_PATH \/etc\/snort\/preproc_rules<\/pre>\n\n\n\n# Set the absolute path appropriately\nvar WHITE_LIST_PATH \/etc\/snort\/rules\nvar BLACK_LIST_PATH \/etc\/snort\/rules<\/pre>\n\n\n\nIn the same snort.conf file, scroll down to section 6 and set the output for unified2 to log under the filename of snort.log<\/tt> like below.<\/p>\n\n\n\n# unified2\n# Recommended for most installs\noutput unified2: filename snort.log, limit 128<\/pre>\n\n\n\nLastly, scroll down towards the bottom of the file to find the list of included rule sets. You will need to uncomment the local.rules<\/tt> to allow Snort to load any custom rules.<\/p>\n\n\n\n
include $RULE_PATH\/local.rules<\/pre>\n\n\n\nIf you are using the community rules, add the line underneath to your ruleset as well, for example just below your local.rules<\/tt> line.<\/p>\n\n\n\n
include $RULE_PATH\/community.rules<\/pre>\n\n\n\nOnce you are done with the configuration file, save the changes and exit the editor.<\/p>\n\n\n\n
Validating settings<\/h2>\n\n\n\nYour Snort should now be ready to run. Test the configuration using the parameter -T<\/tt> to enable test mode and validate the configuration.<\/p>\n\n\n\n
sudo snort -T -c \/etc\/snort\/snort.conf<\/pre>\n\n\n\nIf you get an error while loading shared libdnet.1 libraries, create the following link and try again.<\/p>\n\n\n\n
ln -s \/usr\/lib64\/libdnet.so.1.0.1 \/usr\/lib64\/libdnet.1<\/pre>\n\n\n\nAfter running the Snort configuration test, you should get a message like this example below.<\/p>\n\n\n\n
        --== Initialization Complete ==--\n\n   ,,_     -*> Snort! <*-\n  o\"  )~   Version 2.9.12 GRE (Build 325)\n   ''''    By Martin Roesch & The Snort Team: http:\/\/www.snort.org\/contact#team\n           Copyright (C) 2014-2018 Cisco and\/or its affiliates. All rights reserved.\n           Copyright (C) 1998-2013 Sourcefire, Inc., et al.\n           Using libpcap version 1.5.3\n           Using PCRE version: 8.32 2012-11-30\n           Using ZLIB version: 1.2.7\n\n           Rules Engine: SF_SNORT_DETECTION_ENGINE  Version 3.0  \n           Preprocessor Object: appid  Version 1.1  \n           Preprocessor Object: SF_DNP3  Version 1.1  \n           Preprocessor Object: SF_MODBUS  Version 1.1  \n           Preprocessor Object: SF_GTP  Version 1.1  \n           Preprocessor Object: SF_REPUTATION  Version 1.1  \n           Preprocessor Object: SF_SIP  Version 1.1  \n           Preprocessor Object: SF_SDF  Version 1.1  \n           Preprocessor Object: SF_DCERPC2  Version 1.0  \n           Preprocessor Object: SF_SSLPP  Version 1.1  \n           Preprocessor Object: SF_DNS  Version 1.1  \n           Preprocessor Object: SF_SSH  Version 1.1  \n           Preprocessor Object: SF_SMTP  Version 1.1  \n           Preprocessor Object: SF_IMAP  Version 1.0  \n           Preprocessor Object: SF_POP  Version 1.0  \n           Preprocessor Object: SF_FTPTELNET  Version 1.2  \n\nSnort successfully validated the configuration!\nSnort exiting\n<\/pre>\n\n\n\nIn case you get an error, the printout should tell you what the problem was and where to fix it. Most likely problems are missing files or folders, which you can usually resolve by either adding any you might have missed in the setup above or by commenting out unnecessary inclusion lines in the snort.conf<\/tt>\u00a0file. Check the configuration part and try again.<\/p>\n\n\n\n
Testing the configuration<\/h2>\n\n\n\nTo test if Snort is logging alerts as intended, add a custom detection rule alert on incoming ICMP connections to the local.rules<\/tt> file. Open your local rules in a text editor.<\/p>\n\n\n\n
sudo vi \/etc\/snort\/rules\/local.rules<\/pre>\n\n\n\nThen add the following line to the file.<\/p>\n\n\n\n
alert icmp any any -> $HOME_NET any (msg:\"ICMP test\"; sid:10000001; rev:001;)<\/pre>\n\n\n\nThe rule consists of the following parts:<\/p>\n\n\n\n
\naction for traffic matching the rule, alert in this case<\/li>\n\n\n\n
traffic protocol like TCP, UDP or ICMP like here<\/li>\n\n\n\n
the source address and port, simply marked as any to include all addresses and ports<\/li>\n\n\n\n
the destination address and port, $HOME_NET<\/tt> as declared in the configuration and any port<\/li>\n\n\n\n
some additional bits\n\nlog message<\/li>\n\n\n\n
unique rule identifier (sid) which for local rules needs to be 1000001 or higher<\/li>\n\n\n\n
rule version number.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\nSave the local.rules<\/tt> and exit the editor. You then need to restart Snort since you made changes to the files it loads.<\/p>\n\n\n\n
Start Snort with -A console<\/tt>\u00a0option to print the alerts to stdout<\/tt>.\u00a0You will need to select the correct network interface with the public IP address of your server, for example, eth0<\/tt>.<\/p>\n\n\n\n
sudo snort -A console -i eth0 -u snort -g snort -c \/etc\/snort\/snort.conf<\/pre>\n\n\n\nIf you are not sure which interface to use, check your UpCloud control panel<\/a> for the public IPv4 address of your server in the Network settings<\/a>. You can also use the following command on your server.<\/p>\n\n\n\n
ip addr<\/pre>\n\n\n\nThe output will list all of your currently configured network interfaces. Find the one with the same public IP address as shown in the Network settings, commonly eth0<\/tt>.<\/p>\n\n\n\n
With Snort up and running ping your cloud server from any other computer. You should see a notice for each ICMP call in the terminal running Snort.<\/p>\n\n\n\n07\/12-11:20:33.501624  [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 83.136.252.118 -> 80.69.173.202<\/pre>\n\n\n\nAfter the alerts show up you can stop Snort with ctrl+C<\/tt>.<\/p>\n\n\n\n
Snort records the alerts to a log under \/var\/log\/snort\/snort.log.timestamp<\/span><\/tt>, where the time stamp is the point in time when Snort was started marked in Unix time. You can read the logs with the command underneath. Since you have only run Snort once, there is only one log, complete your command by pressing TAB.<\/p>\n\n\n\nsnort -r \/var\/log\/snort\/snort.log.<\/pre>\n\n\n\nThe log shows a warning for each ICMP call with source and destination IPs, time and date, plus some additional info as shown in the example below.<\/p>\n\n\n\nWARNING: No preprocessors configured for policy 0.\n07\/12-11:20:33.501624 83.136.252.118 -> 80.69.173.202\nICMP TTL:63 TOS:0x0 ID:20187 IpLen:20 DgmLen:84 DF\nType:8 Code:0 ID:13891 Seq:1 ECHO<\/pre>\n\n\n\nRunning Snort in the background<\/h2>\n\n\n\nLastly, if you wish to run Snort on CentOS as a service in the background you should download a startup script from Snort documentation.<\/p>\n\n\n\n
If you installed Snort using yum, you should already have the startup script configured. Start the service as described below.<\/p>\n\n\n\n
Use the following commands to get and install a startup script for your system.<\/p>\n\n\n\nwget https:\/\/www.snort.org\/documents\/snort-startup-script-for-centos -O ~\/snortd\nsudo chmod 755 ~\/snortd && sudo mv ~\/snortd \/etc\/init.d\/<\/pre>\n\n\n\nNext, reload the system daemon.<\/p>\n\n\n\nsudo systemctl daemon-reload<\/pre>\n\n\n\nThen start the service.<\/p>\n\n\n\nsudo systemctl start snortd<\/pre>\n\n\n\nThe startup script also includes the other usual systemctl<\/tt> commands: stop<\/tt>, restart<\/tt>, and status<\/tt>. For example, you can check the status of the service with the following command.<\/p>\n\n\n\nsudo systemctl status snortd<\/pre>\n\n\n\nConclusions<\/h2>\n\n\n\nCongratulations, you should have now successfully configured and tested a network-based intrusion detection system. This guide however only covers the very basics with an introduction to Snort and NIDS in general. To get more out of your installation, check out the deployment guides over at the Snort documents page<\/a>, or jump right into writing your own detection rules with their helpful Snort rules info graph<\/a>.<\/p>\n","protected":false},"featured_media":8908,"comment_status":"open","ping_status":"closed","template":"","community-category":[111,113,121],"class_list":["post-24614","tutorial","type-tutorial","status-publish","has-post-thumbnail","hentry","community-category-networking","community-category-integrations","community-category-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial\/24614","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial"}],"about":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/types\/tutorial"}],"replies":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/comments?post=24614"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media\/8908"}],"wp:attachment":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media?parent=24614"}],"wp:term":[{"taxonomy":"community-category","embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/community-category?post=24614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}