Try UpCloud for free! Deploy a server in just 45 seconds<\/a><\/p>\n Snort is one of the most commonly used network-based IDS<\/a>. It is a lightweight, open source, available on a multitude of platforms, and can be comfortably installed even on the smallest of cloud server instances. Although Snort is capable of much more than just network monitoring, this guide shows how to configure and run Snort in NIDS mode with a basic setup that you can later expand as needed.<\/p>\n Setting up a basic configuration of Snort on Ubuntu is fairly simple but takes a few steps to complete. You will first need to install all the prerequisite software to ready your cloud server for installing Snort itself. Install the required libraries with the following command.<\/p>\n With the prerequisites fulfilled, next up is how to install Snort on Ubuntu 16. Snort can be downloaded and installed manually from the source. Below you will find instructions on how to get this done.<\/p>\n Setting up Snort on Ubuntu from the source code consists of a couple of steps: downloading the code, configuring it, compiling the code, installing it to an appropriate directory, and lastly configuring the detection rules.<\/p>\n Start by making a temporary download folder to your home directory and then changing into it with the command below.<\/p>\n Snort itself uses something called Data Acquisition library (DAQ) to make abstract calls to packet capture libraries. Download the latest DAQ source package from the Snort website with the wget<\/tt> command underneath. Replace the version number in the command if a newer source available.<\/p>\n The download will only take a few seconds. When complete, extract the source code and jump into the new directory with the following commands.<\/p>\n The latest version requires an additional step to auto reconfigure DAQ before running the config. Use the command below which requires you need to have autoconf<\/tt> and libtool<\/tt> installed.<\/p>\n Afterwards, run the configuration script using its default values, then compile the program with make and finally install DAQ.<\/p>\n With the DAQ installed you can get started with Snort, change back to the download folder.<\/p>\n Next, download the Snort source code with wget<\/tt>. You can find the latest version number on the Snort downloads page<\/a>. Replace it in the following command if necessary.<\/p>\n Once the download is complete, extract the source and change into the new directory with these commands.<\/p>\n Then configure the installation with sourcefire<\/tt> enabled, run make and make install.<\/p>\n With that done, continue below on how to set up the configuration files.<\/p>\n Next, you will need to configure Snort for your system. This includes editing some configuration files, downloading the rules that Snort will follow, and taking Snort for a test run.<\/p>\n Start with updating the shared libraries using the command underneath.<\/p>\n Snort on Ubuntu gets installed to \/usr\/local\/bin\/snort<\/tt> directory, it is good practice to create a symbolic link to \/usr\/sbin\/snort<\/tt>.<\/p>\n To run Snort on Ubuntu safely without root access, you should create a new unprivileged user and a new user group for the daemon to run under.<\/p>\n Then create the folder structure to house the Snort configuration, just copy over the commands below.<\/p>\n Set the permissions for the new directories accordingly.<\/p>\n Create new files for the white and blacklists as well as the local rules.<\/p>\n Then copy the configuration files from the download folder.<\/p>\n Next up, you will need to download the detection rules Snort will follow to identify potential threats. Snort provides three tiers of rule sets, community, registered and subscriber rules.<\/p>\n Underneath you can find instructions for downloading both community rules or registered user rule sets.<\/p>\n If you just want to quickly test out Snort, grab the community rules using wget<\/tt> with the command below.<\/p>\n Extract the rules and copy them to your configuration folder.<\/p>\n By default, Snort on Ubuntu expects to find a number of different rule files which are not included in the community rules. You can easily comment out the unnecessary lines using the sed<\/tt> command underneath.<\/p>\n You can also take a moment and register<\/a> on the Snort website. Registering gives you access to use their Oink code to download the registered user rules. You can find the code in the Snort user account details.<\/p>\n Replace the oinkcode<\/tt><\/span> in the following command with your personal code.<\/p>\n Once downloaded, extract the rules over to your configuration directory.<\/p>\n The rule sets for the registered users include an extensive amount of useful preconfigured detection rules. If you tried out Snort with the community rules first, you can enable additional rules by uncommenting their inclusions towards the end of the snort.conf<\/tt> file.<\/p>\n With the configuration and rule files in place, edit the snort.conf<\/tt> to modify a few parameters. Open the configuration file in your favourite text editor, for example using nano<\/tt> with the command below.<\/p>\n Find these sections shown below in the configuration file and change the parameters to reflect the examples here.<\/p>\n In the same snort.conf file, scroll down to the section 6 and set the output for unified2 to log under filename of snort.log<\/tt> like below.<\/p>\n Lastly, scroll down towards the bottom of the file to find the list of included rule sets. You will need to uncomment the local.rules<\/tt> to allow Snort to load any custom rules.<\/p>\n If you are using the community rules, add the line underneath to your ruleset as well, for example just below your local.rules<\/tt> line.<\/p>\n Once you are done with the configuration file, save the changes and exit the editor.<\/p>\n Your Snort should now be ready to run. Test the configuration using the parameter -T<\/tt> to enable test mode.<\/p>\n After running the Snort configuration test, you should get a message like this example below.<\/p>\n In case you get an error, the print out should tell you what the problem was and where to fix it. Most likely problems are missing files or folders, which you can usually resolve by either adding any you might have missed in the setup above, or by commenting out unnecessary inclusion lines in the snort.conf<\/tt> file. Check the configuration part and try again.<\/p>\n To test if Snort is logging alerts as intended, add a custom detection rule alert on incoming ICMP connections to the local.rules<\/tt> file. Open your local rules in a text editor.<\/p>\n Then add the following line to the file.<\/p>\n The rule consists of the following parts:<\/p>\n Save the local.rules<\/tt> and exit the editor.<\/p>\n Start Snort with -A console<\/tt> options to print the alerts to stdout<\/tt>. You will need to select the correct network interface with the public IP address of your server, for example, eth0<\/tt>.<\/p>\n If you are not sure which interface to use, check your UpCloud control panel<\/a> for the public IPv4 address of your server in the Network settings<\/a>. You can also use the following command on your server.<\/p>\n The output will list all of your currently configured network interfaces. Find the one with the same public IP address as shown in the Network settings, commonly eth0<\/tt>.<\/p>\n With Snort up and running, ping your cloud server from any other computer. You should see a notice for each ICMP call in the terminal running Snort.<\/p>\n After the alerts show up you can stop Snort with ctrl+C<\/tt>.<\/p>\n Snort records the alerts to a log under \/var\/log\/snort\/snort.log.timestamp<\/span><\/tt>, where the timestamp is the point in time when Snort was started marked in Unix time. You can read the logs with the command underneath. Since you have only run Snort once, there is only one log, complete your command by pressing TAB.<\/p>\n The log shows a warning for each ICMP call with source and destination IPs, time and date, plus some additional info as shown in the example below.<\/p>\n To run Snort on Ubuntu as a service in the background you will need to add a startup script for Snort. Open a new file in a text editor for example with the next command.<\/p>\n Enter the following to the file, save and exit the editor.<\/p>\n With the service defined, reload the systemctl<\/tt> daemon.<\/p>\n Snort can then be run with the configuration you set up using the command below.<\/p>\n The startup script also includes other usual systemctl<\/tt> commands: stop<\/tt>, restart<\/tt>, and status<\/tt>. For example, you can check the status of the service with the following command.<\/p>\n Congratulations, you should have now successfully configured and tested a network-based intrusion detection system. This guide however only covers the very basics with an introduction to Snort and NIDS in general. To get more out of your installation, check out the deployment guides over at the Snort documents page<\/a>, or jump right into writing your own detection rules with their helpful Snort rules info graph<\/a>.<\/p>\n","protected":false},"featured_media":8910,"comment_status":"open","ping_status":"closed","template":"","community-category":[111,121],"class_list":["post-24635","tutorial","type-tutorial","status-publish","has-post-thumbnail","hentry","community-category-networking","community-category-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial\/24635","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial"}],"about":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/types\/tutorial"}],"replies":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/comments?post=24635"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media\/8910"}],"wp:attachment":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media?parent=24635"}],"wp:term":[{"taxonomy":"community-category","embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/community-category?post=24635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Snort](\"https:\/\/upcloud.com\/media\/snort_logo-2.png\"){kind=logo}
<\/p>\nPreparing your server<\/h2>\n
sudo apt install -y gcc libpcre3-dev zlib1g-dev libluajit-5.1-dev \nlibpcap-dev openssl libssl-dev libnghttp2-dev libdumbnet-dev \nbison flex libdnet autoconf libtool<\/pre>\n
Installing from the source<\/h2>\n
mkdir ~\/snort_src && cd ~\/snort_src<\/pre>\n
wget https:\/\/www.snort.org\/downloads\/snort\/daq-2.0.7.tar.gz<\/pre>\n
tar -xvzf daq-2.0.7.tar.gz\ncd daq-2.0.7<\/pre>\n
autoreconf -f -i<\/pre>\n
.\/configure && make && sudo make install<\/pre>\n
cd ~\/snort_src<\/pre>\n
wget https:\/\/www.snort.org\/downloads\/snort\/snort-2.9.16.tar.gz<\/pre>\n
tar -xvzf snort-2.9.16.tar.gz\ncd snort-2.9.16<\/pre>\n
.\/configure --enable-sourcefire && make && sudo make install<\/pre>\n
Configuring Snort to run in NIDS mode<\/h2>\n
sudo ldconfig<\/pre>\n
sudo ln -s \/usr\/local\/bin\/snort \/usr\/sbin\/snort<\/pre>\n
Setting up username and folder structure<\/h2>\n
sudo groupadd snort\nsudo useradd snort -r -s \/sbin\/nologin -c SNORT_IDS -g snort<\/pre>\n
sudo mkdir -p \/etc\/snort\/rules\nsudo mkdir \/var\/log\/snort\nsudo mkdir \/usr\/local\/lib\/snort_dynamicrules<\/pre>\n
sudo chmod -R 5775 \/etc\/snort\nsudo chmod -R 5775 \/var\/log\/snort\nsudo chmod -R 5775 \/usr\/local\/lib\/snort_dynamicrules\nsudo chown -R snort:snort \/etc\/snort\nsudo chown -R snort:snort \/var\/log\/snort\nsudo chown -R snort:snort \/usr\/local\/lib\/snort_dynamicrules<\/pre>\n
sudo touch \/etc\/snort\/rules\/white_list.rules\nsudo touch \/etc\/snort\/rules\/black_list.rules\nsudo touch \/etc\/snort\/rules\/local.rules<\/pre>\n
sudo cp ~\/snort_src\/snort-2.9.16\/etc\/*.conf* \/etc\/snort\nsudo cp ~\/snort_src\/snort-2.9.16\/etc\/*.map \/etc\/snort<\/pre>\n
\n
Option 1. Using community rules<\/h2>\n
wget https:\/\/www.snort.org\/rules\/community -O ~\/community.tar.gz<\/pre>\n
sudo tar -xvf ~\/community.tar.gz -C ~\/<\/pre>\n
sudo cp ~\/community-rules\/* \/etc\/snort\/rules<\/pre>\n
sudo sed -i 's\/include $RULE_PATH\/#include $RULE_PATH\/' \/etc\/snort\/snort.conf<\/pre>\n
Option 2. Obtaining registered user rules<\/h2>\n
wget https:\/\/www.snort.org\/rules\/snortrules-snapshot-29160.tar.gz?oinkcode=oinkcode<\/span> -O ~\/registered.tar.gz<\/pre>\nsudo tar -xvf ~\/registered.tar.gz -C \/etc\/snort<\/pre>\n
Configuring the network and rule sets<\/h2>\n
sudo nano \/etc\/snort\/snort.conf<\/pre>\n
# Setup the network addresses you are protecting\nipvar HOME_NET server_public_ip<\/span>\/32<\/pre>\n# Set up the external network addresses. Leave as \"any\" in most situations\nipvar EXTERNAL_NET !$HOME_NET\n<\/pre>\n
# Path to your rules files (this can be a relative path)\nvar RULE_PATH \/etc\/snort\/rules\nvar SO_RULE_PATH \/etc\/snort\/so_rules\nvar PREPROC_RULE_PATH \/etc\/snort\/preproc_rules<\/pre>\n
# Set the absolute path appropriately\nvar WHITE_LIST_PATH \/etc\/snort\/rules\nvar BLACK_LIST_PATH \/etc\/snort\/rules<\/pre>\n
# unified2\n# Recommended for most installs\noutput unified2: filename snort.log, limit 128<\/pre>\n
include $RULE_PATH\/local.rules<\/pre>\n
include $RULE_PATH\/community.rules<\/pre>\n
Validating settings<\/h2>\n
sudo snort -T -c \/etc\/snort\/snort.conf<\/pre>\n
--== Initialization Complete ==--\n\n ,,_ -*> Snort! <*-\n o\" )~ Version 2.9.16 GRE (Build 118) \n '''' By Martin Roesch & The Snort Team: http:\/\/www.snort.org\/contact#team\n Copyright (C) 2014-2020 Cisco and\/or its affiliates. All rights reserved.\n Copyright (C) 1998-2013 Sourcefire, Inc., et al.\n Using libpcap version 1.8.1\n Using PCRE version: 8.39 2016-06-14\n Using ZLIB version: 1.2.11\n\n Rules Engine: SF_SNORT_DETECTION_ENGINE Version 3.1 \n Preprocessor Object: SF_DCERPC2 Version 1.0 \n Preprocessor Object: SF_SSH Version 1.1 \n Preprocessor Object: SF_FTPTELNET Version 1.2 \n Preprocessor Object: SF_SDF Version 1.1 \n Preprocessor Object: SF_DNP3 Version 1.1 \n Preprocessor Object: SF_REPUTATION Version 1.1 \n Preprocessor Object: SF_IMAP Version 1.0 \n Preprocessor Object: SF_SMTP Version 1.1 \n Preprocessor Object: SF_GTP Version 1.1 \n Preprocessor Object: appid Version 1.1 \n Preprocessor Object: SF_MODBUS Version 1.1 \n Preprocessor Object: SF_POP Version 1.0 \n Preprocessor Object: SF_DNS Version 1.1 \n Preprocessor Object: SF_SSLPP Version 1.1 \n Preprocessor Object: SF_SIP Version 1.1 \n\nSnort successfully validated the configuration!\nSnort exiting<\/pre>\n
Testing the configuration<\/h2>\n
sudo nano \/etc\/snort\/rules\/local.rules<\/pre>\n
alert icmp any any -> $HOME_NET any (msg:\"ICMP test\"; sid:10000001; rev:001;)<\/pre>\n
\n
\n
sudo snort -A console -i eth0 -u snort -g snort -c \/etc\/snort\/snort.conf<\/pre>\n
ip addr<\/pre>\n
07\/12-11:20:33.501624 [**] [1:10000001:1] ICMP test [**] [Priority: 0] {ICMP} 83.136.252.119 -> 80.69.173.202<\/pre>\nsnort -r \/var\/log\/snort\/snort.log.<\/pre>\n
WARNING: No preprocessors configured for policy 0.\n07\/12-11:20:33.501624 83.136.252.118 -> 80.69.173.202\nICMP TTL:63 TOS:0x0 ID:20187 IpLen:20 DgmLen:84 DF\nType:8 Code:0 ID:13891 Seq:1 ECHO<\/pre>\n
Running Snort in the background<\/h2>\n
sudo nano \/lib\/systemd\/system\/snort.service<\/pre>\n
[Unit]\nDescription=Snort NIDS Daemon\nAfter=syslog.target network.target\n\n[Service]\nType=simple\nExecStart=\/usr\/local\/bin\/snort -q -u snort -g snort -c \/etc\/snort\/snort.conf -i eth0\n\n[Install]\nWantedBy=multi-user.target<\/pre>\n
sudo systemctl daemon-reload<\/pre>\n
sudo systemctl start snort<\/pre>\n
sudo systemctl status snort<\/pre>\n
Conclusions<\/h2>\n