Intrusion Detection using BASE and Snort
From Debian Wiki
Contents |
Introduction
This HOWTO will help you install and configure BASE (Basic Analysis and Security Engine) and the Snort intrusion detection system (IDS). BASE provides a web front-end to query and analyze the alerts coming from a Snort IDS system. With BASE you can perform analysis of intrusions that Snort has detected on your network.
Requirements
- A Debian Etch base installation - Installation HOWTO here.
- Apache2, MySQL 5 and PHP5 - Installation HOWTO here.
- Root access to your server.
Assumptions
For the purpose of this HOWTO we will assume the following:
- Our domain name is: example.com
- Our website files are located at: /var/www/example.com
- The IP of the server is: 192.168.0.5
- The network interface name is: eth0
Downloading and untaring
We need a temporary place for all the files that we are going to download, and untar. To keep things simple we will create a directory in the /root named snorttemp.
cd /root mkdir snorttemp cd snorttemp
Snort
Now you need to get Snort. The latest version at the time of writing this is 2.6.1.2:
wget http://www.snort.org/dl/current/snort-2.6.1.2.tar.gz
When the download is finished untar the file:
tar -xvzf snort-2.6.1.2.tar.gz
And let's remove the tar file:
rm snort-2.6.1.2.tar.gz
We also need the Snort rules!
Go to: http://www.snort.org/pub-bin/downloads.cgi and scroll down till you see the "Sourcefire VRT Certified Rules - The Official Snort Ruleset (unregistered user release)" rules:
wget http://www.snort.org/pub-bin/downloads.cgi/Download/vrt_pr/snortrules-pr-2.4.tar.gz
Move the snortrules-pr-2.4.tar.gz into the snort-2.6.1.2 map:
mv snortrules-pr-2.4.tar.gz /root/snorttemp/snort-2.6.1.2
and cd into snort-2.6.1.2:
cd snort-2.6.1.2
Untar the snortrules-pr-2.4.tar.gz file:
tar -xvzf snortrules-pr-2.4.tar.gz
Remove the tar file:
rm snortrules-pr-2.4.tar.gz
We are done downloading the files needed to get Snort to work but to make snort work with BASE, we need more!
PCRE - Perl Compatible Regular Expressions
Go to: http://www.pcre.org/ and select a download link for the pcre-7.0.tar.gz file to download PCRE (at time of writing this it is pcre-7.0.tar.gz)
cd back to the snorttemp map:
cd /root/snorttemp
and download the pcre-7.0.tar.gz file:
wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-7.0.tar.gz
Untar the file:
tar -xvzf pcre-7.0.tar.gz
Remove the tar:
rm pcre-7.0.tar.gz
LIBPCAP
Go to: http://www.tcpdump.org/ and select a download link for Libpcap (at time of writing this it is libpcap-0.9.5.tar.gz)
cd back to the snorttemp map:
cd /root/snorttemp
and download the libpcap-0.9.5.tar.gz file:
wget http://www.tcpdump.org/release/libpcap-0.9.5.tar.gz
Untar the file:
tar -xvzf libpcap-0.9.5.tar.gz
Remove the file:
rm libpcap-0.9.5.tar.gz
BASE (Basic Analysis and Security Engine)
Go to: http://secureideas.sourceforge.net/ and download the latest release (at time of writing BASE 1.2.7 (karen))
cd back to the snorttemp map:
cd /root/snorttemp
and download the base-1.2.7.tar.gz file:
wget http://kent.dl.sourceforge.net/sourceforge/secureideas/base-1.2.7.tar.gz
Untar the file:
tar -xvzf base-1.2.7.tar.gz
Remove the file:
rm base-1.2.7.tar.gz
ADOdb: (ADOdb Database Abstraction Library for PHP (and Python).)
Go to: http://adodb.sourceforge.net/ and download the latest release (at time of writing adodb-493a-for-php)
cd back to the snorttemp map:
cd /root/snorttemp
and download the adodb493a.tgz file:
wget http://belnet.dl.sourceforge.net/sourceforge/adodb/adodb493a.tgz
Untar the file:
tar -xvzf adodb493a.tgz
Remove the file:
rm adodb493a.tgz
Running ls should now show the following directories in /root/snorttemp:
adodb, base-1.2.7, libpcap-0.9.5, pcre-7.0 and snort-2.6.1.2
Installing it all
Install LIBPCAP
Make sure that you are in the directory that you downloaded all files.
cd /root/snorttemp
cd into the libcap map:
cd libpcap-0.9.5
and make / install LIBPCAP:
./configure make make install
Install PCRE
Again, make sure that you are in the directory that you downloaded all files.
cd /root/snorttemp
cd into the PCRE map:
cd pcre-7.0
and make / install pce-7.0
./configure make make install
Installing Snort
Make sure that you are in the directory that you downloaded all files.
cd /root/snorttemp
cd into the snort map:
cd snort-2.6.1.2
and make / install Snort with some extra needed options!
./configure --enable-dynamicplugin --with-mysql make make install
Snort needs some maps, so let's create them:
mkdir /etc/snort mkdir /etc/snort/rules mkdir /var/log/snort
Moving the Snort files from the installation map to the just created maps. Make sure that you are in the directory that you downloaded all files.
cd /root/snorttemp
cd into the snort map:
cd snort-2.6.1.2
and into the rules
cd rules
now we copy all files from the /rules into /etc/snort/rules
cp * /etc/snort/rules
We will do the same for the files in the install /etc folder:
cd ../etc cp * /etc/snort
Fixing the snort.conf
The /etc/snort/snort.conf needs some tuning to get it to work on your system! So cd into /etc/snort:
cd /etc/snort
and open snort.conf with vim (or any other 'text' editor)
vim snort.conf
change "var HOME_NET any" to "var HOME_NET 192.168.0.5/32" change "var EXTERNAL_NET any" to "var EXTERNAL_NET !$HOME_NET" change "var RULE_PATH ../rules" to "var RULE_PATH /etc/snort/rules"
As we made snort with the '--with-mysql' option and as BASE needs it, we also need to tell Snort what database to use. Scroll down till you see "# output database", and remove the # in front of the line for the MySQL. Now also change the "user", "password" and "dbname". Make a note of this as you will need it later! Save the file and close 'vim'
Setting up the MySQL Database for Snort
There are many ways to create the snort database. The table layout can be found in the file create_mysql in the /root/snorttemp/snort-2.6.1.2/schemas directory. Whichever way you create the database, make sure the 'user', 'password' and 'dbame' are the same as the one you set in the /etc/snort/snort.conf file!
After creating you can test snort and see if you get any errors with:
snort -c /etc/snort/snort.conf
Exit the test with Ctrl+C and if you get no error's Snort is setup correct.
Moving ADOdb and BASE
cd back to the download dir:
cd /root/snorttemp/
and move adodb it to the root of the www map:
mv adodb /var/www
Still in the download dir, we move the base dir into the 1st website map:
mv base-1.2.7 /var/www/example.com
and cd into /var/www/example.com
cd /var/www/example.com
To enable BASE to write the setup file we need to chmod the base-1.2.7 folder to 757:
chmod 757 base-1.2.7
BASE web page setup
Open your favorite web browser and go to: http://www.example.com/base-1.2.7/setup If all is setup okay you should see the BASE Setup Program page:
Click on Continue
Step 1 of 5:
Enter the path to ADODB (/var/www/adodb):
Step 2 of 5:
Enter the needed info on the next screen: (leave the Use Archive Database as is):
Step 3 of 5:
If you want to Use Authentication for the Base page you can do so here:
Step 4 of 5:
Click on Create BASE AG to create the database:
and after Create BASE AG:
Step 5 of 5:
Once done, click on Now continue to step 5...
To make the Graph's from BASE work you will also need to install Image_Color, Image_Canvas and Image_Graph.
To do this do:
pear install Image_Color pear install Image_Canvas-alpha pear install Image_Graph-alpha
That it for BASE!
If you want you can chmod the base-1.2.7 dir back to 775:
chmod 775 base-1.2.7
You can also delete the snorttemp directory, and all the files in it.
Starting Snort
To start SNORT and make BASE show you the Snort's logged info, you will need to run:
/usr/local/bin/snort -c /etc/snort/snort.conf -i eth0 -g root -D
Now wait some time and see all the Snort alerts show up in BASE:
References
Intrusion Detection With BASE And Snort - by edge |