Intrusion Detection With BASE And Snort - Page 3

Installing

Lets start with: LIBPCAP.
Make sure that you are in the directory that you downloaded all files.

cd /root/snorttemp

cd into the libcap map:

cd libpcap-0.9.4

and make / install LIBPCAP:

./configure
make
make install

Next is PCRE.
Again, make sure that you are in the directory that you downloaded all files.

cd /root/snorttemp

cd into the PCRE map:

cd pcre-6.3

and make / install pce-6.3

./configure
make
make install

Now it time for Snort:
Make sure that you are in the directory that you downloaded all files.

cd /root/snorttemp

cd into the snort map:

cd snort-2.6.0

and make / install Snort with some extra needed options!

./configure --enable-dynamicplugin --with-mysql
make
make install

Snort needs some maps, so let’s create them:

mkdir /etc/snort
mkdir /etc/snort/rules
mkdir /var/log/snort

Moving the Snort files from the installation map to the just created maps.
Make sure that you are in the directory that you downloaded all files.

cd /root/snorttemp
and cd into snort-2.6.0: 
cd snort-2.6.0
and into the rules 
cd rules
now we copy all files from the /rules into /etc/snort/rules 
cp * /etc/snort/rules
We will do the same for the files in the install /etc folder:

cd ../etc
cp * /etc/snort

Fixing the snort.conf

The /etc/snort/snort.conf needs some tuning to get it to work on your system!
So cd into /etc/snort: 

cd /etc/snort
and open snort.conf with nano (or any other 'text' editor) 
nano snort.conf

change "var HOME_NET any" to "var HOME_NET 192.168.0.5/32"
change "var EXTERNAL_NET any" to "var EXTERNAL_NET !$HOME_NET"
change "var RULE_PATH ../rules" to "var RULE_PATH /etc/snort/rules"

As we made snort with the '--with-mysql' option and as BASE needs it, we also need to tell Snort what database to use.
Scroll down till you see "# output database", and remove the # in front of the line for the MySQL.
Now also change the "user", "password" and "dbname". hint Make a note of this as you will need it later!
Save the file and close 'nano'

Setting up the MySQL Database for Snort.

There are many ways to create the snort database.
The table layout can be found in the file create_mysql in the /root/snorttemp/snort-2.6.0/schemas directory.
Whichever way you create the database, make sure the 'user', 'password' and 'dbame' are the same as the one you set in the /etc/snort/snort.conf file!

After creating you can test snort and see if you get any errors with: 

snort -c /etc/snort/snort.conf

Exit the test with Ctrl+C

If you get no error's Snort is setup correct.

Moving ADOdb and BASE

Moving ADOdb:
cd back to the download dir

cd /root/snorttemp/

and move adodb it to the root of the www map:

mv adodb /var/www

Next: BASE (Basic Analysis and Security Engine )
Still in the download dir, we move the base dir into the 1st website map that you create with ISPconfig.

mv base-1.2.5 /var/www/www.example.com/web

and cd into /var/www/www.example.com/web

cd /var/www/www.example.com/web

To enable BASE to write the setup file we need to chmod the base-1.2.5 folder to 757:

chmod 757 base-1.2.5
Share this page:

Suggested articles

5 Comment(s)

Add comment

Comments

By: Anonymous
Reply  

After editing the "user", "password" and "dbname" (on page 3) its time to make a new SQL database.

Login to your SQL server

mysql -u root -p
(Enter password)

mysql> create database snort;
mysql> exit

Now that you have a SQL database ready, we can use the SNORT schemas for the proper layout.

mysql -D snort -u root -p < /root/snorttemp/snort-2.6.0/schemas/create_mysql
(Enter password)

Finally we are ready to test snort.

snort -c /etc/snort/snort.conf

EXAMPLE: 

        --== Initialization Complete ==--

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.6.0 (Build 59)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
           (C) Copyright 1998-2006 Sourcefire Inc., et al.
 
Enjoy!

By: Anonymous
Reply  

what is you get an error that says parsing rules file "/etc/snort/snort.conf"

 error: /etc/snort/snort.conf(1) Invalid configuration line :FdF#..................................................

By: Anonymous
Reply  

If you get:
configure: error: C++ preprocessor "/lib/cpp" fails sanity check
when running:

./configure --enable-dynamicplugin --with-mysql

You may need to install the gcc c++ compiler.

Just run:

apt-get install g++

...and when it's finished, rerun the configure command, and you should be sorted out.

By:
Reply  

if you running test snort.

snort -c /etc/snort/snort.conf

and get an error like this : 

ERROR: ERROR /etc/snort/rules/web-misc.rules Line 452 => unable to parse pcre regex "fn=Eye\d{4}_\d{2}.log/Rmsi"
Fatal Error, Quitting..

Solution :

you must edit file /etc/snort/rules/web-misc.rules with your favorite text editor, on Line 452 . and :

change/add line above :
pcre:"fn=Eye\d{4}_\d{2}.log/Rmsi"

with :
pcre:"/fn=Eye\d{4}_\d{2}.log/Rmsi"

Just add '/' in front line. 

By: HomeSen
Reply  

Hi @ all,

 I ran into some issues with my snort install on Debain 5r2. And I thought, it might be helpful to post the solutions I found:

1.  While ./configure... I got mysql.h not found

You need to install the package libmysqlclient-dev

2. Loading dynamic detection library /usr/local/lib/snort_dynamicrules/bad-traffic.so... ERROR: Failed to load /usr/local/lib/snort_dynamicrules/bad-traffic.so: /usr/local/lib/snort_dynamicrules/bad-traffic.so: cannot open shared object file: No such file or directory
Fatal Error, Quitting..

This one can be fixed by copying all files from <snort_src_folder>/so_rules/precompiled/Debian-Lenny/i386/2.8.4/ to /usr/local/lib/snort_dynamicrules/

3. When trying to start snort, I also got the following: ERROR: ERROR /etc/snort/rules/exploit.rules(23): Couldn't resolve hostname HOME_NET
Fatal Error, Quitting..

 That was tricky one, since it wasn't that easy to localize the evil's root. In snort.conf you have to change the line:

var EXTERNAL_NET !HOME_NET

to

var EXTERNAL_NET !$HOME_NET

Because the Dollar-sign is missing there.

Hope this helps a few unlucky as I was ;-)