Snort ACID Low cost highly configurable IDS by

Snort & ACID Low cost, highly configurable IDS by Patrick Southcott southcottus@yahoo. com http: //www. patricksouthcott. com

Large topic, General outline: 1. What is snort? 2. Where does an IDS fit in the network? 3. Snort 2. 0, Marty and Sourcefire. com 4. Snort system overview – config file – rules (custom & public) 5. ACID : opensource, web-based, simple alert management. 6. PROS & CONS of snort as an IDS. 7. Building a snort sensor on Redhat 9.

What is Snort? Snort is an application which listens to network traffic and uses rules to determine if it sees particular types of traffic. It logs, alerts for and listens to network traffic. The System Architecture consists of these main parts: • Sniffer • “Promiscuous Mode” NIC Packets on the wire • Preprocessor • frag 2, stream 4, http_decode • Detection Engine Snort Detection Process • Using Rules • Logging and Alerting plugins • log mysql, alert smb Records in a SQL db

Snort in the larger picture • Snort “sensors” can be placed on any network device. Hubs work best. • Sensors may log to a central database over secure tunnels or private media. • Management console using ACID.

Network Overview Management Console IDS network sensor Internet Router / firewall DMZ sensor Router / firewall Private LAN DMZ hosts

IDS in Perspective • Management / Executive • low TCO (End-to-end, openness) • Wants reports which show ROE • System Admin • • • Configures and runs everything. Routers, firewalls, servers. Endless game to keep “up-to-date”. Wants to be “user” of IDS High quality data Auto-response to new vulnerabilities. • Network Admin / Analyst • • Maintains network Event Correlation Broad -> Specific Tune rules

Marty Roesch and Sourcefire • Created snort in 1998. • Sourcefire sells IDS boxes which they install, configure and support. Different security needs may involve specific tuning to customer’s network. • Sourcefire is the major commercial supporter of snort. • Gig speeds with multiprocessors and linux – same kernel, custom drivers, minimal footprint • demo-sensor. sourcefire. com

Snort Usage • Run on Console $. /snort –c snort. conf Shell output from snort init. : $. /snort –l /home/snort_spool/ Running in packet logging mode Log directory = /snort_spool/ –l /home/snort_spool/ Initializing Network Interface eth 0 --== Initializing Snort ==-- • Run as Daemon $. /snort –D –c snort. conf Initializing Output Plugins! Decoding Ethernet on interface eth 0 --== Initialization Complete ==-- –l home/snort_spool/ -*> Snort! <*Version 2. 0. 0 rc 4 (Build 70) Snort Config File: config daemon By Martin Roesch (roesch@sourcefire. com, www. snort. org)

Snort Console Output ================================ Snort analyzed 4 out of 4 packets, dropping 0(0. 000%) packets Breakdown by protocol: Action Stats: TCP: 4 (100. 000%) ALERTS: 0 UDP: 0 (0. 000%) LOGGED: 4 ICMP: 0 (0. 000%) PASSED: 0 ARP: 0 (0. 000%) EAPOL: 0 (0. 000%) IPv 6: 0 (0. 000%) IPX: 0 (0. 000%) OTHER: 0 (0. 000%) DISCARD: 0 (0. 000%) ================================ Wireless Stats: Breakdown by type: Management Packets: 0 (0. 000%) Control Packets: 0 (0. 000%) Data Packets: 0 (0. 000%) ================================ Fragmentation Stats: Fragmented IP Packets: 0 (0. 000%) Fragment Trackers: 0 Rebuilt IP Packets: 0 Frag elements used: 0 Discarded(incomplete): 0 Discarded(timeout): 0 Frag 2 memory faults: 0 ….

Snort Configuration File Variables • var HOME_NET • var EXTERNAL_NET • var FOO_SERVERS Configuration • • config interface: eth 0 set_uid: snort dump_payload daemon Preprocessor • preprocessor frag 2 • preprocessor stream 4 • preprocessor portscan 2 Each bullet is a line in the config file. Variables are used in the files with the snort rules. Output SQL Database • output database: log, mysql, user=snort password=foobar dbname=snort host=localhost

Snort Preprocessors • Frag 2 Preprocessor – snort. conf: “preprocessor frag 2” – packet fragmentation can lead to the IDS missing packets or getting different ones than the host gets. This cleans fragmented packets. • The stream 4 Preprocessor – snort can keep track of tcp sessions. “stateful” – detection of “stealth” scans from software like nmap. • Portscan and portscan 2 Preprocessors – detection of single host access to many ports.

Snort Rules snort. conf : . . . include $RULE_PATH/local. rules : activate tcp any -> any 23 (activates: 23; msg: ”Potential Telnet Login Credentials Logged”; ) dynamic tcp any -> any 23 (activated_by: 23; count: 20; ) Rules to log all tcp, udp and icmp traffic. log tcp any -> any (msg: “tcp traffic”; ) log udp any -> any (msg: “udp traffic”; ) log icmp any -> any (msg: “icmp traffic”; )

web-iis. rules : Snort Rules alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg: "WEB-IIS cmd. exe access"; flow: to_server, established; content: "cmd. exe"; nocase; classtype: web-application-attack; sid: 1002; rev: 5; ) alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg: "WEB-IIS Code. Red v 2 root. exe access"; flow: to_server, established; uricontent: "/root. exe"; nocase; classtype: web-application-attack; reference: url, www. cert. org/advisories/CA-2001 -19. html; sid: 1256; rev: 7; ) # action = pass, log, alert, dynamic, activate # protocol = icmp, tcp, ip, udp action protocol source -> destination ( optional_rule_body )

Snort Rules • Default rules for known bad packets. • • • • • attack-responses. rules backdoor. rules bad-traffic. rules chat. rules ddos. rules deleted. rules DMZ. rules dns. rules dos. rules experimental. rules exploit. rules finger. rules ftp. rules icmp-info. rules icmp. rules imap. rules info. rules local. rules • • • • • misc. rules multimedia. rules mysql. rules netbios. rules nntp. rules oracle. rules other-ids. rules p 2 p. rules policy. rules pop 2. rules pop 3. rules porn. rules rpc. rules rservices. rules scan. rules shellcode. rules smtp. rules snmp. rules • • • • sql. rules telnet. rules tftp. rules virus. rules web-attacks. rules web-cgi. rules web-client. rules web-coldfusion. rules web-frontpage. rules web-iis. rules web-misc. rules web-php. rules x 11. rules

ACID to manage Alerts • Sort and display alerts based on ip, port, date, unique alerts. • Search alerts • Display layer 3 and 4 packet data • Graphs and statistics for alert frequency. • Alert grouping, archiving, managing

Connecting mysql with stunnel • Generate foo. pem for tunnel. openssl req -new -out stunnel. pem -keyout stunnel. pem -nodes -x 509 -days 365 • stunnel 4 with config ( stunnel. conf) Cert = /foobar/stunnel. pem [mysqls] accept = 3307 connect = 3306 • stunnel 3. 22 from shell prompt. #!/bin/sh /usr/local/sbin/stunnel -c -d 3306 -r 10. 1. 5. 1: 3307

Snort IDS: PROs and CONs PROs • Powerful, specific rules to match packets. • No backdoors • Weakness quickly found & published. • Rules actively published for detection of new worms etc. • Open Source software developers know code will be checked. Fewer hacks. CONs • Snort/ACID is only part of a secure network. • Does not record the success or failure of a detected intrusion • Does nothing to stop an intrusion in progress. • False sense of security.

Installing snort on Red. Hat 9

IDS component overview • Open Source Network Intrusion Detection System (Snort) – snort-2. 0. 0 rc 4. tar. gz – mysql-4. 0. 12. tar. gz • Analysis Console for Intrusion Databases (ACID) – apache_1. 3. 27. tar. gz – php-4. 3. 1. tar. gz – acid-0. 9. 6 b 23. tar. gz

Apache & php Setup • . /configure --prefix=/home/apache_prefix/ -activate-module=src/modules/php 4/libphp 4. a • make && make install • . /configure --prefix=/home/apache/php_prefix --withmysql --enable-bcmath --with-gd --enable-sockets --withzlib-dir=/home/apache/php-4. 3. 1/zlib-1. 1. 4/ --withapache=. . /apache_1. 3. 27 • Php needs graphics libs: – zlib-1. 1. 4, libpng-1. 2. 5, gd-1. 8. 4, phplot-4. 4. 6

Snort System Setup • mysql-4. 0. 12 • . /configure --prefix=/home/snort_prefix --enable-smbalerts --with-mysql • Make && make check && make install; • Webmin – snort-1. 0. wbm

Create snort database & tables • CREATE DATABASE snort; " | mysql -u root –p • grant INSERT, SELECT on snort. * to snortusr@localhost; • mysql -D snort -u root -p <. /contrib/create_mysql

Snort Config Setup • output database: log, mysql, user=snortusr password=foobar dbname=snort host=localhost • Modify alert rules to personal taste

ACID Setup • adodb 331. zip in www_root • tar zxfp acid-0. 9. 6 b 23. tar. gz – mv acid /var/www/html • edit acid/acid_conf. php – $DBlib_path = "/var/www/html/adodb"; – $aler_dbname = "snort“ • http: //acid. foobar. com/acid_main. php