Snort 2.9 on CentOS 6.3 (continued) with Barnyard2

This is a continuation of the post on installing Snort 2.9 on CentOS 6.4 (http://nkush.blogspot.com.au/2013/03/snort-29-on-centos-63.html). This post installs Barnyard2 on the host.

Barnyard is an output system for Snort. If effectively allows better snort performance by enabling Snort to produce binary output which is then processed by Barnyard.

Barnyard processes the binary Snort output files (unified2 binary) and stores the processed data into a database back-end, for example MySQL. The advantage of using Barnyard instead of the database output from Snort is that Barnyard is able to "cache" the data in case the database is unavailable.

Barnyard is able to be executed in three modes, this example employs the continual mode with bookmarking. A bookmark (waldo) file is employed to keep track of the progress of Barnyard processing. In case of Barnyard failure, it can resume where it left off based on the bookmark file.

Installation:

1. Install and configure MySQL
1. yum -y install mysql mysql-server mysql-devel mysql-bench
2. service mysqld start
3. /usr/bin/mysql_secure_installation
2. Download and install Barnyard2 from http://securixlive.com/barnyard2/download.php
1. wget http://securixlive.com/download/barnyard2/barnyard2-1.9.tar.gz
2. tar zxvf barnyard2-1.9.tar.gz
3. cd barnyard2-1.9
4. ./configure --with-mysql --with-mysql-libraries=/usr/lib64/mysql/
5. make
6. make install
3. Configure Barnyard to process Snort output
1. Change Snort config to output to the unified file format
1. output unified2: filename merged.log, limit 128, mpls_event_types, vlan_event_types
2. Change the Barnyard config (/usr/local/etc/barnyard2.conf)
1. config logdir: /var/log/barnyard2
2. config hostname:    localhost
3. config interface:    ethX
4. config daemon
5. config set_gid:nnnn
6. config set_uid:nnnn
7. config show_year
8. config umask: 066
9. config waldo_file: /var/log/snort/barnyard2.waldo
10. input unified2
11. output database: log, mysql, user=snort password=password dbname=barnyard2 host=localhost
4. Create the MySQL database for Barnyard
1. mysqladmin -u root -p create barnyard2
2. mysql -u root -p -D barnyard2 < ./schemas/create_mysql
5. Grant privileges to database
1. mysql -u root -p
2. GRANT ALL PRIVILEGES ON barnyard2.* TO snort@localhost WITH GRANT OPTION;
3. SET PASSWORD FOR snort@localhost=PASSWORD('password');
6. Prepare Barnyard2
1. touch /var/log/snort/barnyard2.waldo
2. chown -R snort:snort /var/log/snort
7. Run Barnyard then Snort
1. barnyard2 -c /usr/local/etc/barnyard2.conf -d /var/log/snort/ -w /var/log/snort/barnyard2.waldo -f merged.log -u snort -g snort -D
2. snort -c /etc/snort/snort.conf -i eth4 -u snort -g snort -D

If all goes well then you should see events being logged into your event table in the barnyard2 database.

Errors:

1. ERROR: unable to find mysqlclient library (libmysqlclient.*)
1. ./configure --with-mysql-libraries=/usr/lib64/mysql/
2. ERROR: Unable to open directory '' (No such
    file or directory)
   ERROR: Unable to find the next spool file!
1.  Ensure that the waldo file is specified (by the -w option included as a command line argument or in the config file)
3. WARNING: Can't extract timestamp extension from 'alert'using base ''
1. Ensure that the unified2 file is specified (by the -f option included as a command line argument or in the config file)
4. FATAL ERROR: Absdir is not a subset of the logdir
1.  Ensure that the logdir is configured in the Barnyard configuration file
5. FATAL ERROR: database: mysql_error: Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2)
1. Ensure that the MySQL service/daemon is running

I had to do some maintenance work on a Linux based server

I had to do some maintenance work on a Linux based server. It was mainly just archiving some files around and updating packages and configurations. However, as part of the maintenance I took the opportunity to put in some simple technical security controls in place and documented some of them here for my reference.

MySQL Database
There was a MySQL server running that was only needed for the local host, but a "netstat -ltn" indicated that it was not bound to any specific IP, i.e. listening on 0.0.0.0, so I bound it to the localhost IP of 127.0.0.1 by editing the /etc/my.cnf file using the entry bind-address=127.0.0.1

vi /etc/my.cnf
bind-address=127.0.0.1

RKHunter Rootkit Anti-malware
I installed the new version of rkhunter and modified the configuration file to suit.

yum install rkhunter
vi /etc/rkhunter.conf
PKGMGR=RPM
ENABLE_TESTS="all"
DISABLE_TESTS="none"
SCAN_MODE_DEV=THOROUGH 
rkhunter --propupd --update --check --sk -l
vi /etc/rkhunter.conf
ALLOWHIDDENDIR=
ALLOWDEVFILE=

IPTables Firewall
Strangely enough there was no firewall configured on the host, so I quickly knocked up an script and saved it. Here's a snippet of the script that simply resets the rules, sets the default policies to drop and allows all local communications. There are additional parts that allow specific traffic through, but I have not put this up here to obscure the services and IP addresses being used.

#!/bin/bash

#
# Global script variables
#

# Commands
IPTABLES=/sbin/iptables

# Network interfaces and addresses
LOOP_IFACE=lo
LAN=192.168.100.0/24
LAN_ADDR=192.168.100.201
LAN_IFACE=eth0

# Port numbers
NAMED_PORT=53
NETFLOW_PORT=9996
NTP_PORT=123
PRIV_PORTS=1:1024
SMB_PORTS=137:139
SSHD_PORT=4022
UNPRIV_PORTS=1025:65535


#
# Manage kernel parameters
#

echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/ip_forward


#
# Configure default table policies
#

$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP


#
# Initialise tables - flush rules, remove chains, zero counts
#

$IPTABLES -F
$IPTABLES -F -t mangle
$IPTABLES -F -t nat

$IPTABLES -X
$IPTABLES -X -t mangle
$IPTABLES -X -t nat

$IPTABLES -Z


#
# Allow all local loopback traffic
#

$IPTABLES -A INPUT -i $LOOP_IFACE -j ACCEPT
$IPTABLES -A OUTPUT -o $LOOP_IFACE -j ACCEPT


#
# Allow all traffic that is part of a related or established connection in
#

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


#
# Politely reject SMB traffic
#

$IPTABLES -A INPUT -i $LAN_IFACE -p tcp --dport $SMB_PORTS -j REJECT
$IPTABLES -A INPUT -i $LAN_IFACE -p udp --dport $SMB_PORTS -j REJECT


#
# Allow icmp pings
#

$IPTABLES -A INPUT -i $LAN_IFACE -s $LAN -d $LAN_ADDR -p icmp --icmp-type echo-request -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -o $LAN_IFACE -s $LAN_ADDR -d $LAN -p icmp --icmp-type echo-reply -m state --state ESTABLISHED,RELATED -j ACCEPT


#
# *** DELETED SERVICES SPECIFIC RULES TO IMPLEMENT SECURITY BY OBSCURITY ***

# 


#
# Debugging - log all other traffic *** DO NOT USE IN PRODUCTION ENVIRONMENT ***
#
#
#$IPTABLES -A INPUT -i $LAN_IFACE -j LOG --log-prefix "rc.firewall "
#

ClamAV Anti-virus
ClamAV is an open source anti-virus software for Linux. I installed this using the yum package manager and configured the AV to scan daily, and used freshclam to ensure that the virus definitions are updated hourly.

yum install clamav clamd clamav-db

vi /etc/cron.hourly/freshclam
#!/bin/bash
/usr/bin/freshclam --quiet -l /var/log/clamav/freshclam.log

vi /etc/cron.daily/clamscan
#!/bin/bash
/usr/bin/clamscan -r / --exclude-dir=/proc --quiet --infected --log=/var/log/clamd/clamscan

Fail2Ban Intrusion Prevention
fail2ban is an interesting intrusion prevention system that parses system logs to dynamically update firewall rules to stop potential intrusion attempts. It supports several other mechanism, but I was only interested in the firewall and SSH access

yum install fail2ban
vi /etc/ssh/sshd_config
SyslogFacility LOCAL5
LogLevel INFO

vi /etc/syslog.conf
local5.info                                     /var/log/sshd/sshd.log

vi /etc/fail2ban/jail.conf
[ssh-iptables]
enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
           sendmail-whois[name=SSH, dest=*DELTED*, sender=*DELETED*]
logpath  = /var/log/sshd/sshd.log
maxretry = 2

Legal notices
The client wanted some legal notices and disclaimers on the host for various reasons, one of them being to notify employees that their usage was being monitored. I stuck the disclaimer from their legal department (it looked pretty generic though) into /etc/issue and created a link from /etc/issue.net to it.

Installing Snort 2.9.1.2 on CentOS 5.7

CentOS 5.7 uses an older version of libpcap (0.9.4), but Snort's Data Acquisition Library (daq) needs a newer version of libpcap (>=1.0.0). The latter is not an issue with the CentOS 6.0. Vishesh Kumar [1] provides an excellent instructions to getting Snort 2.9 to run on RHEL 5 (http://www.linuxmantra.com/2010/10/install-snort-29-on-rhel-5.html). The purpose of this post is not to duplicate his efforts, but to extend it slightly to include instructions for a complete Snort set-up.

1. libpcap - http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz [3]
2. daq : http://www.snort.org/downloads/1221 [2]
3. snort : http://www.snort.org/downloads/1207 [2]

Download and install the libraries and software as per the instructions below;

1. Enable the Extra Packaged for Enterprise Linux (EPEL) repository to enable the installation of additional packages not available under the standard repositories
1. rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-4.noarch.rpm
2. yum -y update
3. yum -y upgrade
2. Install developments to compile the libraries and source code, and additional libraries and header files that are required later on
1. yum -y groupinstall 'Development Tools'
2. yum -y install pcre-devel
3. yum -y install libdnet-devel
4. yum -y install zlib-devel
5. yum -y install mysql mysql-server mysql-devel mysql-bench
3. Download, compile and install libpcap
1. wget http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz
2. cd libpcap-1.1.1
3. ./configure --prefix=/usr
4. make && make install
4. Download, compile and install daq
1. wget http://www.snort.org/downloads/1221 -O daq-0.6.2.tar.gz
2. cd daq-0.6.2
3. ./configure
4. make && make install
5. Download, compile and install snort
1. wget http://www.snort.org/downloads/1207 -O snort-2.9.1.2.tar.gz
2. cd snort-2.9.1.2
3. ./configure --with-mysql
4. make && make install
6. Download, compile and install Barnyard2
1. wget --no-check-certificate https://github.com/firnsy/barnyard2/tarball/master -O firnsy-barnyard2-405761e.tar.gz
2. tar zxvf firnsy-barnyard2-405761e.tar.gz
3. cd firnsy-barnyard2-405761e
4. ./autogen.sh
5. ./configure --with-mysql
6. make && make install
7. Create the snort database on the mysql enginer
1. mysqladmin -u root -p create snort
2. mysql -u root -p -D snort < schemas/create_mysql
3. mysql -u root -p
1. GRANT CREATE,INSERT ON root.* TO snort@localhost IDENTIFIED BY 'PASSWORD';
2. GRANT CREATE,INSERT,SELECT,DELETE,UPDATE ON snort.* TO snort@localhost IDENTIFIED BY 'PASSWORD';
8. To get the current registered user rules, you need to sign up and obtain an Oinkcode. The Oinkcode will be used for downloading the rules and used with pulledpork.
1. Sign in or request an account from https://www.snort.org/login
2. Get your oinkcode after signing in from https://www.snort.org/account/oinkcode
3. cd etc
4. wget http://www.snort.org/reg-rules/snortrules-snapshot-.tar.gz/OINKCODE -O snortrules-snapshot-LATEST.tar.gz
5. tar zxvf snortrules-snapshot-LATEST.tar.gz
9. Setup the configuration and rules files for snort
1. mkdir -p /etc/snort
2. mv -f etc/* .
3. rmdir etc/
4. mv snortrules-snapshot-LATEST.tar.gz ../../
5. rm -f Makefile Makefile.am Makefile.in
6. cp -rf * /etc/snort/
10. Edit the snort configuration
1. vi /etc/snort/snort.conf
1. ipvar HOME_NET
2. var RULE_PATH rules
3. var SO_RULE_PATH so_rules
4. var PREPROC_RULE_PATH preproc_rules
5. output database: log, mysql, user=snort password=PASSWORD dbname=snort host=localhost
6. output alert_syslog: LOG_LOCAL6 LOG_ALERT
11. Edit the syslog.conf file to log alerts to separate file and restart the syslog daemon
1. Include the line in syslog.conf "local6.*        /var/log/snort/alerts.log"
2. /etc/rc.d/init.d/syslog restart
12. Test the snort installation, and set-up environment to run snort if all OK
1. snort -c /etc/snort/snort.conf -T
2. useradd -G snort snort -s /bin/false
3. chown -R root:snort /var/log/snort
4. chmod -R g+w /var/log/snort
13. Configure barnyard [4]
1. mkdir -p /var/log/barnyard2
2. chmod 666 /var/log/barnyard2
3. touch /var/log/snort/barnyard2.waldo
4. cp etc/barnyard2.conf /etc/snort/
5. Edit the /etc/snort/barnyard2.conf
1. output database: log, mysql, user=snort password= dbname=snort host=localhost
2. config hostname:   localhost
3. config interface:  eth0
14. You can get snort to start automatically, but writing a customer script to start/stop/restart the daemon or simply kicking it off to start up when the machine boots. Edit the rc.local file and out the following in
1. /usr/local/bin/snort -D -u snort -g snort -c /etc/snort/snort.conf -i eth0
2. /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo -D

Common Errors:

1. ERROR: parser.c(5261) Could not stat dynamic module path "/usr/local/lib/snort_dynamicrules": No such file or directory.
   Fatal Error, Quitting..
1. mkdir -p /usr/local/lib/snort_dynamicrules
2. cp /etc/snort/so_rules/precompiled/DIST/i386/2.9.0.0/* /usr/local/lib/snort_dynamicrules/
2. ERROR: /etc/snort/rules/web-misc.rules(555) Cannot use the fast_pattern content modifier for a lone http cookie/http raw uri /http raw header /http raw cookie /status code / status msg /http method buffer content.
   Fatal Error, Quitting..
1. The fast_pattern option cannot be used with the http_method string. Edit the web-misc.rules file and remove it from the snort rule. Do a search for "2010-0388" and remove the alert option fast_pattern from the alert rule.
3. ERROR: /etc/snort/snort.conf(244) => 'compress_depth' and 'decompress_depth' should be set to max in the default policy to enable 'unlimited_decompress'
   Fatal Error, Quitting..
1. Edit the /etc/snort/snort.conf file and set the http_inspect compress_depth and decompress_depth to 65535 from 20480.
4. ERROR: ByteExtract variable 'bugtraq' in rule [3:13897] is used before it is defined
1. Ensure that the shared libraries copied above using "cp /etc/snort/so_rules/precompiled/DIST/i386/2.9.0.0/* /usr/local/lib/snort_dynamicrules/" are for the correct distribution
2. Ensure that the rules being used are for the version of snort being used.

Please note: 

1. These instruction are for 32bit hardware, for 64bit machines you will need to select appropriate 64bit RPM packages or configure and compile with appropriate compiler switches. These are considered beyond the scope of this post.
2. All instructions are executed with root privileges.

References:

1. http://www.linuxmantra.com/2010/10/install-snort-29-on-rhel-5.html
2. http://www.snort.org/snort-downloads?
3. http://www.tcpdump.org/#latest-release
4. http://www.snort.org/assets/145/Install_Snort_2.8.6_on_CentOS_5.5.pdf

Snort sniff honk !

Snort is an open source intrusion detection system (IDS). Its highly configurable and can be run in a number of modes and architectures, There are a small number of freely available rules to use. For more information refer to the Snort home page http://www.snort.org/. Here are some instructions on getting it setup on CentOS, these were adapted from the Snort Documentation by Patrick Harper at http://assets.sourcefire.com/snort/setupguides/Snort_Base_Minimal.pdf;

1. yum install mysql mysql-bench mysql-server mysql-devel mysqlclient10 php-mysql httpd gcc pcre-devel php-gd gd mod_ssl glib2-devel gcc-c++ php php-pear libpcap-devel
2. vi /etc/httpd/conf/httpd.conf #Edit the httpd.conf file to suit
3. /etc/rc.d/init.d/httpd start
4. /etc/rc.d/init.d/mysqld restart
5. /usr/bin/mysql_secure_installation
6. cd /root
7. mkdir snortinstall
8. cd snortinstall
9. wget http://dl.snort.org/snort-current/snort-2.8.5.3.tar.gz
10. tar zxvf snort-2.8.5.3.tar.gz
11. cd snort-2.8.5.3
12. ./configure --with-mysql --enable-dynamicplugin # Fingers crossed it all goes well
13. make
14. make install
15. /usr/sbin/groupadd snort
16. /usr/sbin/useradd -g snort snort -s /sbin/nologin
17. mkdir -p /etc/snort/rules
18. mkdir -p /var/log/snort
19. cd /root/snortinstall/snort-2.8.5.3/etc
20. cp ./* /etc/snort/
21. cd /root/snortinstall
22. wget http://www.emergingthreats.net/rules/emerging.rules.tar.gz
23. tar zxvf emerging.rules.tar.gz
24. cd rules
25. cp ./* /etc/snort/rules/
26. vi /etc/snort/snort.conf # Edit the snort.conf file to suit
27. /etc/rc.d/init.d/mysqld start
28. mysql -u root -p mysql # Create the snort database and snort database user and set permissions
    
29. cd  /root/snortinstall/snort-2.8.5.3/schemas
30. mysql -u snort -p snort < create_mysql
31. pear install -a Image_Graph-alpha Image_Canvas-alpha Image_Color Numbers_Roman
32. cd /root/snortinstall/
33. wget http://downloads.sourceforge.net/project/adodb/adodb-php5-only/adodb-510-for-php5/adodb510.tgz?use_mirror=transact
34. wget http://downloads.sourceforge.net/project/secureideas/BASE/base-1.4.4/base-1.4.4.tar.gz?use_mirror=transact
35. cd /var/www
36. tar zxvf /root/snortinstall/adodb510.tgz
37. mv adodb5/ adbodb
38. cd /var/www/html/
39. tar zxvf /root/snortinstall/base-1.4.4.tar.gz
40. mv base-1.4.4/ base
41. cd base
42. cp base_conf.php.dist base_conf.php
43. vi base_conf.php # Edit the file to suit
44. # Load http://SERVERNAME/base in a browser and click on the setup link
45. # Click on Create BASE AG button
46. # Click on the Main Page link

SQL

1. create database snort;
2. create user 'snort'@'localhost' identified by '';
3. grant create, insert, select, delete, update on snort.* to snort@localhost;
4. grant create, insert, select, delete, update on snort.* to snort;