Aquesta wiki forma part dels materials d'un curs | |
|---|---|
| Curs: | SeguretatXarxesInformàtiques |
| Fitxers: | No hi ha fitxers |
| Repositori SVN: | https://[email protected]/svn/iceupc/SeguretatXarxesInform%C3%A0tiques |
| Usuari: | anonymous |
| Paraula de pas: | sense paraula de pas |
| Autors: | Sergi Tur Badenas |
Snort és utilitzat sobretot com un IDS (Intrusion Detection System) basat en xarxa (NIDS o Network IDS). Aquest tipus de IDS controlen un segment de xarxa. També pot funcionar com un analitzador de xarxa o sniffer de forma similar al que fan aplicacions com tcpdump o wireshark.
Snort pot funcionar tant com a IDS passiu (només detectar abusos en l'ús de la xarxa) com a IDS actiu (a més de detectar, realitzar alguna acció contra l'atac detectat).
$ sudo apt-get install snort
Paquets dependents:
libprelude2 snort snort-common snort-common-libraries snort-rules-default
Els paquets que instal·la snort són:
$ dpkg -l | grep snort ii snort 2.7.0-14 Flexible Network Intrusion Detection System ii snort-common 2.7.0-14 Flexible Network Intrusion Detection System ii snort-common-libraries 2.7.0-14 Flexible Network Intrusion Detection System ii snort-rules-default 2.7.0-14 Flexible Network Intrusion Detection System
Els fitxers executables són:
$ dpkg -L snort | grep bin /usr/sbin /usr/sbin/snort
$ dpkg -L snort-common | grep bin /usr/sbin /usr/sbin/snort-stat
Fitxers de configuració
$ dpkg -L snort | grep etc /etc /etc/cron.daily /etc/init.d /etc/init.d/snort /etc/logrotate.d /etc/logrotate.d/snort /etc/default /etc/default/snort /etc/ppp /etc/ppp/ip-down.d /etc/ppp/ip-down.d/snort /etc/ppp/ip-up.d /etc/ppp/ip-up.d/snort /etc/snort
$ dpkg -L snort-common | grep etc /etc /etc/cron.daily /etc/cron.daily/5snort /etc/snort /etc/snort/snort.conf /etc/snort/unicode.map /etc/snort/threshold.conf
Fitxers de normes:
$ dpkg -L snort-rules-default | grep etc /etc /etc/snort /etc/snort/rules /etc/snort/rules/attack-responses.rules /etc/snort/rules/backdoor.rules /etc/snort/rules/bad-traffic.rules /etc/snort/rules/chat.rules /etc/snort/rules/community-bot.rules /etc/snort/rules/community-deleted.rules /etc/snort/rules/community-dos.rules /etc/snort/rules/community-exploit.rules /etc/snort/rules/community-ftp.rules /etc/snort/rules/community-game.rules /etc/snort/rules/community-icmp.rules /etc/snort/rules/community-imap.rules /etc/snort/rules/community-inappropriate.rules /etc/snort/rules/community-mail-client.rules /etc/snort/rules/community-misc.rules /etc/snort/rules/community-nntp.rules /etc/snort/rules/community-oracle.rules /etc/snort/rules/community-policy.rules /etc/snort/rules/community-sip.rules /etc/snort/rules/community-smtp.rules /etc/snort/rules/community-sql-injection.rules /etc/snort/rules/community-virus.rules /etc/snort/rules/community-web-attacks.rules /etc/snort/rules/community-web-cgi.rules /etc/snort/rules/community-web-client.rules /etc/snort/rules/community-web-dos.rules /etc/snort/rules/community-web-iis.rules /etc/snort/rules/community-web-misc.rules /etc/snort/rules/community-web-php.rules /etc/snort/rules/ddos.rules /etc/snort/rules/deleted.rules /etc/snort/rules/dns.rules /etc/snort/rules/dos.rules /etc/snort/rules/experimental.rules /etc/snort/rules/exploit.rules /etc/snort/rules/finger.rules /etc/snort/rules/ftp.rules /etc/snort/rules/icmp-info.rules /etc/snort/rules/icmp.rules /etc/snort/rules/imap.rules /etc/snort/rules/info.rules /etc/snort/rules/local.rules /etc/snort/rules/misc.rules /etc/snort/rules/multimedia.rules /etc/snort/rules/mysql.rules /etc/snort/rules/netbios.rules /etc/snort/rules/nntp.rules /etc/snort/rules/oracle.rules /etc/snort/rules/other-ids.rules /etc/snort/rules/p2p.rules /etc/snort/rules/policy.rules /etc/snort/rules/pop2.rules /etc/snort/rules/pop3.rules /etc/snort/rules/porn.rules /etc/snort/rules/rpc.rules /etc/snort/rules/rservices.rules /etc/snort/rules/scan.rules /etc/snort/rules/shellcode.rules /etc/snort/rules/smtp.rules /etc/snort/rules/snmp.rules /etc/snort/rules/sql.rules /etc/snort/rules/telnet.rules /etc/snort/rules/tftp.rules /etc/snort/rules/virus.rules /etc/snort/rules/web-attacks.rules /etc/snort/rules/web-cgi.rules /etc/snort/rules/web-client.rules /etc/snort/rules/web-coldfusion.rules /etc/snort/rules/web-frontpage.rules /etc/snort/rules/web-iis.rules /etc/snort/rules/web-misc.rules /etc/snort/rules/web-php.rules /etc/snort/rules/x11.rules /etc/snort/sid-msg.map /etc/snort/gen-msg.map /etc/snort/community-sid-msg.map /etc/snort/classification.config /etc/snort/reference.config
Durant la instal·lació apareix la següent finestra:
Podem tornar a executar la configuració d'Snort en qualsevol moment executant:
$ sudo dpkg-reconfigure snort
Tal i com ens comenta apt-get al fer la instal·lació d'snort:
$ sudo apt-get install snort ... Paquets suggerits: snort-doc
Podem instal·lar la documentació amb:
$ sudo apt-get install snort-doc
$ cat /var/log/auth.log | /usr/sbin/snort-stat
$ ps aux | grep snort snort 9840 0.3 14.2 173916 147276 ? Ss 19:07 0:07 /usr/sbin/snort -m 027 -D -d -l /var/log/snort -u snort -g snort -c /etc/snort /snort.conf -S HOME_NET=[192.168.0.0/16] -i eth0 ...
El servei snort es pot controlar amb:
Acacha Wiki
$ sudo /etc/init.d/snort ...
Usage: /etc/init.d/snort {start|stop|restart|force-restart|reload|force-reload|status|config-check}
Les opcions per defecte es troben al fitxer:
$ cat /etc/default/snort # Parameters for the daemon # Add any additional parameteres here. PARAMS="-m 027 -D -d " # # Snort user # This user will be used to launch snort. Notice that the # preinst script of the package might do changes to the user # (home directory, User Name) when the package is upgraded or # reinstalled. So, do *not* change this to 'root' or to any other user # unless you are sure there is no problem with those changes being introduced. # SNORTUSER="snort" # # Logging directory # Snort logs will be dropped here and this will be the home # directory for the SNORTUSER. If you change this value you should # change the /etc/logrotate.d/snort definition too, otherwise logs # will not be rotated properly. # LOGDIR="/var/log/snort" # # Snort group # This is the group that the snort user will be added to. # SNORTGROUP="snort" # # Allow Snort's init.d script to work if the configured interfaces # are not available. Set this to yes if you configure Snort with # multiple interfaces but some might not be available on boot # (e.g. wireless interfaces) # # Note: In order for this to work the 'iproute' package needs to # be installed. ALLOW_UNAVAILABLE="no"
Segons el manual Unix d'snort:
Snort has three primary uses. It can be used as a straight packet sniffer like tcpdump(1), a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion detection system.
Snort té 2 modes de funcionament principals:
Snort com a analitzador de xarxa (sniffer) i logger
$ snort -dev
Ens anirà mostrant es paquets de la interfície de xarxa de forma similar al que pot fer tcpdump.
Podem guardar els paquets capturats amb
$ snort -dev -l log
El format del fitxers de captura és compatible amb tcpdump o wireshark però també permet altres formats.
Snort com a NIDS
$ snort -l log -dev -h 192.168.4.0/24 -c snort.conf
Recursos:
-dev imprime en pantalla la dirección IP y cabeceras TCP/UDP/ICMP, los datos que pasan por la interface de red con información bastante detallada.
-h 192.168.4.0/24 es el home network (nuestra red).
-c snort.conf indicamos que SNORT use el fichero de configuración de Snort con la lista de archivos de reglas y otros parámetros. Esta opción tiene una variante al cambiarse el archivo snort.conf por uno de reglas o rules personalizada.
Snort puede obtener los datos desde una interface de red -i eth0 o desde un archivo -r nombarchivo. Normalmente no hará fata indicarle la interface de red.
Accions per defecte d'Snort
Es poden definir accions pròpies...
TODO:
rule actions are used together to dynamically modify Snort's ruleset at runtime. These are the activate and dynamic actions. Rules that use the dynamic action are just like a log rule, except they will be considered only after they have been enabled by an activate rule. To accomplish this, Snort enforces the use of the activates and activated_by rule options in order to know what dynamic rules to enable once an activate rule has been triggered. In addition, dynamic rules are required to specify a count option in order for Snort to limit how many packets the rule will record.
El format de les normes d'snort és:
action proto src_ip src_port direction -> dst_ip dst_port (opcions)
NOTA: el operador -> indica la direcció del paquet. No es pot utilitza <- però si que es pot utilitzar l'operador bidireccional <>.
On action es qualsevol de les accions comentades anteriorment (log,alert,pass...). Després cal indicar unes condicions d'IP d'origen (es poden indicar adreces IP particulars o rangs de xarxa) i IP de destinació conjuntament amb port d'origen i destinació.
De les opcions les més importants són:
IMPORTANT: les opcions s'indiquen entre parèntesi, i cada opció ve separada per un ;. Les opcions són parells de valors--> variable:valor;variable:valor;variable:valor.
Exemple:
alert tcp 192.168.1.5 any -> any any (msg:"Traffic from 192.168.1.5";sid:1000000; rev:1;)
alert tcp any any -> any 22 (msg:"SSH incoming"; flow:stateless; flags:S+;)
Exemples:
Notificar tràfic des d'una IP concreta:
alert tcp 192.168.1.5 any -> any any (msg:"Traffic from 192.168.1.5";sid:1000000; rev:1;)
Connexió SSH:
alert tcp $HOME_NET 22 -> $EXTERNAL_NET any (msg:"SSH login from untrusted network"; flags: S; tag: session, 300, packets;)
alert tcp any any -> any 22 (msg:"Detectada connexió SSH"; flow:stateless; flags:S+;)
Recursos:
$ ls /etc/snort/rules/ attack-responses.rules community-mail-client.rules community-web-iis.rules imap.rules pop3.rules web-cgi.rules backdoor.rules community-misc.rules community-web-misc.rules info.rules porn.rules web-client.rules bad-traffic.rules community-nntp.rules community-web-php.rules local.rules rpc.rules web-coldfusion.rules chat.rules community-oracle.rules ddos.rules misc.rules rservices.rules web-frontpage.rules community-bot.rules community-policy.rules deleted.rules multimedia.rules scan.rules web-iis.rules community-deleted.rules community-sip.rules dns.rules mysql.rules shellcode.rules web-misc.rules community-dos.rules community-smtp.rules dos.rules netbios.rules smtp.rules web-php.rules community-exploit.rules community-sql-injection.rules experimental.rules nntp.rules snmp.rules x11.rules community-ftp.rules community-virus.rules exploit.rules oracle.rules sql.rules community-game.rules community-web-attacks.rules finger.rules other-ids.rules telnet.rules community-icmp.rules community-web-cgi.rules ftp.rules p2p.rules tftp.rules community-imap.rules community-web-client.rules icmp-info.rules policy.rules virus.rules
Si tenim problemes amb regles que no funcionen d'snort, podem intentar executar snort com a superusuari i no pas com a usuari snort.