Author: JD Durick
Problem
This recipe demonstrates how to configure Snort Acid on Solaris 9 using Nemesis as our test Acid console and washint1.XXXXX.org as our test remote sensor. Additionally, this recipe will show you how to configure snort so that alerts will be remotely logged to our mysql database on nemesis.XXXXX.org.
Requirements
1. Solaris 8 should be installed on nemesis.XXXXX.org.
2. Solaris 9 should be installed on washint1.XXXXX.org.
3. Compilation and configuration of the following packages/binaries is required:
a. snort 2.3.0
b. mysql 4.0.23 is necessary for nemesis and mysql client libraries are needed for all remote sensors. Mysql will (by default) be installed in the /usr/local/mysql directory.
c. libpcap is needed for snort to sniff the network.
d. libnet
e. apache 1.3.
f. openssl 0.9.
g. mod_ssl
h. php
i. jpgraph
j. adodb
k. acid
l. pcre
Solution
The solution is to install and configure Snort/ACID goes as follows:
1. Become a root user and log in as root.
# su - root
Set your shell/path and environment variables correctly:
# bash
# export LD_LIBRARY_PATH=/usr/local/lib:/usr/local/mysql/lib/mysql
2. Install mysql-4.0.23 on nemesis (version 4).
# gunzip -d mysql-4.0.23-sol8-sparc-local.gz
# pkgadd -d mysql-4.0.23-sol8-sparc-local
If you want the more recent mysql downloads, use a source distribution and compile it:
http://www.mysql.com/downloads
Compilation instustructions can be found:
http://www.mysql.com/doc/en/Solaris.html
3. Configuration of Mysql-4.0.23
# mysql -u root -p
Password for root local access:
mysql> set password fpr 'root'@'localhost'=password('your_password');
Delete unnecessary database:
mysql> drop database test
Delete the anonymous access:
mysql> connect mysql
mysql> delete from user where user="";
mysql> delete db where user="";
mysql> exit
Make soft link to mysql binary
# ln -s /usr/local/mysql/bin/mysql /usr/bin/mysql
4. Installation of snort-2.3.0
Installation of snort with
# gunzip -c snort-2.3.0.tar.gz| tar xvf -
# cd snort-2.3.0
# ./configure --with-mysql=/usr/local/mysql --host=sparc-sun-solaris2.9
# make;make install
If you don't have pcre installed, you may have to install that source before you install snort-2.3.0. After you install pcre, make sure your LD_LIBRARY_PATH is set correctly. Additionally, only the mysql client libraries are needed for installation of snort-2.3.0 to work with mysql. The mysql client libraries have to be installed on the remote snort sensor prior to compiling and installing snort 2.3.0.
Configuration of the snort.conf file for remote access to the database, make the following change:
output database: log, mysql, user=snort dbname=snort host=128.29.210.16
128.29.210.16 = nemesis.XXXXX.org or can correspond to any database being used.
5. Create database for snort
# mysql -u root -p
# create database snort
Install the tables using create_mysql and snortdb-extra.gz. To do this you must copy those files from your remote sensor, which in our case was washint1.XXXXX.org over to nemesis.XXXXX.org. Put these files into the /tmp directory. Then perform the following:
# source /tmp/create_mysql
# gunzip /tmp/snortdb-extra.gz
# source /tmp/snortdb-extra
This will create the necessary tables and data for the snort database within mysql. One interesting problem I found, snortdb-extra.gz does not come with some snort-2.3.0 builds. To get around this, you might have to go down one level to snort-2.2.0, then get the snortdb-extra.gz file from there.
Configure the good rights in the database mysql
# mysql> connect mysql
# mysql> set password for 'snort'@'localhost' = password('your_password');
# mysql> set password for 'snort'@'%' = password('your_password');
# flush privileges
6. Test whether or not the tables were created.
# mysql -u root -p
# mysql> connect snort
# mysql> show tables
+------------------+
| Tables_in_snort |
+------------------+
| acid_ag |
| acid_ag_alert |
| acid_event |
| acid_ip_cache |
| data |
| detail |
| encoding |
| event |
| flags |
| icmphdr |
| iphdr |
| opt |
| protocols |
| reference |
| reference_system |
| schema |
| sensor |
| services |
| sig_class |
| sig_reference |
| signature |
| tcphdr |
| udphdr |
+------------------+
23 rows in set (0.02 sec)
# mysql> exit
7. Installation of Apache & mod_ssl
Get a copy of openssl, mod_ssl, and apache from the following locations:
http://www.openssl.org/source/openssl-0.9.7e.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.22-1.3.33.tar.gz
http://www.apache.org/dist/httpd/apache_1.3.33.tar.gz
bash-2.05# gunzip -c openssl-0.9.7e.tar.gz | tar xvf -
bash-2.05# gunzip -c mod_ssl-2.8.22-1.3.33.tar.gz | tar xvf -
bash-2.05# gunzip -c apache_1.3.ee.tar.gz | tar xvf -
bash-2.05# cd openssl-0.9.7b
bash-2.05# sh config -fPIC
bash-2.05# make
bash-2.05# make test (optional)
bash-2.05# make install (optional)
bash-2.05# cd ../mod_ssl-2.8.22-1.3.33
bash-2.05# ./configure --with-apache=../apache_1.3.33 --with-ssl=../openssl-0.9.7e -- prefix=/usr/local/apache --enable-shared=ssl
bash-2.05# cd ../apache_1.3.33
bash-2.05# make
bash-2.05# make certificate TYPE=custom
bash-2.05# make install
Configure the httpd.conf file, I am assuming you know how to configure this configuration file.
I will use the path "/web" for the DocumentRoot in Apache for the rest of installation.
Test your configuration:
bash-2.05# ln -s /usr/local/apache/bin/apachectl /usr/local/bin/apache
bash-2.05# apache start
http://your_acid_computer/
bash-2.05# apache stop
bash-2.05# apache startssl
https://your_acid_computer/
8. PHP & Apache/mod_ssl configuration
Download php from: http://www.php.net/
wget http://us2.php.net/get/php-4.3.10.tar.gz/from/this/mirror
bash-2.05# gunzip -c php-4.3.10.tar.gz | tar xvf -
bash-2.05# cd ../php-4.3.10
bash-2.05# CFLAGS='-DEAPI' ./configure --with-apxs=/usr/local/apache/bin/apxs --with-mysql=/usr/local/mysql --with-zlib=/usr/local --with-gd
bash-2.05# make
bash-2.05# make install
Verify that all these lines have been added in your "httpd.conf" in "/usr/local/apache/conf" :
LoadModule php4_module libexec/libphp4.so
AddModule mod_php4.c
AddType application/x-httpd-php .php
You can add "index.php" in the DirectoryIndex property too.
Restart apache :
bash-2.05# apache stop
bash-2.05# apache startssl
Test your php configuration
Create a file "test.php" contening the following code :
and place it in your DocumentRoot, here it's "/web".
Open your browser and see the result :
https://your_acid_computer/test.php
If you see the date, it's OK.
9. Acid installation and corresponding packages. We are under the assumption that all your apache configuration files are under /web.
bash-2.05# gunzip -c jpgraph-1.12.1.tar.gz | tar xvf -
bash-2.05# gunzip -c adodb340.tgz | tar xvf -
bash-2.05# gunzip -c acid-0.9.6b23.tar.gz | tar xvf -
bash-2.05# cp -R jpgraph-1.12.1 /web/jpgraph
bash-2.05# cp -R adodb /web/
bash-2.05# cp -R acid /web/
bash-2.05# vi /web/acid/acid_conf.php
Configuration of Acid and corresponding packages
$DBlib_path = "../adodb";
$DBtype = "mysql";
$alert_dbname = "snort";
$alert_host = "localhost";
$alert_port = "";
$alert_user = "snort";
$alert_password = "your_snort_password";
$ChartLib_path = "../jpgraph/src";
You can verify your setup by the following way :
bash-2.05# mysql-u snort -p
mysql> connect snort
mysql> show tables;
+------------------+
| Tables_in_snort |
+------------------+
| acid_ag |
| acid_ag_alert |
| acid_event |
| acid_ip_cache |
| data |
| detail |
| encoding |
| event |
| icmphdr |
| iphdr |
| opt |
| reference |
| reference_system |
| schema |
| sensor |
| sig_class |
| sig_reference |
| signature |
| tcphdr |
| udphdr |
+------------------+
20 rows in set (0.00 sec)
mysql> exit
Final step:
bash-2.05# snort -devyq -c /usr/local/snort/etc/snort.conf -l /var/snort/log -D
https://your_acid_computer/acid/acid_main.php
You should now start seeing traffic to your mysql database. You might want to nmap your sensor or write a custom rule to verify it is actually working correctly.
