SNORT KURULUMU

SNORT KURULUMU;

Kurulum için paket dosyaları:

sudo apt install -y build-essential gcc libpcre3-dev zlib1g-dev libluajit-5.1-dev libpcap-dev openssl libssl-dev libnghttp2-dev libdumbnet-dev bison flex libdnet automake




Güncel Snort ve DAQ kütüphanesi sürümleri:


wget https://www.snort.org/downloads/snort/daq-2.0.7.tar.gz
tar xvzf daq-2.0.7.tar.gz
                      
cd daq-2.0.7
./configure && make && sudo make install
                      
wget https://www.snort.org/downloads/snort/snort-2.9.16.1.tar.gz
tar xvzf snort-2.9.16.1.tar.gz
                      
cd snort-2.9.16.1
./configure --enable-sourcefire && make && sudo make install




Snort'u test etmek için:

ldconfig

ln -s /usr/local/bin/snort /usr/sbin/snort

/usr/sbin/snort –V



Snort kullanımı için kullanıcı/grup oluşturma:

groupadd snort
useradd snort  –r  –s /sbin/nologin –c  SNORT_IDS  –g snort



Gerekli klasörleri oluşturma ve yetkileri verme:
# mkdir /etc/snort 
# mkdir /etc/snort/rules 
# mkdir /etc/snort/preproc_rules 
# mkdir /usr/local/lib/snort_dynamicrules 
# mkdir /etc/snort/so_rules
 
# touch /etc/snort/rules/black_list.rules
# touch /etc/snort/rules/white_list.rules 
# touch /etc/snort/rules/local.rules 
# touch /etc/snort/sid-msg.map
 
# mkdir /var/log/snort 
# mkdir /var/log/snort/archived_logs

 

# chmod -R 5775 /etc/snort 
# chmod -R 5775 /var/log/snort 
# chmod -R 5775 /var/log/snort/archived_logs 
# chmod -R 5775 /etc/snort/so_rules 
# chmod -R 5775 /usr/local/lib/snort_dynamicrules


 


# chown -R snort:snort /etc/snort 
# chown -R snort:snort /var/log/snort 
# chown -R snort:snort /usr/local/lib/snort_dynamicrules



Snort.conf dosyası için tüm kuralları yorum satırına alma # komutu:

# sed -i 's/include \$RULE\_PATH/#include \$RULE\_PATH/' /etc/snort/snort.conf



Snort'u Derleme ve Yeniden Başlatma Komutu:

snort -T -c /etc/snort/snort.conf -i  enp0s3


Kural Yapısı ve Kural yazma komutları:

# nano  /etc/snort/rules/local.rules

# alert icmp any any -> $HOME_NET any (msg:"Ping atılıyor."; GID:1; sid:10000001; rev:001; classtype:icmp-event;)

alert tcp any any -> $HOME_NET 21 (msg:"FTP denemesi gerceklestiriliyor"; sid:1000001; rev:1;) 


Snort'u Çalıştırma komutu:

# /usr/local/bin/snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i enp0s3