Difference between revisions of "Linux: Snort"
Jump to navigation
Jump to search
Rafahsolis (talk | contribs) (→Snort) |
Rafahsolis (talk | contribs) |
||
| Line 3: | Line 3: | ||
https://www.youtube.com/watch?v=cQeeko9J_Yw | https://www.youtube.com/watch?v=cQeeko9J_Yw | ||
=== Instalation === | === Instalation === | ||
| + | https://www.youtube.com/watch?v=ptIzGv1b9GQ<br /> | ||
| + | |||
#.- sudo apt-get install snort | #.- sudo apt-get install snort | ||
#.- sudo dpkg-reconfigure snort | #.- sudo dpkg-reconfigure snort | ||
| Line 19: | Line 21: | ||
#.- sudo su | #.- sudo su | ||
#.- snort -v | #.- snort -v | ||
| − | === | + | === Modes === |
| − | https:// | + | * Packet sniffer (snort -dev) |
| + | * Log Mode (snort -de -l <log_dir> | to view log use: tcpdump -r <log_file>) | ||
| + | * Intrusion detection sniffer (snort -c /etc/snort/snort.conf) | ||
| + | === Intrusion detection mode === | ||
| + | ==== Config file ==== | ||
| + | /etc/snort/snort.conf<br /> | ||
| + | snort -A full -d -c /etc/snort/snotr.conf -l <log_dir><br /> | ||
| + | /etc/snort/reference.config --> display additional information on alerts.<br /> | ||
| + | ==== Snort rules ==== | ||
| + | https://www.youtube.com/watch?v=RUmYojxy3Xw | ||
Revision as of 20:41, 19 April 2015
Snort
Intrusion detection system
https://www.youtube.com/watch?v=cQeeko9J_Yw
Instalation
https://www.youtube.com/watch?v=ptIzGv1b9GQ
- .- sudo apt-get install snort
- .- sudo dpkg-reconfigure snort
- .- sudo apt-get install mysql-server
- .- mysql -u root -localhost -p adminPassword
- .- create user 'snort'@'localhost' identified by 'snort';
- .- grant all privileges on *.* to 'snort'@'localhost' identified by 'snort';
- .- flush privileges;
- .- quit
- .- sudo apt-get install snort-mysql
- .- sudo dpkg-reconfigure -plow snort-mysql
- .- cd /usr/share/doc/snort/snort-mysql/
- .- zcat create_mysql.gz
- .- sudo apt-get install acidbase
- .- sudo gedit /etc/acidbase/database.php
- .- sudo su
- .- snort -v
Modes
- Packet sniffer (snort -dev)
- Log Mode (snort -de -l <log_dir> | to view log use: tcpdump -r <log_file>)
- Intrusion detection sniffer (snort -c /etc/snort/snort.conf)
Intrusion detection mode
Config file
/etc/snort/snort.conf
snort -A full -d -c /etc/snort/snotr.conf -l <log_dir>
/etc/snort/reference.config --> display additional information on alerts.