Snort+barnyard2+postgresql— LinuxForum.Fans

21.09.2012 12:15 · отредактировано #275919

Всем примет. Решил поставить такую вот связку Snort+barnyard2+postgresql из исходников (чтоб версии посвежей были) на Debian 6.0.5, но столкнулся с проблемой. Выполнялось по оф мануалам.
1. После сборки не оказалось файла sid-msg.map, вероятней всего он идет вместе с правилами(я его копировал с другой машины с ubuntu 12.04)
2. После запуска он ничего не получает от snort.
Результат запуска: /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -G /etc/snort/gen-msg.map -S /etc/snort/sid-msg.map -d /var/log/snort -f snort.u2 -w /var/log/snort/bylog.waldo

Показать

Running in Continuous mode

--== Initializing Barnyard2 ==--
Initializing Input Plugins!
Initializing Output Plugins!
Parsing config file "/etc/snort/barnyard2.conf"
Log directory = /var/log/barnyard2
database: compiled support for (postgresql)
database: configured to use postgresql
database: schema version = 107
database: host = localhost
database: port = 5432
database: user = snort
database: database name = snort
database: sensor name = vmovs-testn:NULL
database: sensor id = 1
database: sensor cid = 1
database: data encoding = hex
database: detail level = full
database: ignore_bpf = no
database: using the "alert" facility

--== Initialization Complete ==--

______ -*> Barnyard2 <*-
/ ,,_ \ Version 2.1.9 (Build 263)
|o" )~| By the SecurixLive.com Team: http://www.securixlive.com/about.php
+ '''' + (C) Copyright 2008-2010 SecurixLive.

Snort by Martin Roesch & The Snort Team: http://www.snort.org/team.html
(C) Copyright 1998-2007 Sourcefire Inc., et al.

WARNING: Ignoring corrupt/truncated waldofile '/var/log/snort/bylog.waldo'
Waiting for new spool file

По завершении выдает следующее

Показать

===============================================================================
Record Totals:
Records: 0
Events: 0 (0.000%)
Packets: 0 (0.000%)
===============================================================================
Packet breakdown by protocol (includes rebuilt packets):
ETH: 0 (0.000%)
ETHdisc: 0 (0.000%)
VLAN: 0 (0.000%)
IPV6: 0 (0.000%)
IP6 EXT: 0 (0.000%)
IP6opts: 0 (0.000%)
IP6disc: 0 (0.000%)
IP4: 0 (0.000%)
IP4disc: 0 (0.000%)
TCP 6: 0 (0.000%)
UDP 6: 0 (0.000%)
ICMP6: 0 (0.000%)
ICMP-IP: 0 (0.000%)
TCP: 0 (0.000%)
UDP: 0 (0.000%)
ICMP: 0 (0.000%)
TCPdisc: 0 (0.000%)
UDPdisc: 0 (0.000%)
ICMPdis: 0 (0.000%)
FRAG: 0 (0.000%)
FRAG 6: 0 (0.000%)
ARP: 0 (0.000%)
EAPOL: 0 (0.000%)
ETHLOOP: 0 (0.000%)
IPX: 0 (0.000%)
OTHER: 0 (0.000%)
DISCARD: 0 (0.000%)
InvChkSum: 0 (0.000%)
S5 G 1: 0 (0.000%)
S5 G 2: 0 (0.000%)
Total: 0

Добавление к barnyard.conf

text

    output database: alert, postgresql, user=snort password=snort dbname=snort host=localhost port=5432

21.09.2012 12:58 #275941

Поправил вывод в snort.conf

text

 output unified2: filename snort.log, limit 128

Теперь barnyard2 нежелательный трафик видит, но в базу не пишет.
Результаты запуска

Показать

Running in Continuous mode

--== Initializing Barnyard2 ==--
Initializing Input Plugins!
Initializing Output Plugins!
Parsing config file "/etc/snort/barnyard2.conf"
Log directory = /var/log/barnyard2
database: compiled support for (postgresql)
database: configured to use postgresql
database: schema version = 107
database: host = localhost
database: port = 5432
database: user = snort
database: database name = snort
database: sensor name = vmovs-testn:NULL
database: sensor id = 1
database: sensor cid = 1
database: data encoding = hex
database: detail level = full
database: ignore_bpf = no
database: using the "alert" facility

--== Initialization Complete ==--

______ -*> Barnyard2 <*-
/ ,,_ \ Version 2.1.9 (Build 263)
|o" )~| By the SecurixLive.com Team: http://www.securixlive.com/about.php
+ '''' + (C) Copyright 2008-2010 SecurixLive.

Snort by Martin Roesch & The Snort Team: http://www.snort.org/team.html
(C) Copyright 1998-2007 Sourcefire Inc., et al.

WARNING: Ignoring corrupt/truncated waldofile '/var/log/snort/barnyard2.waldo'
Opened spool file '/var/log/snort/snort.log.1348212950'
Closing spool file '/var/log/snort/snort.log.1348212950'. Read 0 records
Opened spool file '/var/log/snort/snort.log.1348213650'
Closing spool file '/var/log/snort/snort.log.1348213650'. Read 0 records
Opened spool file '/var/log/snort/snort.log.1348216521'
Closing spool file '/var/log/snort/snort.log.1348216521'. Read 0 records
Opened spool file '/var/log/snort/snort.log.1348217594'
Closing spool file '/var/log/snort/snort.log.1348217594'. Read 12 records
Opened spool file '/var/log/snort/snort.log.1348217672'
Waiting for new data

По завершении выдает следующее

Показать

Record Totals:
Records: 68
Events: 0 (0.000%)
Packets: 68 (100.000%)
===============================================================================
Packet breakdown by protocol (includes rebuilt packets):
ETH: 68 (100.000%)
ETHdisc: 0 (0.000%)
VLAN: 0 (0.000%)
IPV6: 0 (0.000%)
IP6 EXT: 0 (0.000%)
IP6opts: 0 (0.000%)
IP6disc: 0 (0.000%)
IP4: 68 (100.000%)
IP4disc: 0 (0.000%)
TCP 6: 0 (0.000%)
UDP 6: 0 (0.000%)
ICMP6: 0 (0.000%)
ICMP-IP: 0 (0.000%)
TCP: 0 (0.000%)
UDP: 0 (0.000%)
ICMP: 68 (100.000%)
TCPdisc: 0 (0.000%)
UDPdisc: 0 (0.000%)
ICMPdis: 0 (0.000%)
FRAG: 0 (0.000%)
FRAG 6: 0 (0.000%)
ARP: 0 (0.000%)
EAPOL: 0 (0.000%)
ETHLOOP: 0 (0.000%)
IPX: 0 (0.000%)
OTHER: 0 (0.000%)
DISCARD: 0 (0.000%)
InvChkSum: 0 (0.000%)
S5 G 1: 0 (0.000%)
S5 G 2: 0 (0.000%)
Total: 68

21.09.2012 15:03 · отредактировано #275960

Добавил к своему правилу уровень опасности, теперь он видит такие пакеты как "события", но писать в базу отказывается

Показать

^C===============================================================================
Record Totals:
Records: 64
Events: 32 (50.000%)
Packets: 32 (50.000%)
===============================================================================
Packet breakdown by protocol (includes rebuilt packets):
ETH: 32 (100.000%)
ETHdisc: 0 (0.000%)
VLAN: 0 (0.000%)
IPV6: 0 (0.000%)
IP6 EXT: 0 (0.000%)
IP6opts: 0 (0.000%)
IP6disc: 0 (0.000%)
IP4: 32 (100.000%)
IP4disc: 0 (0.000%)
TCP 6: 0 (0.000%)
UDP 6: 0 (0.000%)
ICMP6: 0 (0.000%)
ICMP-IP: 0 (0.000%)
TCP: 0 (0.000%)
UDP: 0 (0.000%)
ICMP: 32 (100.000%)
TCPdisc: 0 (0.000%)
UDPdisc: 0 (0.000%)
ICMPdis: 0 (0.000%)
FRAG: 0 (0.000%)
FRAG 6: 0 (0.000%)
ARP: 0 (0.000%)
EAPOL: 0 (0.000%)
ETHLOOP: 0 (0.000%)
IPX: 0 (0.000%)
OTHER: 0 (0.000%)
DISCARD: 0 (0.000%)
InvChkSum: 0 (0.000%)
S5 G 1: 0 (0.000%)
S5 G 2: 0 (0.000%)
Total: 32
===============================================================================

22.09.2012 11:19 #276011

Со связкой разобрался.