Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédente | |||
| elearning:workbooks:debian:11:sec:l107 [2025/12/04 09:30] – admin | elearning:workbooks:debian:11:sec:l107 [2025/12/04 15:40] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | |||
| - | SNORT | ||
| Version : **2026.01** | Version : **2026.01** | ||
| Ligne 25: | Ligne 23: | ||
| * LAB #2 - Mise en place du Système de Détection d' | * LAB #2 - Mise en place du Système de Détection d' | ||
| * 2.1 - Installation | * 2.1 - Installation | ||
| - | * 2.2 - Configuration | + | * 2.2 - Configuration |
| - | * Editer le fichier / | + | * 2.3 - Utilisation |
| - | * 2.3 - Utilisation | + | |
| - | * 2.4 - Utilisation de snort en mode " | + | |
| - | * 2.5 - Journalisation | + | |
| * LAB #3 - Mise en place du Système de Détection et de Prévention d' | * LAB #3 - Mise en place du Système de Détection et de Prévention d' | ||
| * 3.1 - Installation | * 3.1 - Installation | ||
| Ligne 599: | Ligne 594: | ||
| Snort est un **S**ystème de **D**étection d' | Snort est un **S**ystème de **D**étection d' | ||
| - | === Installation === | + | === 2.1 - Installation === |
| Sous Debian 12, **snort** n'est pas installé par défaut. Qui plus est **snort** ne se trouve pas dans les dépôts standards. | Sous Debian 12, **snort** n'est pas installé par défaut. Qui plus est **snort** ne se trouve pas dans les dépôts standards. | ||
| Ligne 607: | Ligne 602: | ||
| < | < | ||
| root@debian12: | root@debian12: | ||
| - | </ | ||
| - | |||
| - | < | ||
| - | root@debian12: | ||
| - | |||
| - | root@debian12: | ||
| - | Cloning into ' | ||
| - | remote: Enumerating objects: 21776, done. | ||
| - | remote: Counting objects: 100% (253/253), done. | ||
| - | remote: Compressing objects: 100% (151/151), done. | ||
| - | remote: Total 21776 (delta 165), reused 125 (delta 102), pack-reused 21523 (from 3) | ||
| - | Receiving objects: 100% (21776/ | ||
| - | Resolving deltas: 100% (18190/ | ||
| - | |||
| + | apt install build-essential libpcap-dev libpcre3-dev libnet1-dev zlib1g-dev luajit hwloc libdumbnet-dev bison flex liblzma-dev openssl libssl-dev pkg-config libhwloc-dev cmake cpputest libsqlite3-dev uuid-dev libcmocka-dev libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev libunwind-dev libcrep2-dev git -y | ||
| </ | </ | ||
| - | Téléchargez et désarchivez**snort** : | + | Créez ensuite le fichier **/ |
| < | < | ||
| - | root@debian12: | + | root@debian12: |
| - | root@debian12: | + | root@debian12: |
| - | Cloning into ' | + | /usr/ |
| - | remote: Enumerating objects: 123479, done. | + | /usr/local/lib64 |
| - | remote: Counting objects: 100% (12563/12563), done. | + | /usr/ |
| - | remote: Compressing objects: 100% (1891/1891), done. | + | |
| - | remote: Total 123479 (delta 11060), reused 10812 (delta 10672), pack-reused 110916 (from 5) | + | |
| - | Receiving objects: 100% (123479/123479), 91.19 MiB | 28.36 MiB/s, done. | + | |
| - | Resolving deltas: 100% (104741/104741), done. | + | |
| </ | </ | ||
| - | Créez | + | Créez |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# mkdir ~/snort-source-files |
| - | </ | + | |
| - | Dernièrement, | + | root@debian12: |
| - | < | + | root@debian12:~/ |
| - | [root@centos7 | + | Cloning into ' |
| + | remote: Enumerating objects: 2617, done. | ||
| + | remote: Counting objects: 100% (239/239), done. | ||
| + | remote: Compressing objects: 100% (78/78), done. | ||
| + | remote: Total 2617 (delta 199), reused 169 (delta 161), pack-reused 2378 (from 2) | ||
| + | Receiving objects: 100% (2617/ | ||
| + | Resolving deltas: 100% (1891/ | ||
| </ | </ | ||
| - | ==Options de la commande== | + | Procédez à la compilation et à l' |
| - | + | ||
| - | Les options | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~/snort-source-files# cd libdaq/ |
| - | ,, | + | root@debian12: |
| - | | + | + autoreconf -ivf --warnings=all |
| - | | + | autoreconf: export WARNINGS=all |
| - | Copyright (C) 2014-2017 Cisco and/or its affiliates. All rights reserved. | + | autoreconf: Entering directory '.' |
| - | Copyright (C) 1998-2013 Sourcefire, Inc., et al. | + | autoreconf: configure.ac: not using Gettext |
| - | Using libpcap version 1.5.3 | + | autoreconf: running: aclocal --force -I m4 |
| - | Using PCRE version: 8.32 2012-11-30 | + | autoreconf: configure.ac: tracing |
| - | Using ZLIB version: 1.2.7 | + | autoreconf: running: libtoolize --copy --force |
| + | libtoolize: putting auxiliary files in '.'. | ||
| + | libtoolize: copying file './ltmain.sh' | ||
| + | libtoolize: putting macros in AC_CONFIG_MACRO_DIRS, | ||
| + | libtoolize: copying file 'm4/libtool.m4' | ||
| + | libtoolize: copying file 'm4/ltoptions.m4' | ||
| + | libtoolize: copying file ' | ||
| + | libtoolize: copying file 'm4/ltversion.m4' | ||
| + | libtoolize: copying file 'm4/lt~obsolete.m4' | ||
| + | autoreconf: configure.ac: not using Intltool | ||
| + | autoreconf: configure.ac: | ||
| + | autoreconf: running: aclocal | ||
| + | autoreconf: running: / | ||
| + | configure.ac:27: warning: The macro `AC_PROG_CC_C99' | ||
| + | configure.ac:27: You should run autoupdate. | ||
| + | ./ | ||
| + | configure.ac: | ||
| + | autoreconf: running: / | ||
| + | autoreconf: running: automake --add-missing --copy --force-missing | ||
| + | configure.ac:29: installing './ | ||
| + | configure.ac: | ||
| + | configure.ac: | ||
| + | configure.ac: | ||
| + | configure.ac: | ||
| + | configure.ac: | ||
| + | api/ | ||
| + | parallel-tests: | ||
| + | autoreconf: Leaving directory ' | ||
| - | USAGE: snort [-options] <filter options> | + | root@debian12:~/snort-source-files/ |
| - | Options: | + | ... |
| - | -A Set alert mode: fast, full, console, test or none (alert file alerts only) | + | config.status: executing libtool commands |
| - | " | + | |
| - | -b Log packets in tcpdump format (much faster!) | + | |
| - | -B < | + | |
| - | -c < | + | |
| - | -C Print out payloads with character data only (no hex) | + | |
| - | -d Dump the Application Layer | + | |
| - | -D Run Snort in background (daemon) mode | + | |
| - | -e | + | |
| - | -f Turn off fflush() calls after binary log writes | + | |
| - | -F < | + | |
| - | -g < | + | |
| - | -G < | + | |
| - | -h < | + | |
| - | (for use with -l or -B, does NOT change $HOME_NET in IDS mode) | + | |
| - | -H Make hash tables deterministic. | + | |
| - | -i < | + | |
| - | -I Add Interface name to alert output | + | |
| - | -k < | + | |
| - | -K < | + | |
| - | -l < | + | |
| - | -L < | + | |
| - | -M Log messages to syslog (not alerts) | + | |
| - | -m < | + | |
| - | -n < | + | |
| - | -N Turn off logging (alerts still work) | + | |
| - | -O | + | |
| - | -p | + | |
| - | -P < | + | |
| - | -q | + | |
| - | -Q | + | |
| - | -r < | + | |
| - | -R < | + | |
| - | -s Log alert messages to syslog | + | |
| - | -S < | + | |
| - | -t < | + | |
| - | -T Test and report on the current Snort configuration | + | |
| - | -u < | + | |
| - | -U Use UTC for timestamps | + | |
| - | -v Be verbose | + | |
| - | -V Show version number | + | |
| - | -X Dump the raw packet data starting at the link layer | + | |
| - | -x Exit if Snort configuration problems occur | + | |
| - | | + | |
| - | -Z < | + | |
| - | -? Show this information | + | |
| - | <Filter Options> are standard BPF options, as seen in TCPDump | + | |
| - | Longname options and their corresponding single char version | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | --treat-drop-as-alert | + | |
| - | | + | |
| - | | + | |
| - | --enable-inline-test | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | for < | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | takes from signaling until DAQ_Stop() is called. | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | --daq < | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | </ | + | libdaq 3.0.23 |
| - | ===Configuration de Snort=== | + | prefix: |
| + | sysconfdir: | ||
| + | libdir: | ||
| + | includedir: | ||
| - | Snort a besoin de règles pour fonctionner correctement. Ces règles sont disponibles sous trois formes différentes | + | cc: gcc |
| + | cppflags: | ||
| + | am_cppflags: | ||
| + | cflags: | ||
| + | am_cflags: | ||
| + | ldflags: | ||
| + | am_ldflags: | ||
| + | libs: | ||
| - | * **Community** - règles de base disponibles à tout le monde, | + | code_coverage_enabled: |
| - | * **Registered** - règles disponibles à toute personne possédant un compte gratuit sur le site **[[http:// | + | code_coverage_cppflags: |
| - | | + | |
| + | code_coverage_ldflags: | ||
| - | Le répertoire rules est donc vide lors de l' | + | Build AFPacket DAQ module.. |
| + | Build BPF DAQ module....... : yes | ||
| + | Build Divert DAQ module.... : no | ||
| + | Build Dump DAQ module...... : yes | ||
| + | Build FST DAQ module....... : yes | ||
| + | Build netmap DAQ module.... : no | ||
| + | Build NFQ DAQ module....... : yes | ||
| + | Build PCAP DAQ module...... : yes | ||
| + | Build Savefile DAQ module.. : yes | ||
| + | Build Trace DAQ module..... : yes | ||
| + | Build GWLB DAQ module...... : yes | ||
| - | < | + | root@debian12:~/ |
| - | [root@centos7 | + | ... |
| - | [root@centos7 | + | make[2]: Leaving directory '/root/snort-source-files/libdaq/example' |
| + | Making all in test | ||
| + | make[2]: Entering directory '/ | ||
| + | make[2]: Nothing to be done for ' | ||
| + | make[2]: Leaving directory '/ | ||
| + | make[2]: Entering directory '/ | ||
| + | make[2]: Leaving directory '/ | ||
| + | make[1]: Leaving directory '/ | ||
| + | |||
| + | root@debian12:~/ | ||
| + | ... | ||
| + | ---------------------------------------------------------------------- | ||
| + | / | ||
| + | / | ||
| + | make[2]: Leaving directory '/ | ||
| + | make[1]: Leaving directory '/ | ||
| + | Making install in example | ||
| + | make[1]: Entering directory '/ | ||
| + | make[2]: Entering directory '/ | ||
| + | / | ||
| + | /bin/bash ../ | ||
| + | libtool: install: / | ||
| + | libtool: install: / | ||
| + | make[2]: Nothing to be done for ' | ||
| + | make[2]: Leaving directory '/ | ||
| + | make[1]: Leaving directory '/ | ||
| + | Making install in test | ||
| + | make[1]: Entering directory '/ | ||
| + | make[2]: Entering directory '/ | ||
| + | make[2]: Nothing to be done for ' | ||
| + | make[2]: Nothing to be done for ' | ||
| + | make[2]: Leaving directory '/ | ||
| + | make[1]: Leaving directory '/ | ||
| + | make[1]: Entering directory '/ | ||
| + | make[2]: Entering directory '/ | ||
| + | make[2]: Nothing to be done for ' | ||
| + | / | ||
| + | / | ||
| + | make[2]: Leaving directory '/ | ||
| + | make[1]: Leaving directory '/ | ||
| </ | </ | ||
| - | |||
| - | Téléchargez les règles **Registered** grâce au lien suivant contenant un **oinkcode** : | ||
| < | < | ||
| - | [root@centos7 ~]# wget https:// | ||
| </ | </ | ||
| - | Ensuite, saisissez les commandes suivantes | + | Téléchargez et désarchivez**snort** |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~/snort-source-files/libdaq# cd .. |
| - | [root@centos7 | + | |
| - | app-detect.rules | + | root@debian12:~/snort-source-files# git clone https:// |
| - | attack-responses.rules file-java.rules nntp.rules | + | Cloning into ' |
| - | backdoor.rules file-multimedia.rules | + | remote: Enumerating objects: 123479, done. |
| - | bad-traffic.rules | + | remote: Counting objects: 100% (12552/ |
| - | blacklist.rules | + | remote: Compressing objects: 100% (1884/ |
| - | botnet-cnc.rules | + | remote: Total 123479 (delta 11054), reused 10808 (delta 10668), pack-reused 110927 (from 5) |
| - | browser-chrome.rules finger.rules | + | Receiving objects: 100% (123479/ |
| - | browser-firefox.rules | + | Resolving deltas: 100% (104744/ |
| - | browser-ie.rules | + | |
| - | browser-other.rules | + | |
| - | browser-plugins.rules | + | |
| - | browser-webkit.rules | + | |
| - | chat.rules | + | |
| - | content-replace.rules | + | |
| - | ddos.rules | + | |
| - | deleted.rules | + | |
| - | dns.rules | + | |
| - | dos.rules | + | |
| - | experimental.rules | + | |
| - | exploit-kit.rules | + | |
| - | exploit.rules | + | |
| - | file-executable.rules | + | |
| - | file-flash.rules | + | |
| - | file-identify.rules | + | |
| </ | </ | ||
| - | <WRAP center round important 50%> | + | Procédez à la compilation et à l' |
| - | **Important** - Si vous utilisez **snort** régulièrement, | + | |
| - | </ | + | |
| - | == Editer le fichier /etc/snort/snort.conf == | + | < |
| + | root@debian12: | ||
| - | Lancez vi pour éditer le fichier **/etc/snort/snort.conf** : | + | root@debian12: |
| - | + | ||
| - | Modifiez la ligne qui commence par **ipvar HOME_NET** pour que celle-ci comporte l' | + | |
| - | + | ||
| - | < | + | |
| - | ... | + | |
| - | ipvar HOME_NET 10.0.2.0/24 | + | |
| ... | ... | ||
| - | </ | + | ------------------------------------------------------- |
| + | snort version 3.10.0.0 | ||
| - | Dans le cas où vous êtes connecté à deux ou à plusieurs réseaux directement, | + | Install options: |
| + | prefix: | ||
| + | includes: | ||
| + | plugins: | ||
| - | ipvar HOME_NET [adresse_réseau_1 ( p.e. 10.0.2.0/24 ), adresse_réseau_2 ( p.e. 10.0.0.0/8 )] | + | Compiler options: |
| + | CC: /usr/bin/cc | ||
| + | CXX: / | ||
| + | CFLAGS: | ||
| + | CXXFLAGS: | ||
| + | EXE_LDFLAGS: | ||
| + | MODULE_LDFLAGS: | ||
| - | Vérifiez la présence de les lignes qui commencent par **var RULE_PATH**, | + | Feature options: |
| + | DAQ Modules: | ||
| + | libatomic: | ||
| + | Hyperscan: OFF | ||
| + | ICONV: | ||
| + | Libunwind: | ||
| + | LZMA: ON | ||
| + | RPC DB: | ||
| + | SafeC: | ||
| + | TCMalloc: | ||
| + | JEMalloc: | ||
| + | UUID: ON | ||
| + | NUMA: ON | ||
| + | LibML: | ||
| + | ------------------------------------------------------- | ||
| - | < | + | -- Configuring done |
| - | ... | + | -- Generating done |
| - | var RULE_PATH | + | -- Build files have been written to: /root/snort-source-files/snort3/build |
| - | var SO_RULE_PATH ../ | + | |
| - | var PREPROC_RULE_PATH ../ | + | |
| - | ... | + | |
| - | </file> | + | |
| - | Modifiez les deux lignes suivantes afin d' | + | root@debian12:~/ |
| - | < | + | root@debian12: |
| ... | ... | ||
| - | var WHITE_LIST_PATH | + | [ 98%] Built target preprocessor_states |
| - | var BLACK_LIST_PATH | + | [ 98%] Building CXX object tools/snort2lua/CMakeFiles/snort2lua.dir/ |
| - | ... | + | [ 98%] Building CXX object tools/snort2lua/CMakeFiles/snort2lua.dir/ |
| - | </file> | + | [ 98%] Linking CXX executable snort2lua |
| + | [ 98%] Built target snort2lua | ||
| + | [ 98%] Building C object daqs/ | ||
| + | [ 98%] Linking C shared module daq_file.so | ||
| + | [ 98%] Built target daq_file | ||
| + | [ 98%] Building C object daqs/CMakeFiles/ | ||
| + | [100%] Linking C shared module daq_hext.so | ||
| + | [100%] Built target daq_hext | ||
| - | Décommentez la ligne qui commence par **ooutput unified2** concernant la journalisation et supprimez le mot **nostamp** | + | root@debian12:~/ |
| - | + | ||
| - | < | + | |
| ... | ... | ||
| - | # unified2 | + | -- Up-to-date: / |
| - | # Recommended for most installs | + | -- Installing: / |
| - | output unified2: filename merged.log, limit 128, mpls_event_types, | + | -- Installing: / |
| - | ... | + | -- Installing: / |
| - | </file> | + | -- Installing: / |
| - | + | -- Installing: / | |
| - | Commentez ensuite la ligne commençant par **dynamicdetection directory** | + | -- Installing: |
| - | + | -- Installing: / | |
| - | < | + | -- Installing: |
| - | # path to dynamic rules libraries | + | |
| - | # dynamicdetection directory | + | |
| </ | </ | ||
| - | Créez ensuite les deux fichiers ci-dessous | + | Dernièrement, |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~/snort-source-files/snort3/build# echo $PATH |
| - | [root@centos7 ~]# touch /etc/snort/rules/black_list.rules | + | /usr/local/sbin:/usr/ |
| - | </code> | + | |
| - | Modifiez maintenant le fichier **/etc/sysconfig/snort** : | + | root@debian12: |
| - | < | + | root@debian12: |
| - | ... | + | / |
| - | #### General Configuration | + | |
| - | # What interface should | + | root@debian12: |
| - | # This is -i {interface} on the command line | + | |
| - | # This is the snort.conf config interface: {interface} directive | + | |
| - | # INTERFACE=eth0 | + | |
| - | INTERFACE=enp0s3 | + | |
| - | # | + | |
| - | # The following two options are not directly supported on the command line | + | |
| - | # or in the conf file and assume the same Snort configuration for all | + | |
| - | # instances | + | |
| - | ... | + | |
| - | </ | + | |
| - | Vérifiez le fichier de configuration | + | root@debian12:~/ |
| + | # ~/.profile: executed by Bourne-compatible login shells. | ||
| - | < | + | if [ " |
| - | [root@centos7 | + | |
| - | ... | + | . ~/.bashrc |
| - | --== Initialization Complete ==-- | + | fi |
| + | fi | ||
| - | ,, | + | PATH=/usr/local/snort/bin: |
| - | o" | + | export $PATH |
| - | '''' | + | |
| - | | + | |
| - | Copyright (C) 1998-2013 Sourcefire, Inc., et al. | + | |
| - | Using libpcap version 1.5.3 | + | |
| - | Using PCRE version: 8.32 2012-11-30 | + | |
| - | Using ZLIB version: 1.2.7 | + | |
| - | Rules Engine: SF_SNORT_DETECTION_ENGINE | + | mesg n 2> /dev/null || true |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | Snort successfully validated the configuration! | + | |
| - | Snort exiting | + | |
| </ | </ | ||
| - | === Utilisation | + | Vérifiez la bonne installation |
| - | + | ||
| - | Pour visualiser les paquets à l'aide de snort, saisissez la commande suivante | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~/snort-source-files/snort3/build# |
| - | ... | + | |
| - | [root@centos7 ~]# ^C | + | |
| - | </ | + | |
| - | <WRAP center round important 50%> | + | ,, |
| - | **Important** - Notez l'utilisation de la combinaison de touches < | + | o" |
| - | </WRAP> | + | '''' |
| - | + | http://snort.org/ | |
| - | Pour surveiller une interface réseau en particulier, saisissez la commande suivante : | + | Copyright (C) 2014-2025 Cisco and/or its affiliates. All rights reserved. |
| - | + | Copyright (C) 1998-2013 Sourcefire, Inc., et al. | |
| - | < | + | Using DAQ version 3.0.23 |
| - | [root@centos7 ~]# snort -vd -i enp0s3 -c / | + | Using libpcap version 1.10.3 (with TPACKET_V3) |
| - | ... | + | Using LuaJIT version 2.1.0-beta3 |
| - | [root@centos7 ~]# ^C | + | Using LZMA version 5.4.1 |
| + | Using OpenSSL 3.0.17 1 Jul 2025 | ||
| + | Using PCRE2 version 10.42 2022-12-11 | ||
| + | Using ZLIB version 1.2.13 | ||
| </ | </ | ||
| - | === Utilisation | + | ==Options |
| - | + | ||
| - | Pour rediriger la sortie à l' | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~/snort-source-files/snort3/build# |
| - | ... | + | |
| - | [root@centos7 ~]# ^C | + | |
| - | </ | + | |
| - | ===Journalisation=== | + | Snort has several options to get more help: |
| - | Constatez le contenu de **/ | + | -? list command line options (same as --help) |
| + | --help this overview of help | ||
| + | --help-commands [<module prefix>] output matching commands | ||
| + | --help-config [<module prefix>] output matching config options | ||
| + | --help-counts [<module prefix>] output matching peg counts | ||
| + | --help-limits print the int upper bounds denoted by max* | ||
| + | --help-module < | ||
| + | --help-modules list all available modules with brief help | ||
| + | --help-modules-json dump description of all available modules in JSON format | ||
| + | --help-plugins list all available plugins with brief help | ||
| + | --help-options [<option prefix>] output matching command line options | ||
| + | --help-signals dump available control signals | ||
| + | --list-buffers output available inspection buffers | ||
| + | --list-builtin [<module prefix>] output matching builtin rules | ||
| + | --list-gids [<module prefix>] output matching generators | ||
| + | --list-modules [<module type>] list all known modules | ||
| + | --list-plugins list all known modules | ||
| + | --show-plugins list module and plugin versions | ||
| - | < | + | --help* and --list* options preempt other processing so should be last on the |
| - | [root@centos7 ~]# ls / | + | command line since any following options are ignored. |
| - | merged.log snort.log.1501937132 | + | --markup and --plugin-path take effect, place them ahead of the help or list |
| - | </ | + | options. |
| - | Constatez le contenu du fichier de journalisation : | + | Options that filter output based on a matching prefix, such as --help-config |
| - | + | won't output anything if there is no match. If no prefix is given, everything | |
| - | < | + | matches. |
| - | [root@centos7 ~]# tail / | + | |
| - | + | ||
| - | ����; | + | |
| - | + | ||
| - | �Ҡ��3��; | + | |
| - | + | ||
| - | ����; | + | |
| - | ������]l�S�����W�h���օYO<' | + | |
| - | + | ||
| - | ����_��������օY���RT5' | + | |
| - | + | ||
| - | �Ҡ����_P�����G}& | + | |
| + | Report bugs to bugs@snort.org. | ||
| </ | </ | ||
| - | Ce fichier étant au format **PCAP binaire**, vous pouvez le lire avec la commande suivante : | + | Snort 3 utilise des modules. Pour consulter la liste des modules, utilisez |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~/snort-source-files/snort3/build# |
| + | ac_bnfa (search_engine): | ||
| + | ac_full (search_engine): | ||
| + | ack (ips_option): | ||
| + | active (basic): configure responses | ||
| + | address_space_selector (policy_selector): | ||
| + | alert (ips_action): | ||
| + | alert_csv (logger): output event in csv format | ||
| + | alert_fast (logger): output event with brief text format | ||
| + | alert_full (logger): output event with full packet dump | ||
| + | alert_json (logger): output event in json format | ||
| + | alert_syslog (logger): output event to syslog | ||
| + | alert_talos (logger): output event in Talos alert format | ||
| + | alert_unixsock (logger): output event over unix socket | ||
| + | alerts (basic): configure alerts | ||
| + | appid (inspector): | ||
| + | appids (ips_option): | ||
| + | arp (codec): support for address resolution protocol | ||
| + | arp_spoof (inspector): | ||
| + | attribute_table (basic): configure hosts loading | ||
| + | auth (codec): support for IP authentication header | ||
| + | back_orifice (inspector): | ||
| + | base64_decode (ips_option): | ||
| + | ber_data (ips_option): | ||
| + | ber_skip (ips_option): | ||
| + | binder (inspector): | ||
| + | block (ips_action): | ||
| + | bufferlen (ips_option): | ||
| + | byte_extract (ips_option): | ||
| + | byte_jump (ips_option): | ||
| + | byte_math (ips_option): | ||
| + | byte_test (ips_option): | ||
| + | cip (inspector): | ||
| + | cip_attribute (ips_option): | ||
| + | cip_class (ips_option): | ||
| + | cip_conn_path_class (ips_option): | ||
| + | cip_instance (ips_option): | ||
| + | cip_req (ips_option): | ||
| + | cip_rsp (ips_option): | ||
| + | cip_service (ips_option): | ||
| + | cip_status (ips_option): | ||
| + | ciscometadata (codec): support for cisco metadata | ||
| + | classifications (basic): define rule categories with priority | ||
| + | classtype (ips_option): | ||
| + | content (ips_option): | ||
| + | cvs (ips_option): | ||
| + | daq (basic): configure packet acquisition interface | ||
| + | dce_http_proxy (inspector): | ||
| + | dce_http_server (inspector): | ||
| + | dce_iface (ips_option): | ||
| + | dce_opnum (ips_option): | ||
| + | dce_smb (inspector): | ||
| + | dce_stub_data (ips_option): | ||
| + | dce_tcp (inspector): | ||
| + | dce_udp (inspector): | ||
| + | decode (basic): general decoder rules | ||
| + | --More-- | ||
| </ | </ | ||
| - | Notez que ce fichier peut aussi être lu par la commande **tcpdump** : | + | Pour obtenir une aide sur un module spécifique, |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~/snort-source-files/snort3/build# |
| - | reading from file /var/log/snort/ | + | |
| - | 16: | + | |
| - | 40, length 676 | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | 16: | + | |
| - | --More-- | + | |
| - | </ | + | ac_bnfa |
| - | <WRAP center round important 50%> | ||
| - | **Important** - Vous pouvez utiliser le logiciel Wireshark pour visulaiser le contenu du fichier en mode graphique. | ||
| - | </ | ||
| - | Dernièrement, | + | Help: Aho-Corasick Binary NFA (low memory, low performance) MPSE |
| - | # snort -de -l / | + | Type: search_engine |
| - | <WRAP center round important 50%> | + | Usage: global |
| - | **Important** - Notez l' | + | |
| - | </ | + | |
| - | Pour lancer snort en arrière plan afin de surveiller l' | + | Peg counts: |
| - | < | + | ac_bnfa.searches: number of search attempts |
| - | [root@centos7 ~]# / | + | ac_bnfa.matches: number of times a match was found (sum) |
| - | [1] 19281 | + | ac_bnfa.bytes: total bytes searched (sum) |
| - | [root@centos7 ~]# Spawning daemon child... | + | |
| - | My daemon child 19401 lives... | + | |
| - | Daemon parent exiting | + | |
| - | ^C | + | |
| - | [1]+ Done / | + | |
| - | [root@centos7 ~]# ps aux | grep snort | + | |
| - | snort 19401 0.0 24.6 850984 504544 ? | + | |
| - | root | + | |
| </ | </ | ||
| - | Pour arrêter ce processus, utilisez al commande | + | Dernièrement, vous pouvez obtenir de l'aide sur la configuration de snort avec la commande |
| < | < | ||
| - | [root@centos7 ~]# ps aux | grep snort | + | root@debian12:~/snort-source-files/snort3/build# |
| - | snort 19401 0.0 24.6 850984 504692 ? | + | interval ack.~range: check if TCP ack value is 'value | min<> |
| - | root | + | int active.attempts = 0: number of TCP packets sent per response (with varying sequence numbers) { 0:255 } |
| - | [root@centos7 ~]# kill 19401 | + | string active.device: use ' |
| - | [root@centos7 ~]# ps aux | grep snort | + | string active.dst_mac: |
| - | root | + | int active.max_responses = 0: maximum number of responses { 0:255 } |
| + | int active.min_interval | ||
| + | string address_space_selector[].addr_spaces: | ||
| + | string address_space_selector[].file: use configuration in given file | ||
| + | bool alert_csv.file = false: output to alert_csv.txt instead of stdout | ||
| + | multi alert_csv.fields = ' | ||
| + | pkts | dir | dst_addr | dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | flowstart_time | geneve_vni | gid | icmp_code | icmp_id | icmp_seq | icmp_type | iface | ip_id | ip_len | msg | mpls | pkt_ge | ||
| + | n | pkt_len | pkt_num | priority | proto | rev | rule | seconds | server_bytes | server_pkts | service | sgt| sid | src_addr | src_ap | src_port | target | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | ti | ||
| + | mestamp | tos | ttl | udp_len | vlan } | ||
| + | int alert_csv.limit = 0: set maximum size in MB before rollover (0 is unlimited) { 0:maxSZ } | ||
| + | string alert_csv.separator = ', ': separate fields with this character sequence | ||
| + | bool alert_fast.file = false: output to alert_fast.txt instead of stdout | ||
| + | bool alert_fast.packet = false: output packet dump with alert | ||
| + | enum alert_fast.buffers = ' | ||
| + | int alert_fast.buffers_depth = 0: number of IPS buffer bytes to dump per buffer (0 is unlimited) { 0:maxSZ } | ||
| + | int alert_fast.limit = 0: set maximum size in MB before rollover (0 is unlimited) { 0:maxSZ } | ||
| + | bool alert_full.file = false: output to alert_full.txt instead of stdout | ||
| + | int alert_full.limit = 0: set maximum size in MB before rollover (0 is unlimited) { 0:maxSZ } | ||
| + | bool alert_json.file = false: output to alert_json.txt instead of stdout | ||
| + | multi alert_json.fields = ' | ||
| + | _pkts | dir | dst_addr | dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | flowstart_time | geneve_vni | gid | icmp_code | icmp_id | icmp_seq | icmp_type | iface | ip_id | ip_len | msg | mpls | pkt_g | ||
| + | en | pkt_len | pkt_num | priority | proto | rev | rule | seconds | server_bytes | server_pkts | service | sgt| sid | src_addr | src_ap | src_port | target | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | t | ||
| + | imestamp | tos | ttl | udp_len | vlan } | ||
| + | int alert_json.limit = 0: set maximum size in MB before rollover (0 is unlimited) { 0:maxSZ } | ||
| + | string alert_json.separator = ', ': separate fields with this character sequence | ||
| + | enum alert_syslog.facility = ' | ||
| + | enum alert_syslog.level = ' | ||
| + | multi alert_syslog.options: | ||
| + | bool alerts.alert_with_interface_name = false: include interface in alert info (fast, full, or syslog only) | ||
| + | int alerts.detection_filter_memcap = 1048576: set available MB of memory for detection_filters { 0:max32 } | ||
| + | int alerts.event_filter_memcap = 1048576: set available MB of memory for event_filters { 0:max32 } | ||
| + | bool alerts.log_references = false: include rule references in alert info (full only) | ||
| + | string alerts.order: | ||
| + | int alerts.rate_filter_memcap = 1048576: set available MB of memory for rate_filters { 0:max32 } | ||
| + | string alerts.reference_net: | ||
| + | string alerts.tunnel_verdicts: | ||
| + | int appid.memcap | ||
| + | bool appid.log_stats = false: enable logging of appid statistics | ||
| + | int appid.app_stats_period = 300: time period for collecting and logging appid statistics { 1:max32 } | ||
| + | int appid.app_stats_rollover_size = 20971520: max file size for appid stats before rolling over the log file { 0:max32 } | ||
| + | string appid.app_detector_dir: | ||
| + | bool appid.list_odp_detectors = false: enable logging of odp detectors statistics | ||
| + | string appid.tp_appid_path: | ||
| + | string appid.tp_appid_config: | ||
| + | bool appid.tp_appid_stats_enable: | ||
| + | bool appid.tp_appid_config_dump: | ||
| + | bool appid.log_all_sessions = false: enable logging of all appid sessions | ||
| + | bool appid.enable_rna_filter = false: monitor only the networks specified in rna configuration | ||
| + | string appid.rna_conf_path: | ||
| + | string appids.~: comma separated list of application names | ||
| + | ip4 arp_spoof.hosts[].ip: | ||
| + | --More-- | ||
| </ | </ | ||
| - | ====LAB #3 - Mise en place du Système | + | ===2.2 - Configuration |
| - | Portsentry est un **S**ystème | + | Pour vérifier la configuration actuelle |
| - | + | ||
| - | === Installation === | + | |
| - | + | ||
| - | Sous RHEL/CentOS 7, **portsentry** n'est pas installé par défaut. Qui plus est **portsentry** ne se trouve pas dans les dépôts standards. Installez donc le paquet **portsentry-1.2-1.el5.x86_64.rpm** à partir de l'URL ci-dessous | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~/snort-source-files/snort3/build# cd ~ |
| - | Loaded plugins: fastestmirror, | + | |
| - | portsentry-1.2-1.el5.x86_64.rpm | + | |
| - | Examining | + | |
| - | Marking / | + | |
| - | Resolving Dependencies | + | |
| - | --> Running transaction check | + | |
| - | ---> Package portsentry.x86_64 0:1.2-1.el5 will be installed | + | |
| - | --> Finished Dependency Resolution | + | |
| - | adobe-linux-x86_64 | + | |
| - | base/ | + | |
| - | extras/ | + | |
| - | updates/ | + | |
| - | Dependencies Resolved | + | root@debian12: |
| - | + | -------------------------------------------------- | |
| - | ======================================================================================================================================= | + | o" |
| - | Package | + | -------------------------------------------------- |
| - | ======================================================================================================================================= | + | Loading / |
| - | Installing: | + | Loading snort_defaults.lua: |
| - | portsentry | + | Finished snort_defaults.lua: |
| - | + | output | |
| - | Transaction Summary | + | active |
| - | ======================================================================================================================================= | + | alerts |
| - | Install | + | daq |
| - | + | decode | |
| - | Total size: 114 k | + | host_cache |
| - | Installed size: 114 k | + | host_tracker |
| - | Is this ok [y/d/N]: y | + | hosts |
| + | network | ||
| + | packets | ||
| + | process | ||
| + | search_engine | ||
| + | so_proxy | ||
| + | stream | ||
| + | stream_ip | ||
| + | stream_icmp | ||
| + | stream_udp | ||
| + | stream_user | ||
| + | stream_file | ||
| + | arp_spoof | ||
| + | back_orifice | ||
| + | imap | ||
| + | netflow | ||
| + | normalizer | ||
| + | pop | ||
| + | sip | ||
| + | ssh | ||
| + | ssl | ||
| + | telnet | ||
| + | cip | ||
| + | dnp3 | ||
| + | iec104 | ||
| + | mms | ||
| + | modbus | ||
| + | opcua | ||
| + | s7commplus | ||
| + | dce_smb | ||
| + | dce_tcp | ||
| + | dce_udp | ||
| + | dce_http_proxy | ||
| + | dce_http_server | ||
| + | gtp_inspect | ||
| + | port_scan | ||
| + | smtp | ||
| + | ftp_server | ||
| + | ftp_client | ||
| + | ftp_data | ||
| + | http_inspect | ||
| + | http2_inspect | ||
| + | file_policy | ||
| + | js_norm | ||
| + | appid | ||
| + | wizard | ||
| + | ips | ||
| + | binder | ||
| + | references | ||
| + | classifications | ||
| + | file_id | ||
| + | rpc_decode | ||
| + | dns | ||
| + | stream_tcp | ||
| + | trace | ||
| + | Finished | ||
| + | Loading file_id.rules_file: | ||
| + | Loading file_magic.rules: | ||
| + | Finished file_magic.rules: | ||
| + | Finished file_id.rules_file: | ||
| + | -------------------------------------------------- | ||
| + | ips policies rule stats | ||
| + | id loaded | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | rule counts | ||
| + | total rules loaded: 219 | ||
| + | text rules: 219 | ||
| + | option chains: 219 | ||
| + | chain headers: | ||
| + | -------------------------------------------------- | ||
| + | service rule counts | ||
| + | file_id: | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | fast pattern groups | ||
| + | | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | search engine (ac_bnfa) | ||
| + | instances: 2 | ||
| + | patterns: 438 | ||
| + | | ||
| + | num states: 1832 | ||
| + | num match states: 392 | ||
| + | | ||
| + | total memory: 71.2812 | ||
| + | | ||
| + | match list memory: 28.4375 | ||
| + | transition memory: 22.9453 | ||
| + | appid: MaxRss diff: 3084 | ||
| + | appid: patterns loaded: 300 | ||
| + | -------------------------------------------------- | ||
| + | pcap DAQ configured to passive. | ||
| + | Snort successfully validated the configuration (with 0 warnings). | ||
| + | o" | ||
| </ | </ | ||
| - | ===Configuration=== | + | === 2.3 - Utilisation de snort === |
| - | Modifiez le fichier **/ | + | Pour lancer Snort 3 en tant qu' |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# snort -c /usr/local/snort/etc/snort/snort.lua -i ens18 -A alert_fast |
| - | 1 # PortSentry Configuration | + | [2] 28057 |
| - | 2 # | + | |
| - | 3 # $Id: portsentry.conf, | + | |
| - | 4 # | + | |
| - | 5 # IMPORTANT NOTE: You CAN NOT put spaces between your port arguments. | + | |
| - | 6 # | + | |
| - | 7 # The default ports will catch a large number of common probes | + | |
| - | 8 # | + | |
| - | 9 # All entries must be in quotes. | + | |
| - | + | ||
| - | + | ||
| - | 10 ####################### | + | |
| - | 11 # Port Configurations # | + | |
| - | 12 ####################### | + | |
| - | 13 # | + | |
| - | 14 # | + | |
| - | 15 # Some example port configs for classic and basic Stealth modes | + | |
| - | 16 # | + | |
| - | 17 # I like to always keep some ports at the " | + | |
| - | 18 # This will detect a sequential port sweep really quickly and usually | + | |
| - | 19 # these ports are not in use (i.e. tcpmux port 1) | + | |
| - | 20 # | + | |
| - | 21 # ** X-Windows Users **: If you are running X on your box, you need to be sure | + | |
| - | 22 # you are not binding PortSentry to port 6000 (or port 2000 for OpenWindows users). | + | |
| - | 23 # Doing so will prevent the X-client from starting properly. | + | |
| - | 24 # | + | |
| - | 25 # These port bindings are *ignored* for Advanced Stealth Scan Detection Mode. | + | |
| - | 26 # | + | |
| - | + | ||
| - | 27 # Un-comment these if you are really anal: | + | |
| - | 28 # | + | |
| - | 29 # | + | |
| - | 30 # | + | |
| - | 31 # Use these if you just want to be aware: | + | |
| - | 32 TCP_PORTS=" | + | |
| - | 33 UDP_PORTS=" | + | |
| - | 34 # | + | |
| - | 35 # Use these for just bare-bones | + | |
| - | 36 # | + | |
| - | 37 # | + | |
| - | + | ||
| - | 38 ########################################### | + | |
| - | 39 # Advanced Stealth Scan Detection Options # | + | |
| - | 40 ########################################### | + | |
| - | 41 # | + | |
| - | 42 # This is the number of ports you want PortSentry to monitor in Advanced mode. | + | |
| - | 43 # Any port *below* this number will be monitored. Right now it watches | + | |
| - | 44 # everything below 1024. | + | |
| - | 45 # | + | |
| - | 46 # On many Linux systems you cannot bind above port 61000. This is because | + | |
| - | 47 # these ports are used as part of IP masquerading. I don't recommend you | + | |
| - | 48 # bind over this number of ports. Realistically: | + | |
| - | 49 # OVER 1024 PORTS AS YOUR FALSE ALARM RATE WILL ALMOST CERTAINLY RISE. You've been | + | |
| - | 50 # warned! Don't write me if you have have a problem because I'll only tell | + | |
| - | 51 # you to RTFM and don't run above the first 1024 ports. | + | |
| - | 52 # | + | |
| - | 53 # | + | |
| - | 54 ADVANCED_PORTS_TCP=" | + | |
| - | 55 ADVANCED_PORTS_UDP=" | + | |
| - | 56 # | + | |
| - | 57 # This field tells PortSentry what ports (besides listening daemons) to | + | |
| - | 58 # ignore. This is helpful for services like ident that services such | + | |
| - | 59 # as FTP, SMTP, and wrappers look for but you may not run (and probably | + | |
| - | 60 # *shouldn' | + | |
| - | 61 # | + | |
| - | 62 # By specifying ports here PortSentry will simply not respond to | + | |
| - | 63 # incoming requests, in effect PortSentry treats them as if they are | + | |
| - | 64 # actual bound daemons. The default ports are ones reported as | + | |
| - | 65 # problematic false alarms and should probably be left alone for | + | |
| - | 66 # all but the most isolated systems/networks. | + | |
| - | 67 # | + | |
| - | 68 # Default TCP ident and NetBIOS service | + | |
| - | 69 ADVANCED_EXCLUDE_TCP=" | + | |
| - | 70 # Default UDP route (RIP), NetBIOS, bootp broadcasts. | + | |
| - | 71 ADVANCED_EXCLUDE_UDP=" | + | |
| - | + | ||
| - | + | ||
| - | 72 ###################### | + | |
| - | 73 # Configuration Files# | + | |
| - | 74 ###################### | + | |
| - | 75 # | + | |
| - | 76 # Hosts to ignore | + | |
| - | 77 IGNORE_FILE=" | + | |
| - | 78 # Hosts that have been denied (running history) | + | |
| - | 79 HISTORY_FILE="/ | + | |
| - | 80 # Hosts that have been denied this session only (temporary until next restart) | + | |
| - | 81 BLOCKED_FILE="/ | + | |
| - | + | ||
| - | 82 ############################## | + | |
| - | 83 # Misc. Configuration Options# | + | |
| - | 84 ############################## | + | |
| - | 85 # | + | |
| - | 86 # DNS Name resolution - Setting this to " | + | |
| - | 87 # for attacking hosts. Setting it to " | + | |
| - | 88 # it off. | + | |
| - | 89 RESOLVE_HOST = " | + | |
| - | + | ||
| - | 90 ################### | + | |
| - | 91 # Response Options# | + | |
| - | 92 ################### | + | |
| - | 93 # Options to dispose of attacker. Each is an action that will | + | |
| - | 94 # be run if an attack is detected. If you don't want a particular | + | |
| - | 95 # option then comment it out and it will be skipped. | + | |
| - | 96 # | + | |
| - | 97 # The variable $TARGET$ will be substituted with the target attacking | + | |
| - | 98 # host when an attack is detected. The variable $PORT$ will be substituted | + | |
| - | 99 # with the port that was scanned. | + | |
| - | | + | |
| - | | + | |
| - | 102 # Ignore Options # | + | |
| - | | + | |
| - | 104 # These options allow you to enable automatic response | + | |
| - | 105 # options for UDP/TCP. This is useful if you just want | + | |
| - | 106 # warnings for connections, | + | |
| - | 107 # a particular protocol (i.e. you want to block TCP, but | + | |
| - | 108 # not UDP). To prevent a possible Denial of service attack | + | |
| - | 109 # against UDP and stealth scan detection for TCP, you may | + | |
| - | 110 # want to disable blocking, but leave the warning enabled. | + | |
| - | 111 # I personally would wait for this to become a problem before | + | |
| - | 112 # doing though as most attackers really aren't doing this. | + | |
| - | 113 # The third option allows you to run just the external command | + | |
| - | 114 # in case of a scan to have a pager script or such execute | + | |
| - | 115 # but not drop the route. This may be useful for some admins | + | |
| - | 116 # who want to block TCP, but only want pager/ | + | |
| - | 117 # on UDP, etc. | + | |
| - | | + | |
| - | 119 # | + | |
| - | 120 # 0 = Do not block UDP/TCP scans. | + | |
| - | 121 # 1 = Block UDP/TCP scans. | + | |
| - | 122 # 2 = Run external command only (KILL_RUN_CMD) | + | |
| - | + | ||
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | 126 # Dropping Routes:# | + | |
| - | | + | |
| - | 128 # This command is used to drop the route or add the host into | + | |
| - | 129 # a local filter table. | + | |
| - | | + | |
| - | 131 # The gateway (333.444.555.666) should ideally be a dead host on | + | |
| - | 132 # the *local* subnet. On some hosts you can also point this at | + | |
| - | 133 # localhost (127.0.0.1) and get the same effect. NOTE THAT | + | |
| - | 134 # 333.444.555.66 WILL *NOT* WORK. YOU NEED TO CHANGE IT!! | + | |
| - | | + | |
| - | 136 # ALL KILL ROUTE OPTIONS ARE COMMENTED OUT INITIALLY. Make sure you | + | |
| - | 137 # uncomment the correct line for your OS. If you OS is not listed | + | |
| - | 138 # here and you have a route drop command that works then please | + | |
| - | 139 # mail it to me so I can include it. ONLY ONE KILL_ROUTE OPTION | + | |
| - | 140 # CAN BE USED AT A TIME SO DON'T UNCOMMENT MULTIPLE LINES. | + | |
| - | | + | |
| - | 142 # NOTE: The route commands are the least optimal way of blocking | + | |
| - | 143 # and do not provide complete protection against UDP attacks and | + | |
| - | 144 # will still generate alarms for both UDP and stealth scans. I | + | |
| - | 145 # always recommend you use a packet filter because they are made | + | |
| - | 146 # for this purpose. | + | |
| - | | + | |
| - | + | ||
| - | 148 # Generic | + | |
| - | | + | |
| - | + | ||
| - | 150 # Generic Linux | + | |
| - | | + | |
| - | + | ||
| - | 152 # Newer versions of Linux support the reject flag now. This | + | |
| - | 153 # is cleaner than the above option. | + | |
| - | | + | |
| - | + | ||
| - | 155 # Generic BSD (BSDI, OpenBSD, NetBSD, FreeBSD) | + | |
| - | | + | |
| - | + | ||
| - | 157 # Generic Sun | + | |
| - | | + | |
| - | + | ||
| - | 159 # NEXTSTEP | + | |
| - | | + | |
| - | + | ||
| - | 161 # FreeBSD | + | |
| - | | + | |
| - | + | ||
| - | 163 # Digital UNIX 4.0D (OSF/1 / Compaq Tru64 UNIX) | + | |
| - | | + | |
| - | + | ||
| - | 165 # Generic HP-UX | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | 168 # Using a packet filter is the PREFERRED. The below lines | + | |
| - | 169 # work well on many OS's. Remember, you can only uncomment *one* | + | |
| - | 170 # KILL_ROUTE option. | + | |
| - | | + | |
| - | + | ||
| - | 172 # ipfwadm support for Linux | + | |
| - | | + | |
| - | | + | |
| - | 175 # ipfwadm support for Linux (no logging of denied packets) | + | |
| - | | + | |
| - | | + | |
| - | 178 # ipchain support for Linux | + | |
| - | | + | |
| - | | + | |
| - | 181 # ipchain support for Linux (no logging of denied packets) | + | |
| - | | + | |
| - | | + | |
| - | 184 # iptables support for Linux | + | |
| - | | + | |
| - | + | ||
| - | 186 # For those of you running FreeBSD (and compatible) you can | + | |
| - | 187 # use their built in firewalling as well. | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | 192 # For those running ipfilt (OpenBSD, etc.) | + | |
| - | 193 # NOTE THAT YOU NEED TO CHANGE external_interface TO A VALID INTERFACE!! | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | + | ||
| - | | + | |
| - | 197 # TCP Wrappers# | + | |
| - | | + | |
| - | 199 # This text will be dropped into the hosts.deny file for wrappers | + | |
| - | 200 # to use. There are two formats for TCP wrappers: | + | |
| - | | + | |
| - | 202 # Format One: Old Style - The default when extended host processing | + | |
| - | 203 # options are not enabled. | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | 206 # Format Two: New Style - The format used when extended option | + | |
| - | 207 # processing is enabled. You can drop in extended processing | + | |
| - | 208 # options, but be sure you escape all ' | + | |
| - | 209 # to prevent problems writing out (i.e. \%c \%h ) | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | 213 # External Command# | + | |
| - | | + | |
| - | 215 # This is a command that is run when a host connects, it can be whatever | + | |
| - | 216 # you want it to be (pager, etc.). This command is executed before the | + | |
| - | 217 # route is dropped or after depending on the KILL_RUN_CMD_FIRST option below | + | |
| - | | + | |
| - | | + | |
| - | 220 # I NEVER RECOMMEND YOU PUT IN RETALIATORY ACTIONS AGAINST THE HOST SCANNING | + | |
| - | 221 # YOU! | + | |
| - | | + | |
| - | 223 # TCP/IP is an *unauthenticated protocol* and people can make scans appear out | + | |
| - | 224 # of thin air. The only time it is reasonably safe (and I *never* think it is | + | |
| - | 225 # reasonable) to run reverse probe scripts is when using the " | + | |
| - | 226 # This mode requires a full connect and is very hard to spoof. | + | |
| - | | + | |
| - | 228 # The KILL_RUN_CMD_FIRST value should be set to " | + | |
| - | 229 # to run *before* the blocking occurs and should be set to " | + | |
| - | 230 # command run *after* the blocking has occurred. | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | + | ||
| - | | + | |
| - | 239 # Scan trigger value# | + | |
| - | | + | |
| - | 241 # Enter in the number of port connects you will allow before an | + | |
| - | 242 # alarm is given. The default is 0 which will react immediately. | + | |
| - | 243 # A value of 1 or 2 will reduce false alarms. Anything higher is | + | |
| - | 244 # probably not necessary. This value must always be specified, but | + | |
| - | 245 # generally can be left at 0. | + | |
| - | | + | |
| - | 247 # NOTE: If you are using the advanced detection option you need to | + | |
| - | 248 # be careful that you don't make a hair trigger situation. Because | + | |
| - | 249 # Advanced mode will react for *any* host connecting to a non-used | + | |
| - | 250 # below your specified range, you have the opportunity to really | + | |
| - | 251 # break things. (i.e someone innocently tries to connect to you via | + | |
| - | 252 # SSL [TCP port 443] and you immediately block them). Some of you | + | |
| - | 253 # may even want this though. Just be careful. | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | | + | |
| - | 257 # Port Banner Section# | + | |
| - | | + | |
| - | | + | |
| - | 260 # Enter text in here you want displayed to a person tripping the PortSentry. | + | |
| - | 261 # I *don' | + | |
| - | 262 # Leave this commented out to disable the feature | + | |
| - | | + | |
| - | 264 # Stealth scan detection modes don't use this feature | + | |
| - | | + | |
| - | | + | |
| - | + | ||
| - | 267 # EOF | + | |
| - | </ | + | |
| - | Pour rendre le service SysVInit compatible avec Systemd, éditez le fichier **/etc/init.d/portsentry** en supprimant la ligne **11** | + | root@debian12: |
| + | o" | ||
| + | -------------------------------------------------- | ||
| + | Loading / | ||
| + | Loading snort_defaults.lua: | ||
| + | Finished snort_defaults.lua: | ||
| + | active | ||
| + | alerts | ||
| + | daq | ||
| + | decode | ||
| + | host_cache | ||
| + | host_tracker | ||
| + | hosts | ||
| + | packets | ||
| + | process | ||
| + | search_engine | ||
| + | so_proxy | ||
| + | stream | ||
| + | stream_ip | ||
| + | stream_icmp | ||
| + | stream_tcp | ||
| + | stream_udp | ||
| + | stream_user | ||
| + | stream_file | ||
| + | arp_spoof | ||
| + | back_orifice | ||
| + | dns | ||
| + | imap | ||
| + | netflow | ||
| + | normalizer | ||
| + | pop | ||
| + | rpc_decode | ||
| + | sip | ||
| + | ssh | ||
| + | ssl | ||
| + | telnet | ||
| + | cip | ||
| + | dnp3 | ||
| + | iec104 | ||
| + | modbus | ||
| + | opcua | ||
| + | s7commplus | ||
| + | dce_smb | ||
| + | dce_tcp | ||
| + | dce_udp | ||
| + | dce_http_proxy | ||
| + | dce_http_server | ||
| + | gtp_inspect | ||
| + | smtp | ||
| + | ftp_server | ||
| + | ftp_client | ||
| + | ftp_data | ||
| + | http_inspect | ||
| + | http2_inspect | ||
| + | file_policy | ||
| + | appid | ||
| + | wizard | ||
| + | binder | ||
| + | ips | ||
| + | classifications | ||
| + | js_norm | ||
| + | file_id | ||
| + | port_scan | ||
| + | mms | ||
| + | output | ||
| + | references | ||
| + | network | ||
| + | trace | ||
| + | Finished | ||
| + | Loading file_id.rules_file: | ||
| + | Loading file_magic.rules: | ||
| + | Finished file_magic.rules: | ||
| + | Finished file_id.rules_file: | ||
| + | -------------------------------------------------- | ||
| + | ips policies rule stats | ||
| + | id loaded | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | rule counts | ||
| + | total rules loaded: 219 | ||
| + | text rules: 219 | ||
| + | option chains: 219 | ||
| + | chain headers: 1 | ||
| + | -------------------------------------------------- | ||
| + | service rule counts | ||
| + | file_id: | ||
| + | total: | ||
| + | -------------------------------------------------- | ||
| + | fast pattern groups | ||
| + | to_server: 1 | ||
| + | to_client: 1 | ||
| + | -------------------------------------------------- | ||
| + | search engine (ac_bnfa) | ||
| + | instances: 2 | ||
| + | | ||
| + | pattern chars: 2602 | ||
| + | num states: 1832 | ||
| + | num match states: 392 | ||
| + | | ||
| + | total memory: 71.2812 | ||
| + | | ||
| + | match list memory: 28.4375 | ||
| + | transition memory: 22.9453 | ||
| + | appid: MaxRss diff: 3408 | ||
| + | appid: patterns loaded: 300 | ||
| + | -------------------------------------------------- | ||
| + | pcap DAQ configured to passive. | ||
| + | Commencing packet processing | ||
| + | Retry queue interval is: 200 ms | ||
| + | ++ [0] ens18 | ||
| + | [Entrée] | ||
| - | < | + | root@debian12:~# ps aux | grep 28057 |
| - | [root@centos7 | + | root |
| - | | + | root |
| - | 2 # | + | |
| - | 3 # Startup script for the Portsentry portscan detector | + | |
| - | 4 # | + | |
| - | 5 # chkconfig: 345 98 02 | + | |
| - | 6 # description: | + | |
| - | | + | |
| - | | + | |
| - | 9 # detection software to the Internet community. | + | |
| - | 10 # processname: portsentry | + | |
| - | 11 # pidfile: /var/run/portsentry.pid <--------------------------------SUPPRIMEZ cette ligne | + | |
| - | 12 # config: / | + | |
| - | + | ||
| - | 13 # Source function library. | + | |
| - | ... | + | |
| </ | </ | ||
| - | Puis ajoutez la ligne **80** | + | Tuez le processus de Snort 3 : |
| < | < | ||
| - | ... | + | root@debian12: |
| - | | + | root@debian12: |
| - | | + | == stopping |
| - | | + | -- [0] ens18 |
| - | | + | -------------------------------------------------- |
| - | | + | Packet Statistics |
| - | | + | -------------------------------------------------- |
| - | 83 [ $RETVAL | + | daq |
| - | 84 } | + | |
| - | + | | |
| - | | + | allow: 1067 |
| - | ... | + | |
| - | </code> | + | -------------------------------------------------- |
| + | codec | ||
| + | total: 1067 (100.000%) | ||
| + | arp: 12 | ||
| + | eth: 1067 (100.000%) | ||
| + | | ||
| + | icmp4_ip: 1 ( 0.094%) | ||
| + | | ||
| + | ipv4: 1054 ( 98.782%) | ||
| + | ipv6: 1 ( 0.094%) | ||
| + | tcp: 1052 ( 98.594%) | ||
| + | udp: 1 ( 0.094%) | ||
| + | -------------------------------------------------- | ||
| + | Module Statistics | ||
| + | -------------------------------------------------- | ||
| + | ac_full | ||
| + | | ||
| + | bytes: 184 | ||
| + | -------------------------------------------------- | ||
| + | appid | ||
| + | packets: 1055 | ||
| + | processed_packets: | ||
| + | ignored_packets: | ||
| + | | ||
| + | service_cache_adds: | ||
| + | bytes_in_use: | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | arp_spoof | ||
| + | packets: 12 | ||
| + | -------------------------------------------------- | ||
| + | back_orifice | ||
| + | packets: 1 | ||
| + | -------------------------------------------------- | ||
| + | binder | ||
| + | raw_packets: | ||
| + | new_flows: 5 | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | detection | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | port_scan | ||
| + | packets: 1055 | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | stream | ||
| + | flows: 5 | ||
| + | | ||
| + | idle_prunes_proto_timeout: | ||
| + | | ||
| + | icmp_timeout_prunes: | ||
| + | -------------------------------------------------- | ||
| + | stream_icmp | ||
| + | | ||
| + | max: 2 | ||
| + | created: 2 | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | stream_tcp | ||
| + | | ||
| + | max: 2 | ||
| + | created: 2 | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | data_trackers: | ||
| + | segs_queued: | ||
| + | segs_released: | ||
| + | segs_used: 638 | ||
| + | rebuilt_packets: | ||
| + | rebuilt_bytes: | ||
| + | client_cleanups: | ||
| + | server_cleanups: | ||
| + | partial_fallbacks: | ||
| + | | ||
| + | max_bytes: 9608 | ||
| + | -------------------------------------------------- | ||
| + | stream_udp | ||
| + | | ||
| + | max: 1 | ||
| + | created: 1 | ||
| + | | ||
| + | total_bytes: | ||
| + | -------------------------------------------------- | ||
| + | wizard | ||
| + | tcp_scans: 292 | ||
| + | | ||
| + | udp_scans: 1 | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | Appid Statistics | ||
| + | -------------------------------------------------- | ||
| + | detected apps and services | ||
| + | Application: | ||
| + | | ||
| + | -------------------------------------------------- | ||
| + | Summary Statistics | ||
| + | -------------------------------------------------- | ||
| + | process | ||
| + | signals: 1 | ||
| + | -------------------------------------------------- | ||
| + | timing | ||
| + | runtime: 00:10:13 | ||
| + | seconds: 613.666561 | ||
| + | pkts/sec: 2 | ||
| + | o" | ||
| - | Dernièrement, | + | [2]+ Done snort -c / |
| - | + | (wd now: ~) | |
| - | < | + | |
| - | [root@centos7 ~]# yum install | + | |
| </ | </ | ||
| - | ===Utilisation=== | + | ====LAB #3 - Mise en place du Système de Détection et de Prévention d' |
| - | Démarrez le service | + | Portsentry est un **S**ystème de **D**étection et de **Prévention** d' |
| - | < | + | ===3.1 - Installation |
| - | [root@centos7 ~]# systemctl start portsentry | + | |
| - | [root@centos7 ~]# systemctl status portsentry | + | |
| - | ● portsentry.service | + | |
| - | | + | |
| - | | + | |
| - | Docs: man: | + | |
| - | Process: 6487 ExecStart=/ | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc | + | Utilisez simplement APT pour installer |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Aug 06 14:48:18 centos7.fenestros.loc portsentry[6513]: | + | |
| - | Hint: Some lines were ellipsized, use -l to show in full. | + | |
| - | [root@centos7 ~]# ps aux | grep portsentry | + | |
| - | root 6511 0.0 0.0 | + | |
| - | root 6513 0.0 0.0 | + | |
| - | root 6687 0.0 0.0 114692 | + | |
| - | </ | + | |
| - | + | ||
| - | Editez le fichier **/ | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# apt install |
| - | 1 # Put hosts in here you never want blocked. This includes the IP addresses | + | |
| - | 2 # of all local interfaces on the protected host (i.e virtual host, mult-home) | + | |
| - | 3 # Keep 127.0.0.1 and 0.0.0.0 to keep people from playing games. | + | |
| - | 4 # | + | |
| - | 5 # PortSentry can support full netmasks for networks as well. Format is: | + | |
| - | 6 # | + | |
| - | 7 # <IP Address>/< | + | |
| - | 8 # | + | |
| - | 9 # Example: | + | |
| - | 10 # | + | |
| - | 11 # 192.168.2.0/ | + | |
| - | 12 # 192.168.0.0/ | + | |
| - | 13 # 192.168.2.1/ | + | |
| - | 14 # Etc. | + | |
| - | 15 # | + | |
| - | 16 # If you don't supply a netmask it is assumed to be 32 bits. | + | |
| - | 17 # | + | |
| - | 18 # | + | |
| - | + | ||
| - | 19 127.0.0.1/ | + | |
| - | 20 0.0.0.0 | + | |
| - | 21 ######################################### | + | |
| - | 22 # Do NOT edit below this line, if you # | + | |
| - | 23 # do, your changes will be lost when # | + | |
| - | 24 # portsentry is restarted via the # | + | |
| - | 25 # initscript. Make all changes above # | + | |
| - | 26 # this box. # | + | |
| - | 27 ######################################### | + | |
| - | + | ||
| - | 28 # Exclude all local interfaces | + | |
| - | 29 # | + | |
| - | 30 fe80:: | + | |
| - | 31 127.0.0.1 | + | |
| - | 32 ::1 | + | |
| - | + | ||
| - | 33 # Exclude the default gateway(s) | + | |
| - | 34 10.0.2.2 | + | |
| - | + | ||
| - | 35 # Exclude the nameservers | + | |
| - | 36 10.0.2.3 | + | |
| - | + | ||
| - | 37 # And last but not least... | + | |
| - | 38 0.0.0.0 | + | |
| </ | </ | ||
| - | **Sans** re-démarrez le service portsentry, lancez un scan des ports avec nmap : | + | ===3.2 |
| - | < | + | Modifiez le fichier **/etc/portsentry/ |
| - | [root@centos7 ~]# nmap -sC 172.YY+20.0.3 | + | |
| - | + | ||
| - | Starting Nmap 6.40 ( http://nmap.org ) at 2017-08-06 14:52 CEST | + | |
| - | ^C | + | |
| - | You have new mail in / | + | |
| - | </ | + | |
| - | + | ||
| - | <WRAP center round important 50%> | + | |
| - | **Important** - Notez l' | + | |
| - | </ | + | |
| - | + | ||
| - | Consultez les règles d' | + | |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# vi / |
| - | Chain INPUT (policy ACCEPT) | + | ... |
| - | target | + | 131 # 0 = Do not block UDP/TCP scans. |
| - | DROP | + | 132 # 1 = Block UDP/TCP scans. |
| - | ACCEPT | + | 133 # 2 = Run external command only (KILL_RUN_CMD) |
| - | ACCEPT | + | 134 |
| - | INPUT_direct | + | 135 BLOCK_UDP=" |
| - | INPUT_ZONES_SOURCE | + | 136 BLOCK_TCP=" |
| - | INPUT_ZONES | + | ... |
| - | DROP | + | 211 # iptables support for Linux with limit and LOG support. Logs only |
| - | REJECT | + | 212 # a limited number of packets to avoid a denial of service attack. |
| + | | ||
| + | ... | ||
| + | 268 # | ||
| + | 269 # for examples see / | ||
| + | 270 KILL_RUN_CMD="/ | ||
| ... | ... | ||
| </ | </ | ||
| - | Dernièrement, | + | ===3.3 - Utilisation=== |
| + | |||
| + | Redémarrez le service **portsentry** | ||
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# systemctl |
| - | Heirloom Mail version 12.5 7/ | + | |
| - | "/ | + | |
| - | >N 1 trainee@centos7.fene | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | & 6 | + | |
| - | Message | + | |
| - | From root@centos7.fenestros.loc | + | |
| - | Return-Path: | + | |
| - | X-Original-To: | + | |
| - | Delivered-To: | + | |
| - | Date: Sun, 06 Aug 2017 14:52:43 +0200 | + | |
| - | To: root@localhost.fenestros.loc | + | |
| - | Subject: Portscan from 10.0.2.15 on port 143 | + | |
| - | User-Agent: Heirloom mailx 12.5 7/5/10 | + | |
| - | Content-Type: | + | |
| - | From: root@centos7.fenestros.loc (root) | + | |
| - | Status: R | + | |
| + | root@debian12: | ||
| + | ● portsentry.service - LSB: # start and stop portsentry | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | Process: 28347 ExecStart=/ | ||
| + | Tasks: 2 (limit: 19123) | ||
| + | | ||
| + | CPU: 84ms | ||
| + | | ||
| + | | ||
| + | | ||
| - | & q | + | Dec 04 16:10:22 debian12 portsentry[28364]: |
| - | Held 6 messages in / | + | Dec 04 16:10:22 debian12 portsentry[28364]: |
| - | You have mail in / | + | Dec 04 16:10:22 debian12 portsentry[28364]: |
| - | [root@centos7 ~]# | + | Dec 04 16:10:22 debian12 portsentry[28364]: |
| + | Dec 04 16:10:22 debian12 portsentry[28364]: | ||
| + | Dec 04 16:10:22 debian12 portsentry[28364]: | ||
| + | Dec 04 16:10:22 debian12 portsentry[28364]: | ||
| + | Dec 04 16:10:22 debian12 portsentry[28364]: | ||
| + | Dec 04 16:10:22 debian12 portsentry[28364]: | ||
| + | Dec 04 16:10:22 debian12 portsentry[28364]: adminalert: PortSentry is now active and listening. | ||
| </ | </ | ||
| - | Pour nettoyer la règle, re-démarrez le service **firewalld** | + | Consultez les processus de Portsentry |
| < | < | ||
| - | [root@centos7 | + | root@debian12:~# ps aux | grep portsentry |
| - | [root@centos7 ~]# iptables -L | + | root 28360 0.0 0.0 |
| - | Chain INPUT (policy ACCEPT) | + | root |
| - | target | + | root |
| - | ACCEPT | + | |
| - | ACCEPT | + | |
| - | INPUT_direct | + | |
| - | INPUT_ZONES_SOURCE | + | |
| - | INPUT_ZONES | + | |
| - | DROP | + | |
| - | REJECT | + | |
| - | ... | + | |
| </ | </ | ||
| ----- | ----- | ||
| Copyright © 2025 Hugh Norris. | Copyright © 2025 Hugh Norris. | ||
