kali上安装配置snort以及简单实验

一、kail上 snort 的安装

结构参考：https://blog.csdn.net/weixin_39625172/article/details/112415163这里是引用

预装daq所需程序

sudo apt-get install flex
sudo apt-get install bison
sudo apt install aptitude 
sudo aptitude install libpcap-dev

安装daq

wget https://www.snort.org/downloads/snort/daq-2.0.7.tar.gz

tar xvfz daq-2.0.7.tar.gz
                      
cd daq-2.0.7
./configure && make && sudo make install
cd ..

安装snort 依赖程序

aptitude install libpcre3-dev
aptitude install libdumbnet-dev
aptitude install zlib1g-dev
apt install openssl
apt-get install libssl-dev

sudo wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz
sudo tar -zxvf LuaJIT-2.0.5.tar.gz
cd LuaJIT-2.0.5/
sudo make && sudo make install
cd ..

安装snort

wget https://www.snort.org/downloads/snort/snort-2.9.17.1.tar.gz
tar xvfz snort-2.9.17.1.tar.gz                      
cd snort-2.9.17.1
./configure --enable-sourcefire && make && sudo make install

安装问题处理：
https://www.136.la/nginx/show-62615.html
安装参考：
https://blog.csdn.net/yisosooo/article/details/78867025

二、使用snort配置规则

参考：https://blog.csdn.net/qq_44785431/article/details/108096135
https://www.jianshu.com/p/113345bbf2f7

1、创建一些必要的文件夹

#Snort的安装目录
sudo mkdir -p /etc/snort/rules/iplists
sudo mkdir -p /etc/snort/preproc_rules
sudo mkdir /usr/local/lib/snort_dynamicrules
sudo mkdir /etc/snort/so_rules

#存储过滤规则和服务器黑白名单
sudo touch /etc/snort/rules/iplists/default.blacklist
sudo touch /etc/snort/rules/iplists/default.whitelist
sudo touch /etc/snort/rules/so_rules

#创建日志目录
sudo mkdir /var/log/snort
sudo mkdir /var/log/snort/archived_logs

#调整权限
sudo chmod -R 5775 /etc/snort
sudo chmod -R 5775 /var/log/snort
sudo chmod -R 5775 /var/log/snort/archived_logs
sudo chmod -R 5775 /etc/snort/rules/so_rules
sudo chmod -R 5775 /usr/local/lib/snort_dynamicrules

2 、复制文件到 /etc/snort

cp /home/kali/snort-2.9.17.1/etc/*.conf* /etc/snort
cp /home/kali/snort-2.9.17.1/etc/*.map /etc/snort
cp /home/kali/snort-2.9.17.1/etc/*.dtd /etc/snort
cp /home/kali/snort-2.9.17.1/src/dynamic-preprocessors/build/usr/local/lib/snort_dynamicpreprocessor/* /usr/local/lib/snort_dynamicpreprocessor/

3、修改默认配置

vim /etc/snort/snort.conf

修改一些文件的路径

var RULE_PATH /etc/snort/rules 
var SO_RULE_PATH /etc/snort/so_rules 
var PREPROC_RULE_PATH /etc/snort/preproc_rules
var WHITE_LIST_PATH /etc/snort/rules/iplists/
var BLACK_LIST_PATH /etc/snort/rules/iplists/

打开文件过滤规则包含,去掉开头的#号

include $RULE_PATH/local.rules

修改配置文件让黑白名单生效

whitelist $WHITE_LIST_PATH/default.whitelist, \ 
blacklist $BLACK_LIST_PATH/default.blacklist

安装rules包

wget https://www.snort.org/downloads/registered/snortrules-snapshot-29171.tar.gz

sudo tar zxvf snortrules-snapshot-29171.tar.gz -C /etc/snort

cp /etc/snort/so_rules/precompiled/RHEL-6-0/x86-64/2.9.12.0/* /usr/local/lib/snort_dynamicrules/

启动测试

sudo snort -T -c /etc/snort/snort.conf

配置规则

snort 规则讲解：https://blog.csdn.net/garmin_/article/details/115111891

三、利用Snort检测ping攻击

1、在rules/icmp-info.rules文件中设置如下规则：

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Large ICMP Packet"; dsize:>800; reference:arachnids,246; classtype:bad-unknown; sid:499; rev:4;)

2、使用snort规则对流量进行检测，并将结果输出到snort日志中

snort -i eth0 -c /etc/snort/snort.conf -A fast -l /var/log/snort/

成功开启snort进行检测后

3、使用局域网内主机对安装snort主机进行包>800的ping攻击

ping -1 1000 kali主机IP 

4、在日志中查看检测结果：

cat /var/log/snort/alert  

成功检测包大于800的ping攻击！

四、利用Snort检测nmap扫描

1.在 /etc/snort/rules/local.rules下进行tcp规则配置

vim /etc/snort/rules/local.rules
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"nmap scan";sid:1000000888;)

2.启动snort进行局域网内的扫描检测

sudo snort -i eth0 -c /etc/snort/snort.conf -A fast -l /var/log/snort/

3.使用宿主机进行局域网内的namp扫描

4.在var/log/snort中查看检测结果

sudo cat /var/log/snort/alert