Snort + Barbyard2 + Snorby环境搭建

1、环境

ubuntu-14.04.5

daq-2.0.7

Snort-2.9.15.1

Barbyard2

snorby

Mysql

Docker

2、架构

3、安装步骤

Ubuntu配置

　　如果是刚安装好的Ubuntu系统，需要执行下面的步骤，否则可以忽略，视自己实际环境而定。

sudo apt-get update
sudo apt-get dist-upgrade -y
sudo apt-get install -y openssh-server
sudo reboot

安装snort依赖

　　snort运行前提已安装：pcap、PCRE、Libdnet、DAQ。

sudo apt-get install -y build-essential
sudo apt-get install -y libpcap-dev libpcre3-dev libdumbnet-dev
sudo apt-get install -y bison flex
mkdir ~/snort_src
cd ~/snort_src

安装DAQ (Data AcQuisition library)

cd ~/snort_src
wget https://snort.org/downloads/snort/daq-2.0.7.tar.gz
tar -xvzf daq-2.0.7.tar.gz
cd daq-2.0.7
./configure
make
sudo make install

sudo apt-get install -y zlib1g-dev liblzma-dev openssl libssl-dev

Ubuntu 16 执行（Ubuntu 14 不执行）
sudo apt-get install -y libnghttp2-dev

Ubuntu 14 执行（Ubuntu 16 不执行）
sudo apt-get install -y autoconf libtool pkg-config
cd ~/snort_src
wget https://github.com/nghttp2/nghttp2/releases/download/v1.17.0/nghttp2-1.17.0.tar.gz
tar -xzvf nghttp2-1.17.0.tar.gz
cd nghttp2-1.17.0
autoreconf -i --force
automake
autoconf
./configure --enable-lib-only
make
sudo make install

安装snort

cd ~/snort_src
wget https://snort.org/downloads/snort/snort-2.9.15.1.tar.gz
tar -xvzf snort-2.9.15.1.tar.gz
cd snort-2.9.15.1
./configure --enable-sourcefire
make
sudo make install

后续配置

sudo ldconfig
sudo ln -s /usr/local/bin/snort /usr/sbin/snort

　　如果我们不想使用root运行snort，我们需要创建一个其它账户。我们创建一些文件和目录供snort使用，并且为这些文件和目录设置权限。snort包含以下文件夹：/etc/snort包含配置文件和规则文件。/var/log/snort/包含alert日志。/usr/local/lib/snort_dynamicrules/下包含其他规则。

# Create the snort user and group:
sudo groupadd snort
sudo useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort

# Create the Snort directories:
sudo mkdir /etc/snort
sudo mkdir /etc/snort/rules
sudo mkdir /etc/snort/rules/iplists
sudo mkdir /etc/snort/preproc_rules
sudo mkdir /usr/local/lib/snort_dynamicrules
sudo mkdir /etc/snort/so_rules

# Create some files that stores rules and ip lists
sudo touch /etc/snort/rules/iplists/black_list.rules
sudo touch /etc/snort/rules/iplists/white_list.rules
sudo touch /etc/snort/rules/local.rules
sudo touch /etc/snort/sid-msg.map

# Create our logging directories:
sudo mkdir /var/log/snort
sudo mkdir /var/log/snort/archived_logs

# Adjust permissions:
sudo chmod -R 5775 /etc/snort
sudo chmod -R 5775 /var/log/snort
sudo chmod -R 5775 /var/log/snort/archived_logs
sudo chmod -R 5775 /etc/snort/so_rules
sudo chmod -R 5775 /usr/local/lib/snort_dynamicrules

# Change Ownership on folders:
sudo chown -R snort:snort /etc/snort
sudo chown -R snort:snort /var/log/snort
sudo chown -R snort:snort /usr/local/lib/snort_dynamicrules

cd ~/snort_src/snort-2.9.15.1/etc/
sudo cp *.conf* /etc/snort
sudo cp *.map /etc/snort
sudo cp *.dtd /etc/snort
cd ~/snort_src/snort-2.9.15.1/src/dynamic-preprocessors/build/usr/local/lib/snort_dynamicpreprocessor/
sudo cp * /usr/local/lib/snort_dynamicpreprocessor/

sudo sed -i "s/include \$RULE\_PATH/#include \$RULE\_PATH/" /etc/snort/snort.conf

sudo vi /etc/snort/snort.conf

　　更改第45行信息为自己主机地址。

ipvar HOME_NET 10.0.0.0/24

　　更改第104行信息如下：

var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules

更改第110行信息如下：
var WHITE_LIST_PATH /etc/snort/rules/iplists
var BLACK_LIST_PATH /etc/snort/rules/iplists

　　将第546行注释去掉。

include $RULE_PATH/local.rules

安装Barnyard2

sudo apt-get install -y mysql-server libmysqlclient-dev mysql-client autoconf libtool

　　更改/etc/snort/snort.conf第521行为如下：

# unified2
# Recommended for most installs
# output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types
output unified2: filename snort.u2, limit 128

cd ~/snort_src
wget https://github.com/firnsy/barnyard2/archive/master.tar.gz -O barnyard2-Master.tar.gz
tar zxvf barnyard2-Master.tar.gz
cd barnyard2-master
autoreconf -fvi -I ./m4

sudo ln -s /usr/include/dumbnet.h /usr/include/dnet.h
sudo ldconfig

./configure --with-mysql --with-mysql-libraries=/usr/lib/x86_64-linux-gnu
make
sudo make install

sudo cp ~/snort_src/barnyard2-master/etc/barnyard2.conf /etc/snort/
# the /var/log/barnyard2 folder is never used or referenced
# but barnyard2 will error without it existing
sudo mkdir /var/log/barnyard2
sudo chown snort.snort /var/log/barnyard2

sudo touch /var/log/snort/barnyard2.waldo
sudo chown snort.snort /var/log/snort/barnyard2.waldo

　　在/etc/snort/barnyard2.conf配置文件最后一行添加，数据库为snort，如果安装了snorby，可以设置为snorby。

output database: log, mysql, user=Mysql用户名 password=MySql密码 dbname=snort host=localhost sensor name=sensor01

sudo chmod o-r /etc/snort/barnyard2.conf

　　运行指令

sudo barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -w /var/log/snort/barnyard2.waldo -g snort -u root

安装snorby

　　Ubuntu安装Docker可以使用安装脚本自动安装，安装完成后可以使用Docker.

curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun

　　docker安装完毕后安装snorby。

docker pull troptop/docker-snorby

　　配置docker镜像参数，参数含义参考：链接

docker run -d --name snorby -p 80:80 --env="MYSQL_HOST=database_ip" --env="MYSQL_USER=snorby" --env="MYSQL_PASSWORD=snorby" --env="MYSQL_DBNAME=snorby" --env="INSTALLDB" --env="MYSQL_ADMIN=root" --env="MYSQL_ADMINPASS=rootpassword" troptop/docker-snorby

　　进入docker系统，查看log文件夹下的development.log，看web服务是否运行成功。

docker exec –it snorby bash

　　最后在浏览器中访问docker网关地址即可登录snorby。

问题

'aclocal-1.15' is missing on your system

cd ~/snort_src
wget http://ftp.gnu.org/gnu/automake/automake-1.15.tar.gz
tar -xvzf automake-1.15
cd automake-1.15
./configure --docdir=/usr/share/doc/automake-1.15
make
sudo make install

Autoconf 2.65 or better is required

wget http://ftp.gnu.org/gnu/autoconf/autoconf-2.68.tar.gz
tar xzf autoconf-2.68.tar.gz
cd autoconf-2.68
./configure
make
sudo make install

LuaJIT library not found.

sudo wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz
sudo tar -zxvf LuaJIT-2.0.5.tar.gz
cd LuaJIT-2.0.5/
make
sudo make install

possibly undefined macro:AC_PROG_LIBTOOL

#将系统拥有的/usr/share/aclocal中文件拷贝到重复安装路径
cp -rf /usr/share/aclocal/* /usr/local/share/aclocal/

数据库连不上

1、数据库不允许远程连接。

mysql> grant all on *.* to root@'%' identified by '123456' with grant option;
flush privileges;

2、更改mysql的配置文件。

# Instead of skip-networking the default is now to listen only on
 46 # localhost which is more compatible and is not less secure.
 47 bind-address            = 127.0.0.1  # 更改为主机地址。

/etc/init.d/mysql restart   # 重启Mysql服务。

坑

　　automake版本变化。在编译daq的时候要求automake1.15，然后在snort编译的时候要求automake1.13.4，如果不切换的话会编译不过去。