snort_inline

snort_inline

Link   http://snort-inline.sourceforge.net/oldhome.html

What is snort_inline?

snort_inline is basically a modified version of Snort that accepts packets from iptables andIPFW via libipq(linux) or divert sockets(FreeBSD), instead of libpcap. It then uses new rule types (drop, sdrop, reject) to tell iptables/IPFW whether the packet should be dropped, rejected, modified, or allowed to pass based on a snort rule set.  Think of this as an Intrusion Prevention System (IPS) that uses existing Intrusion Detection System (IDS) signatures to make decisions on packets that traverse snort_inline.

Contact Info

The code is currently maintained by William Metcalf and Victor Julien. Major contributions have also come from Dave Remien and Nick Rogness. Check out the monitored snort_inline mailing list for discussions on bugs and enhancements.  You must become a member in order to be able to send and receive messages to and from this mailing list.  This was done in order to reduce the amount of spam.  Click hereand follow the directions to become a member.

Downloads

snort_inline comes in three forms: source code, statically compiled binary, and patch.

https://sourceforge.net/projects/snort-inline/files/

https://sourceforge.net/projects/snort-inline/files/snort_inline%20source%20%282.6.x%29/snort_inline-2.6.1.5/snort_inline-2.6.1.5.tar.gz/download

https://sourceforge.net/projects/snort-inline/files/snort_inline%20patch%20%282.6.x%29/snort_inline-2.6.1.5/snort_inline-2.6.1.5.diff.tar.gz/download

FAQ

• I am having problems compiling snort_inline.
• I am having problems running snort_inline.
• Snort_inline is not dropping any packets.
• Which version of libnet do I need?
• I want to handle only selected traffic with snort_inline

Mailing List

snort-inline-users

The code is currently maintained by William Metcalf.

Links

Related information that may help with the deployment of snort_inline.

• Ebtables: The bridging firewall kernel patch may be required if you intend to use snort_inline on a bridge.
• Honeynet Project: Contains information regarding the deployment of snort_inline in a honeynet environment.
• iptables: This is how snort_inline receives packets.
• Libnet: This library allows snort_inline to reject packets.
• libpcap: This is the packet capture library used to by snort, snort_inline, and many other network analyzers.
• Snort: The core of snort_inline.
• snort_inline:  The SourceForge project page.
• snort_inline blog:  The snort_inline blog page.

-----------------------------------------------

http://www.clamav.net/documents/clamav-virus-database-faq

I’m running ClamAV on a lot of clients on my local network. Can I serve the cvd files from a local server so that each client doesn’t have to download them from your servers?

Sure, you can find more details on our Mirror page.

• If you want to take advantage of incremental updates, install a proxy server and then configure your freshclam clients to use it (watch for the HTTPProxyServer parameter in man freshclam.conf).

• The second possible solution is to:

• Configure a local webserver on one of your machines (say machine1.mylan)

• Let freshclam download the *.cvd files from http://database.clamav.net to the webserver’s DocumentRoot.

• Finally, change freshclam.conf on your clients so that it includes:

  DatabaseMirror machine1.mylan

  ScriptedUpdates off

  First the database will be downloaded to the local webserver and then the other clients on the network will update their copy of the database from it.

  Important: For this to work, you have to add ScriptedUpdates off on all of your machines!

Virus Database

For ClamAV to work properly, both the ClamAV engine and the ClamAV Virus Database (CVD) must be kept up to date.

Freshclam should perform these updates automatically. Instructions for setting up Freshclam can be found in the documentation section. 
If your network is segmented or the end hosts are unable to reach the Internet, you should investigate setting up a private local mirror. If this is not viable, you may use these direct download links:  main.cvd | daily.cvd | bytecode.cvd

http://database.clamav.net/main.cvd
http://database.clamav.net/daily.cvd
http://database.clamav.net/bytecode.cvd

------------------------------------------

Snort-Inline + ClamAV

来源  https://ssorc.tw/273

POSTED ON 2006 年 11 月 15 日LEAVE A COMMENT

整合snort-inline與掃毒程式clamav

snort-line會去讀clamav的資料庫病毒碼來過濾所傳送的封包，並擋掉有病毒的封包，但snort-inline+clamav無法擋掉壓縮檔、email附件，及OLE2 病毒

以上來說明來自 README.clamav
　

[1.] apt-get install clamav-db clamav-devel clamav

[2.] 編譯時加入clamav
         ./configure – -enable-clamav

make

make install
　

[3.] vi /etc/snort_inline/snort_inline.conf

preprocessor clamav: ports all !22 !443, action-drop, dbdir /var/clamav, dbreload-time 43200

# preprocessor clamav: ports all !22 !443, toclientonly, dbdir /usr/share/clamav, dbreload-time 43200, file-descriptor-mode

預設定檔中clamav項目中的file-descriptor-mode參數在新版中已不用了。

設定只要 "preprocessor clamav: ports all !22 !443, dbdir /var/clamav, dbreload-time 43200" 即可，試驗結果它已直接 action-drop了，或者你要將連線一直重置就設定為 action-reset。
            toclientonly只對 gateway後面的作 drop，而 toserveronly則只對 gateway，而 toclientonly與 toserveronly都不用，則雙方應該是都作 drop。

[4.] 下載 eicar測試
         wget http://www.eicar.org/download/eicar.com

病毒

http://www.gfos.hr/~dragovic/nest/

　

[5.] log記錄訊息

[**] [122:1:1] (spp_clamav) Virus Found: Eicar-Test-Signature [**]
12/09-11:18:40.345607 81.3.3.133:80 -> 10.10.1.100:44902
TCP TTL:50 TOS:0x0 ID:2639 IpLen:20 DgmLen:478 DF
***AP*** Seq: 0x7A232F0D Ack: 0x462705E2  Win: 0x1920 TcpLen: 32
TCP Options (3) => NOP NOP TS: 63382852 259450410

重要引用:

From: Will Metcalf <william@gm…>
 Eicar and ClamAV
2005-03-12 14:47
 It seems as if the clam guy"s updated the signature database with a new definition for Eicar, and it is no longer detected in the same manner. I was wrong, about Clam being broken as it still seems to pick-up other virii ok. In addition, it appears as if Victor thinks
 he has figured out a way to scan file descriptors via writing packet contents to tmp files. We actually should be able to detect more virii using this method.
 Regards,
 Will

Clamav官方改變了定義，所以測試eicar.com病毒，是失敗的

不過在2006/04/22測試新版的Snort-Inline時，clamav已working

　

註: 2006/04/22

clamav配合 preprocessor stickydrop-timeouts: sfportscan 3000, portscan2 3000, clamav 3000

的時後，一開始的連線是被drop的沒錯，不過要等3000秒後，對目的端的全部連線才能再次溝通。

-------------------------------------

snort_inline with clamav on pfsense

============ End