Snort Intrusion Detection System
January 20, 2010

Operating System	Platform	Application(s)	Database(s)
(6.1 / 64-bit)

I. Abstract

This document describes the process of setting up a Snort network intrusion detection system on IBM AIX 6.1. We will be using Barnyard2 for processing events (unified2 format) to send to a database (to utilize BASE or another SIM product). This guide will go over a PostgreSQL database output configuration for the sensor.

The sensor configuration assumed for this guide consists of two network interfaces (this will not be an inline sensor (IPS)). One will be for management and one will be connected to the network SPAN, TAP or hub on the edge device to monitor all traffic.

Snort Sensor Test Platform:

• IBM eServer pSeries 7029-6C3
• 1.2Ghz Dual Core POWER4 / 2GB RAM
• AIX 6.1

II. Setup the Operating Environment

Follow my guide titled Setting Up TCP/IP, SSH and a GNU C / C++ Development Environment on AIX 6.1 to lay the foundation for what we will be doing here. Or, whatever you have that is capable/compatible.

You may want to nudge up the size on the /var partition, depending on your estimated log sizes.

I also suggest you add the following to your system's PATH:

This will allow easier access to some programs we will need later.

III. Download and Install Sources

Libpcap:

These is a bug in 1.0.0 that causes a ./configure fail on AIX. We will use 0.9.8 until a fix is released.

PCRE:

Snort:

PostgreSQL:

Barnyard2:

IV. Configure Snort

We will be configuring this sensor to monitor traffic on a "stealth" interface. On my system (pSeries 7029-6C3), the second interface name is en1. In the example below, you may need to change for your specific system.

Setup Stealth NIC

Configure snort.conf

Rather than go into intricate detail on this process, I shall refer you to the excellent information provided by the Snort team. The Snort Manual (v2.8.5 (PDF)) will help you understand all the options available to you. Just to get you started, the most important settings you'll want to customize for now are:

• var HOME_NET any
  • example: var HOME_NET [192.168.0.0/24]
• var EXTERNAL_NET any
  • example: var EXTERNAL_NET !$HOME_NET
• var RULE_PATH ../rules
  • example: var RULE_PATH /etc/snort/rules

We also need to configure the section in snort.conf titled:

# unified: Snort unified binary format alerting and logging

This is where we configure the unified2 output plugin. The snort.conf file doesn't mention this, but a new unified output is now available that is actually unified! It is of course called unified2. This is the data that Barnyard2 will be using to export events to your database. All you have to do is add the following line:

output unified2: filename snort.u2, limit 128

Get and Install Rules

First, we need to download the latest rules/signatures. Do this often, and be careful once you start customizing or adding them. It can be very depressing to upgrade Snort or refresh the rules and find your work overwritten! Here, we will use the Emerging Threats signatures.

Go to the Emerging Threats Rules Download page and study what is available. You most likely do not want to use all the rulesets available. Pick what is most appropriate for your network. I'll use a short list for this example, just to give you the idea:

Towards the end of the snort.conf file (Step #6: Customize your rule set), is where you need to edit so Snort knows which rules to use. Start by deleting all the ones listed, because we aren't using them. Then again, if you choose to use the Snort VRT rules, rethink this decision!

Add the following two lines to correspond with the signature sets we've selected:

That's it. Save it and continue.

V. Configure Barnyard2

We will be using Barnyard2 to offload the output processing from Snort. These events will be sent to another system hosting a Snort database.

Uncomment/comment and edit the following lines in /etc/snort/barnyard2.conf. For my setup, I am going to use the data with Basic Analysis and Security Engine (BASE) using PostgreSQL. Bold indicates changes/additions (and use a better password for the DB than snort, please). The server variable should point to the address of your SQL server:

VI. Start Snort and Barnyard!

Use the following commands to start everything (the -D puts it in daemon mode):

The -c option specifies the location of the barnyard.conf file. The -d and -f options specify the directory and name of the Snort logging files, respectively. Lastly, the -w option specifies the location of the waldo file we've just created.

VII. Helpful Links

• Snort Documentation (Manual, Guides, Papers, etc.)
• Port mirroring - Wikipedia