IDS (Intrusion Detection System) - Snort 2.9 [Linux Deb/Ubuntu]

 
What is Snort?

    Snort is the foremost Open Source Intrusion Detection System (IDS) in the world. Snort IDS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users.

    Snort can be deployed inline to stop these packets, as well. Snort has three primary uses: As a packet sniffer like tcpdump, as a packet logger — which is useful for network traffic debugging, or it can be used as a full-blown network intrusion prevention system. Snort can be downloaded and configured for personal and business use alike.
(apud: https://www.snort.org/)

    After digging made this script to make life more easier, you may just

[ apt install snort -y ]

to verify if your REPO got everything before, if it doesn't work, just copy and run the first script out of three:

[1] Install from tarball file manually  [2] Makes Configuration  [3] Launch App

# if you good till here, lets go to CONFIGURATION

#

Here we got the post-install script:
# if you noticed this config is also included in step 2: the second script =D # nano /etc/snort/snort.conf :: Download Link


Check the Output from last Code:

Sample of Output after PING with loaded Community Rules:

 

At the Image below you can check the plugins from Snort, OS_RULES .

###################################################
# Step #9: Customize your Shared Object Snort Rules
# For more information, see http://vrt-blog.snort.org/2009/01/using-vrt-certified-shared-object-rules.h$
###################################################

 

 

 I've made a script to run SNORT and make sure that  snort.config , folder and Aplication USER:GROUP  under /ETC/SNORT enforces its owner:

 

 #################################################

You can skip this config, but is valid to dig into it:

#################################################

At line 45 in /etc/snort/snort.conf should seen like it >:

ipvar HOME_NET  any
ipvar EXTERNAL_NET  any

Note from web-page(link): 

    Change the declaration for EXTERNAL_NET to !$HOME_NET – this expression means the external network will be defined as any IP address that is not part of the home network. Important! If you leave HOME_NET declared as “any” you cannot use !$HOME_NET, as the expression will translate to “not any” and throw an error when you try to start Snort.

Line 104 should look like this:

var  RULE_PATH  /etc/snort/rules
var  SO_RULE_PATH  /etc/snort/so_rules

var PREPROC_RULE_PATH  /etc/snort/preproc_rules
var WHITE_LIST_PATH        /etc/snort/rules/iplists
var BLACK_LIST_PATH        /etc/snort/rules/iplists

#tip: my Snort got some stuff while configuring these paths, depending on your System you may have to change if it ask!  Since on Ubuntu 18.04 is working as so, not reporting any issue as up code.

KEEP READING:

securityarchitecture: https://www.securityarchitecture.com/learning/intrusion-detection-systems-learning-with-snort/configuring-snort/