Pulled Pork Installation Linux: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| (4 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) | |||
| Zeile 11: | Zeile 11: | ||
*cp pulledpork.pl /usr/local/bin | *cp pulledpork.pl /usr/local/bin | ||
*chmod +x /usr/local/bin/pulledpork.pl | *chmod +x /usr/local/bin/pulledpork.pl | ||
| − | *cp etc/*.conf /etc/snort | + | *cp -v etc/*.conf /etc/snort |
| + | *sed -e "s^/usr/local^^" -e "s/<oinkcode>/a4xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxe79/" -e "s/sid_msg_version=1/sid_msg_version=2/" -e "s/distro=.*/distro=Ubuntu-12-04/" etc/pulledpork.conf > /etc/snort/pulledpork.conf | ||
| + | =pulledpork config= | ||
| + | *cat pulledpork.conf | ||
| + | <pre> | ||
| + | rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot-2983.tar.gz|a4xxxxxxxxxxxxxxxxxxx79 | ||
| + | rule_url=https://snort.org/downloads/community/|community-rules.tar.gz|Community | ||
| + | rule_url=https://talosintelligence.com/documents/ip-blacklist|IPBLACKLIST|open | ||
| + | rule_url=https://snort.org/downloads/community/|opensource.gz|Opensource | ||
| + | ignore=deleted.rules,experimental.rules,local.rules | ||
| + | temp_path=/tmp | ||
| + | rule_path=/etc/snort/rules/snort.rules | ||
| + | local_rules=/etc/snort/rules/local.rules | ||
| + | sid_msg=/etc/snort/sid-msg.map | ||
| + | sid_msg_version=2 | ||
| + | sid_changelog=/var/log/sid_changes.log | ||
| + | sorule_path=/lib/snort_dynamicrules/ | ||
| + | snort_path=/bin/snort | ||
| + | config_path=/etc/snort/snort.conf | ||
| + | distro=Ubuntu-12-04 | ||
| + | black_list=/etc/snort/rules/iplists/default.blacklist | ||
| + | IPRVersion=/etc/snort/rules/iplists | ||
| + | snort_control=/bin/snort_control | ||
| + | version=0.7.4 | ||
| + | </pre> | ||
==Erster Funktionstest== | ==Erster Funktionstest== | ||
| Zeile 20: | Zeile 44: | ||
==Konfiguration== | ==Konfiguration== | ||
| − | |||
| − | + | rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot-3000.tar.gz|a4acccccccccccccccccccccccccccce79 | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
==Erster Manueller Start== | ==Erster Manueller Start== | ||
Aktuelle Version vom 16. Oktober 2018, 18:03 Uhr
Vorraussetzung: "Oinkcode"
- Um Pulled Pork nutzen zu können wird ein sog. "Oinkcode" benötigt, den man nur über eine Registrierung auf der Snortwebsite erhalten kann
- Nach der Anmeldung auf die E-Mail-Adresse mit der angemeldet wurde oben rechts in der Ecke klicken, danach links auf "Oinkcode" um diesen einsehen zu können
Vorraussetzung: Pearl-libs
- apt-get install -y libcrypt-ssleay-perl liblwp-useragent-determined-perl
Installation
- git clone https://github.com/shirkdog/pulledpork.git
- cd pulledpork
- cp pulledpork.pl /usr/local/bin
- chmod +x /usr/local/bin/pulledpork.pl
- cp -v etc/*.conf /etc/snort
- sed -e "s^/usr/local^^" -e "s/<oinkcode>/a4xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxe79/" -e "s/sid_msg_version=1/sid_msg_version=2/" -e "s/distro=.*/distro=Ubuntu-12-04/" etc/pulledpork.conf > /etc/snort/pulledpork.conf
pulledpork config
- cat pulledpork.conf
rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot-2983.tar.gz|a4xxxxxxxxxxxxxxxxxxx79 rule_url=https://snort.org/downloads/community/|community-rules.tar.gz|Community rule_url=https://talosintelligence.com/documents/ip-blacklist|IPBLACKLIST|open rule_url=https://snort.org/downloads/community/|opensource.gz|Opensource ignore=deleted.rules,experimental.rules,local.rules temp_path=/tmp rule_path=/etc/snort/rules/snort.rules local_rules=/etc/snort/rules/local.rules sid_msg=/etc/snort/sid-msg.map sid_msg_version=2 sid_changelog=/var/log/sid_changes.log sorule_path=/lib/snort_dynamicrules/ snort_path=/bin/snort config_path=/etc/snort/snort.conf distro=Ubuntu-12-04 black_list=/etc/snort/rules/iplists/default.blacklist IPRVersion=/etc/snort/rules/iplists snort_control=/bin/snort_control version=0.7.4
Erster Funktionstest
- root@schnabeltier:~$ /usr/local/bin/pulledpork.pl -V
PulledPork v0.7.2 - E.Coli in your water bottle!
Konfiguration
rule_url=https://www.snort.org/reg-rules/%7Csnortrules-snapshot-3000.tar.gz%7Ca4acccccccccccccccccccccccccccce79
Erster Manueller Start
- /usr/local/bin/pulledpork.pl -c /etc/snort/pulledpork.conf -l
Herrunter geladene Rules zu Snort hinzufügen
- vi /etc/snort/snort.conf
- In Zeile 577 den folgenden Text hinzufügen:
include $RULE_PATH/snort.rules
Änderungen in snort.conf testen
- snort -T -c /etc/snort/snort.conf -i eth0
Automatische Aktualisierung der Rules einrichten
- crontab -e und folgende Zeile hinzufügen:
01 04 * * * /usr/local/bin/pulledpork.pl -c /etc/snort/pulledpork.conf -l