Deploying Snort
26 Jan '06 - 15:31 by benrI recently rolled out Snort at my place of employment. Sadly I had to make some serious compromises because I was given a Compaq DL360 (Gen 3) for deployment and Solaris 10 X86 was unhappy on the box. I was forced to use Linux and I was unsure of all the various best practices for Snort on Linux. Thankfully Mr. Patrick S. Harper was there to save the day! On the Snort.org documentation page you can find two of his papers:
- Snort, Apache, SSL, PHP, MySQL, and BASE Install on CentOS 4, RHEL 4 or Fedora Core [PDF]: A wonderful step-by-step end-to-end guide for installing, securing, and configuring Linux, Snort, Apache, SSL, MySQL, and BASE.
- Oinkmaster Installation and Configuration Guide [PDF]: An excellent step-by-step look at properly installing and configuring OinkMaster for daily automated Snort rules updates.
Both these docs are extremely simple and follow and well tested. I printed both, put them in a binder, set it on top of my crappy DL360 and started installing CentOS. I followed it step by step and was never led astray. I've now got a pretty kickin' Snort box attached to mirror ports on each of our front-end switches. Thanks to BASE (Basic Analysis and Security Engine) there is a simple to user and understand web interface that my manager and network admin can access to get all the information they need without the need to log into the system or dig through dumps and logs.
If your thinking about playing with or deploying Snort I highly recommend that you consider these two docs as your guide through the Snort universe. I bought both the Managing Security with Snort & IDS Tools and Snort Cookbook books from O'Reilly, but frankly Patrick's papers where far more useful to me. If you want to learn about Snort or dig into any particular aspect of a snort system, buy the books... but if you want to deploy a system, go and see Mr. Patrick S. Harper.
If you want a kick ass gui check out [[http://www.sguil.com]] . It can be used as a simple Tcl/TK interface for managing alerts on one or more sensors or use its full potential as a “Network Security Monitoring” platform. I have gotten it to run on Solaris 10 (minus the sancp component).
godfadda - 26 January '06 - 17:13
Ya Sguil looks awesome. I’m gonna play with that next week I think. Wanna get a couple days of alerts piled up first.benr - 26 January '06 - 17:15
If you ever use snort with passive ethernet taps, Solaris and it’s interface trunking is a great way of reassembling the send and receive so you can snort a single interface.bret - 27 January '06 - 09:49
How was S10 unhappy with the DL360? I’m running it on a DL380 with no problems..Bill Bradford (Email) (URL) - 03 February '06 - 22:42
Thanks for the info—it has been very helpfull.Adam - 13 February '06 - 14:22
[[http://www.seo.co.yu/best_web_design_0..]][[http://www.seo.co.yu/best_web_design_0..]]
BitDesign (Email) (URL) - 06 March '06 - 09:29
I like this site!theodore (Email) (URL) - 15 March '06 - 17:03
Thanks for the special work and information!becky (Email) (URL) - 18 March '06 - 07:50
Hello! Very interesting and professional site.Molli (Email) (URL) - 19 March '06 - 02:48
This site is a lot of fun very well designed.laurette (Email) (URL) - 19 March '06 - 16:35
Holla and Happy Thanksgiving.teena (Email) (URL) - 20 March '06 - 09:16
I am here to say hello and you have a great site!laurette (Email) (URL) - 20 March '06 - 10:31
you have to help me out with mine…cherly (Email) (URL) - 20 March '06 - 16:26
Hi there! Your site is cool!lloyd (Email) (URL) - 22 March '06 - 01:41
Hi there! Your site is cool!sonia (Email) (URL) - 22 March '06 - 01:51
Hope you come back soon!!carolee (Email) (URL) - 22 March '06 - 16:38
Your pictures are great.leo (URL) - 22 March '06 - 18:28
This is the coolest La Cocina.micheal (Email) (URL) - 23 March '06 - 11:54
Great. Thanks!mirian (URL) - 23 March '06 - 13:42
Hello! Very interesting and professional site.reggie (Email) (URL) - 23 March '06 - 21:45
you have to help me out with mine…kristina (Email) (URL) - 24 March '06 - 00:26
This is the coolest La Cocina.Taly (Email) (URL) - 24 March '06 - 08:40
I am here to say hello and you have a great site!leona (Email) (URL) - 24 March '06 - 12:45
Hi there! Your site is cool!calvin (Email) (URL) - 25 March '06 - 00:41
Hi you have a nice homepagetheodore (Email) (URL) - 25 March '06 - 04:51
Thanks for the special work and information!olga (Email) (URL) - 25 March '06 - 13:08
It looks like you really had a nice time.billie (URL) - 26 March '06 - 00:58
You done great work.pennie (Email) (URL) - 26 March '06 - 13:19
This site is a lot of fun very well designed.yasmin (Email) (URL) - 26 March '06 - 19:35
It looks like you really had a nice time.shelly (Email) (URL) - 27 March '06 - 01:41
Very interesting and professional site! Good luck!annabel (Email) (URL) - 27 March '06 - 11:50
Your pictures are great.marinda (Email) (URL) - 29 March '06 - 20:11
Hello! Very interesting and professional site.mirian (Email) (URL) - 31 March '06 - 04:25
It looks like you really had a nice time.calvin (Email) (URL) - 01 April '06 - 01:53
A very nice website !! Very well Done !!!lashanda (Email) (URL) - 01 April '06 - 15:12
Holla and Happy Thanksgiving.Suse (Email) (URL) - 01 April '06 - 23:06
Hi you have a nice homepagefloyd (Email) (URL) - 02 April '06 - 20:58
Your pictures are great.shane (Email) (URL) - 03 April '06 - 02:33
You done great work.mae (Email) (URL) - 03 April '06 - 11:47
Hi there! Your site is cool!Chuke (Email) (URL) - 04 April '06 - 11:48
Hi you have a nice homepageclemente (Email) (URL) - 04 April '06 - 12:56
Holla and Happy Thanksgiving.everette (Email) (URL) - 05 April '06 - 22:50
Can I share some resources with you?lizbeth (Email) (URL) - 06 April '06 - 06:53
You done great work.tommy (Email) (URL) - 07 April '06 - 03:45
I am here to say hello and you have a great site!derek (Email) (URL) - 07 April '06 - 12:04
Hello! Very interesting and professional site.velma (Email) (URL) - 07 April '06 - 20:18
Hello and congratulations!Nick (Email) (URL) - 08 April '06 - 01:42
Can I share some resources with you?pennie (Email) (URL) - 08 April '06 - 04:05
Hello and congratulations!brandy (Email) (URL) - 08 April '06 - 11:30
you have to help me out with mine…misty (Email) (URL) - 09 April '06 - 06:08
A very nice website !! Very well Done !!!hyun (Email) (URL) - 09 April '06 - 07:02
Hello! Very interesting and professional site.marvel (Email) (URL) - 10 April '06 - 13:31
It looks like you really had a nice time.nestor (URL) - 10 April '06 - 17:13
I am here to say hello and you have a great site!elene (Email) (URL) - 11 April '06 - 14:42
Your site is amaizing. Can I share some resources with you?kori (Email) (URL) - 11 April '06 - 16:56
Holla and Happy Thanksgiving.felicia (Email) (URL) - 11 April '06 - 21:52
Holla and Happy Thanksgiving.naomi (Email) (URL) - 12 April '06 - 08:46
Great. Thanks!carole (Email) (URL) - 12 April '06 - 17:15
This is the coolest La Cocina.jackie (Email) (URL) - 13 April '06 - 00:55
This site is a lot of fun very well designed.leona (Email) (URL) - 14 April '06 - 13:54
Very interesting & professional site. You done great work.akilah (Email) (URL) - 15 April '06 - 18:28
I like this site!violet (Email) (URL) - 16 April '06 - 11:24
Follow your dreams, you can reach your goals.mae (Email) (URL) - 17 April '06 - 13:44
Hello and congratulations!leisha (Email) (URL) - 18 April '06 - 09:50
Follow your dreams, you can reach your goals.teena (Email) (URL) - 18 April '06 - 11:59
Thanks for the special work and information!yasmin (Email) (URL) - 18 April '06 - 15:41
This is a wonderful wealth of information. Good Luck!buy phentermine | carisoprodol | phentermine online |
Louise (Email) (URL) - 19 April '06 - 02:06
Not much on my mind right now, but it’s not important. I’ve just been letting everything happen without me. I just don’t have anything to say right now.Halz (Email) (URL) - 19 April '06 - 02:06
A very nice website !! Very well Done !!!carolee (Email) (URL) - 19 April '06 - 08:01
Follow your dreams, you can reach your goals.thanh (Email) (URL) - 19 April '06 - 17:15
CT-Graphics – professional photography, royalty free photos, photo journalism, photo objects, action photography, images – San Diego, California royalty free photos.Stock Photography – Royalty-Free Stock Photos – Photo Objects – Stock Images Low Cost High Resolution at CT-graphics Download royalty free stock photos, stock images, photo-objects at the best stock photography royalty free image site. Search our royalty-free image collections for stock photo objects and royalty free pics for business stock photography, dogs and animals photos, pictures of churches, medical photos, and more! Request pictures at CT – Graphics !!!
CT Graphics (Email) (URL) - 20 April '06 - 06:57
Great. Thanks!doreen (URL) - 21 April '06 - 06:47
Hey man…sorry I missed the party.kristina (Email) (URL) - 22 April '06 - 00:27
Great. Thanks!velma (Email) (URL) - 22 April '06 - 12:08
Great. Thanks!felicia (Email) (URL) - 23 April '06 - 00:29
Hello! Very interesting and professional site.brandy (Email) (URL) - 23 April '06 - 13:10
Your pictures are great.clifford (Email) (URL) - 24 April '06 - 00:54
Great. Thanks!billie (Email) (URL) - 24 April '06 - 11:59
Hi you have a nice homepagejerrie (Email) (URL) - 24 April '06 - 22:59
Hi there! Your site is cool!brandy (Email) (URL) - 25 April '06 - 00:26
Holla and Happy Thanksgiving.priscilla (Email) (URL) - 25 April '06 - 20:12
I like this site!oscar (Email) (URL) - 26 April '06 - 08:21
Follow your dreams, you can reach your goals.kori (Email) (URL) - 26 April '06 - 17:40
Your site is amaizing. Can I share some resources with you?micheal (Email) (URL) - 27 April '06 - 02:01
I like this site!clifford (Email) (URL) - 28 April '06 - 17:28
Your pictures are great.misty (Email) (URL) - 29 April '06 - 16:30
I am here to say hello and you have a great site!Peter (Email) (URL) - 30 April '06 - 15:11
Hi there! Your site is cool!kristina (Email) (URL) - 01 May '06 - 03:03
I like this site!pennie (Email) (URL) - 01 May '06 - 14:35
Follow your dreams, you can reach your goals.floyd (Email) (URL) - 02 May '06 - 13:42
This is the coolest La Cocina.lizbeth (Email) (URL) - 03 May '06 - 02:23
Your site is amaizing. Can I share some resources with you?nydia (Email) (URL) - 05 May '06 - 03:26
Hi there! Your site is cool!calvin (Email) (URL) - 05 May '06 - 03:40
good site!Alex (Email) (URL) - 05 May '06 - 05:40
best siteMary (Email) (URL) - 06 May '06 - 10:38
Just wanted to say hi, thanks and byeAlex (Email) (URL) - 06 May '06 - 13:42
Hey man…sorry I missed the party.becky (Email) (URL) - 07 May '06 - 02:07
Hello! Very interesting and professional site.micheal (Email) (URL) - 07 May '06 - 02:46
Just wanted to say hi, thanks and byeJohn (Email) (URL) - 12 June '06 - 13:59
This is very interesting sitecalvin (Email) (URL) - 12 June '06 - 13:59
Hey man…sorry I missed the party.maire (Email) (URL) - 13 June '06 - 00:29
Great. Thanks!alex (Email) (URL) - 13 June '06 - 02:23
Thanks for the special work and information!hai (Email) (URL) - 13 June '06 - 02:27
I am here to say hello and you have a great site!samira (Email) (URL) - 13 June '06 - 17:44
Your site is amaizing. Can I share some resources with you?allen (Email) (URL) - 13 June '06 - 21:44
Just wanted to say hi, thanks and bye