Re: Snort3 configuration issues

Yehor Velykozhon via Snort-users <[email protected]>
Newsgroups gmane.comp.security.ids.snort.general
Message-ID <[email protected]> 
As I understand, you followed the steps from https://kifarunix.com/install-and-configure-snort-3-nids-on-ubuntu-20-04/

On the step “Under IPS section, define the location to your rules;”
You should add following configuration in ips section: “variables = default_variables”

If this didn’t help, can you execute the following command and send result of it?

Command: cat /usr/local/etc/snort/snort.lua

Thanks, Yehor.

From: Francisco Godoy Gmail <[email protected]>
Date: Wednesday, 24 November 2021 at 14:04
To: Yehor Velykozhon <[email protected]>
Cc: "'Shravan Rangarajuvenkata (shrarang)'" <[email protected]>, "[email protected]" <[email protected]>
Subject: RES: [Snort-users] Snort3 configuration issues


CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
thank you very much 😊
Unfortunely, this “snort.lua” has the same configs than mine.
Could you please send a file with the adjusts ?

Sory about my poor skiks over snort ☹

Best regards
Francisco


De: Yehor Velykozhon <[email protected]>
Enviada em: quarta-feira, 24 de novembro de 2021 06:10
Para: Francisco Godoy Gmail <[email protected]>
Cc: 'Shravan Rangarajuvenkata (shrarang)' <[email protected]>; [email protected]
Assunto: Re: [Snort-users] Snort3 configuration issues

Here is the link to the GitHub repository of Snort3 where you can find all default configurations:
https://github.com/snort3/snort3/tree/master/lua

I attached snort.lua from that repository.

Thanks, Yehor.

From: Francisco Godoy Gmail <[email protected]<mailto:[email protected]>>
Date: Wednesday, 24 November 2021 at 10:39
To: Yehor Velykozhon <[email protected]<mailto:[email protected]>>
Cc: "'Shravan Rangarajuvenkata (shrarang)'" <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>
Subject: RES: [Snort-users] Snort3 configuration issues


CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
Thank you again,
Do you have a snort.lua file and could you send it for me please ?


thank you very much 😊


De: Yehor Velykozhon <[email protected]<mailto:[email protected]>>
Enviada em: terça-feira, 23 de novembro de 2021 08:44
Para: Francisco Godoy Gmail <[email protected]<mailto:[email protected]>>
Cc: 'Shravan Rangarajuvenkata (shrarang)' <[email protected]<mailto:[email protected]>>; [email protected]<mailto:[email protected]>
Assunto: Re: [Snort-users] Snort3 configuration issues

You should add the following line in config file after including snort_defaults.lua

ips = { variables = default_variables }

Example:
-----------------------------------------------------------------------
HOME_NET = "10.10.10.0/24"
EXTERNAL_NET = '[10.0.17.0/24 10.0.14.0/24 192.168.0.0/16]'

conf_dir = os.getenv(‘LUA_PATH’)

if ( not conf_dir ) then
   conf_dir = '.'
end

dofile(conf_dir .. '/snort_defaults.lua')

ips = { variables = default_variables }
-----------------------------------------------------------------------

You should be aware of overriding ips module: ‘ips = { … }’ mean that all previous data in ips will be discarded.
If in your configuration you have previously defined ips module, instead of “ips = { variables = default_variables }”
write “ips.variables = default_variables”


Thanks, Yehor.

From: Francisco Godoy Gmail <[email protected]<mailto:[email protected]>>
Date: Sunday, 21 November 2021 at 11:20
To: Yehor Velykozhon <[email protected]<mailto:[email protected]>>
Cc: "'Shravan Rangarajuvenkata (shrarang)'" <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>
Subject: RES: [Snort-users] Snort3 configuration issues


CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
Thank you, an apologize ☹ But does not worked, I am trying to use other rule base “snortrules-snapshot-31150”.
Attached the error founded.
More one time thank you a lot about your patience

Best Regards
Francisco

De: Yehor Velykozhon <[email protected]<mailto:[email protected]>>
Enviada em: segunda-feira, 8 de novembro de 2021 07:27
Para: [email protected]<mailto:[email protected]>
Cc: Shravan Rangarajuvenkata (shrarang) <[email protected]<mailto:[email protected]>>; [email protected]<mailto:[email protected]>
Assunto: Re: [Snort-users] Snort3 configuration issues

Hello Francisco!

All variables must be assigned before including snort_defaults.lua

Example of snort.lua:
-----------------------------------------------------------------------
HOME_NET = "10.10.10.0/24"
EXTERNAL_NET = '[10.0.17.0/24 10.0.14.0/24 192.168.0.0/16]'

conf_dir = os.getenv(‘LUA_PATH’)

if ( not conf_dir ) then
   conf_dir = '.'
end

dofile(conf_dir .. '/snort_defaults.lua')
-----------------------------------------------------------------------

or

-----------------------------------------------------------------------
ips =
{
   id = 1,
   rules = local_rules,
   variables =
   {
       nets =
       {
           HOME_NET = '192.168.1.0/24',
           EXTERNAL_NET = '10.10.10.0/24'
       }
   }
}
-----------------------------------------------------------------------

Thank you, Yehor!

From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of "Shravan Rangarajuvenkata (shrarang) via Snort-users" <[email protected]<mailto:[email protected]>>
Reply to: "Shravan Rangarajuvenkata (shrarang)" <[email protected]<mailto:[email protected]>>
Date: Tuesday, 2 November 2021 at 18:11
To: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>
Cc: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] Snort3 configuration issues


CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.


From: Francisco Godoy Gmail <[email protected]<mailto:[email protected]>>
Date: Monday, November 1, 2021 at 10:59 AM
To: Shravan Rangarajuvenkata (shrarang) <[email protected]<mailto:[email protected]>>
Subject: RES: [Snort-openappid] RTMP packets have no "http://"
Hello Shravan
I am trying to install Snort 3 but I saw the error below:

Finished /usr/local/etc/snort/snort.lua:
Loading /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:
ERROR: /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:389 Undefined variable in the string: $SQL_SERVERS.
ERROR: /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:389 undefined variable in the string: $EXTERNAL_NET.
ERROR: /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:1777 Undefined variable in the string: $HOME_NET.
ERROR: /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:1777 undefined variable in the string: $EXTERNAL_NET.
FATAL: /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:1777 ***PortVar Lookup failed on '$HTTP_PORTS'.
Fatal Error, Quitting..

snort.lua configuration:

“-- HOME_NET and EXTERNAL_NET must be set now
-- setup the network addresses you are protecting
HOME_NET = '10.1.5.253/32'

-- set up the external network addresses.
-- (leave as "any" in most situations)

-- EXTERNAL_NET = 'any'
EXTERNAL_NET = '!$HOME_NET'”

Source step by step installation website:
https://kifarunix.com/install-and-configure-snort-3-nids-on-ubuntu-20-04/

Could you  help me ?

thank you very much 😊


De: Snort-openappid <[email protected]<mailto:[email protected]>> Em nome de Shravan Rangarajuvenkata (shrarang) via Snort-openappid
Enviada em: quinta-feira, 21 de outubro de 2021 12:52
Para: [email protected]<mailto:[email protected]>
Assunto: [Snort-openappid] RTMP packets have no "http://"

Date: Thu, 12 Aug 2021 16:25:42 +0800 (CST)
From: ?? <[email protected]<mailto:[email protected]>>
To: [email protected]<mailto:[email protected]>
Subject: [Snort-openappid] the rtmp packets have no "http://"
Message-ID: <[email protected]<mailto:[email protected]>>
Content-Type: text/plain; charset="gbk"

static int detector_add_rtmp_url(lua_State* L)
{
..................
 ud->get_odp_ctxt().get_http_matchers().insert_rtmp_url_pattern(pattern);

Why is it here   http ?    the rtmp packets like this :  StreamPlayer/..flashVer...WIN 9,0,47,0..swfUrl...file://..tcUrl..*rtmp://fc432.streamedia.info/Strea.mPlayer/..fpad....audioCodecs

have no http:// xxxxxxxxxx

..................
}

>>> Because RTMP has similar metadata as HTTP, AppId treats RTMP traffic like HTTP for detecting payload applications in it. However, AppId uses separate matchers for RTMP as can be seen in the code:



void HttpPatternMatchers::insert_rtmp_url_pattern(DetectorAppUrlPattern* pattern)

{

    rtmp_url_patterns.emplace_back(pattern);

}

We have a separate Lua detector API for registering RTMP patterns – addRTMPUrl. The patterns registered with this API will not interfere with the HTTP patterns.

This API also allows you to register a path pattern. For example, in odp/lua/payload_group_chivas.lua:
gRTMPPatternList = {
    --ESPN Video
    { 0, 0, 0, 2933, 0, "espn.go.com", "/", "http:", "", 2933},
    --Crackle Video
    { 0, 0, 0, 2955, 0, "crackle.com", "/", "http:", "", 2955},
}

You could replace “http:” with the path pattern you need.

Please let us know if appid detection doesn’t work for your RTMP app after doing the above.

Thanks,
Shravan

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.