[sentinix-list] Client-Server Sensor Config / How-To

Hello all,
 Here is a quick and dirty run down of what I had to do to get a client-server setup working. I'm going to rebuild the server and add 2 more sensors next week so I'll fine-tune this document with new information and submit the final draft when Im finished. 

In the meantime, here are my notes I'm going to use for my new sensors for those that are interested.

****************************************************************************************
Client-Server set-up of Snort, Snort Center Sensor Agent (remote) and MySQL Database with Sentinix Linux. 

This document describes the set-up of remote sensors reporting to a central database.

 There are a few things to consider before you begin using this document. This document contains only what I deemed to be the “tricky parts” of the set-up process, it was time consuming to use the “trial and error” method like I did and I documented it in an effort to make future deployments more cost effective.

 You should already have some ability administering Linux before you begin.

The IP numbers listed here are LAN IP’s and will change depending on your configuration. I have them statically assigned to dual NIC’s, one NIC for administration purposes and one NIC being monitored by Snort. For (remote) administration purposes I recommend that the IP’s for your admin consoles be statically assigned as well, if your DHCP server changes your IP’s you’ll be locked out.

 That being said, let’s begin.

 1) When adding remote sensors to the Snort Center admin console the username and password are the following by default:
	-username: admin
	-password: change

 If you change the Snort Center default login information this would probably change as well, I believe both services use the same user and pass.

2) When you install Snort Center on a box (it’s installed by default with Sentinix) the snort sensor "miniserv.conf" access list is blank. This prevents communication between the Snort Center admin console on the MySQL server and the remote Snort Center Agent node. 
IE: It will produce an “access not permitted” error when you try and add the sensor.

 To remedy this, open the miniserv.conf file on the remote sensor box in vim and enter the IP#'s of any remote machines you would like to grant remote access to (like the Snort Center command console on the MySQL server).
 The path to this file is:
	/usr/local/snort/sensor/conf
		"cat miniserv.conf"










miniserv.conf continued:

 This file’s default contents are as follows:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[email protected]:/usr/local/snort/sensor/conf# cat miniserv.conf
port=2525  <<< note that the miniserv listens on 2525, you’ll need this information latter when configuring your firewall.
bind=
root=/usr/local/snort/sensor/cgi
host=localhost
addtype_cgi=internal/cgi
realm=SnortCenter Sensor
logfile=/usr/local/snort/sensor/log/miniserv.log
pidfile=/usr/local/snort/sensor/log/miniserv.pid
errorlog=/usr/local/snort/sensor/log/miniserv.error
logtime=168
ssl=1
env_SENSOR_CONFIG=/usr/local/snort/sensor/conf
env_SENSOR_VAR=/usr/local/snort/sensor/log
atboot=1
logout=/usr/local/snort/sensor/conf/logout-flag
denyfile=\.pl$
log=1
blockhost_failures=5
blockhost_time=60
passdelay=1
syslog=1
allow=localhost    <<< add IP numbers here, use "spaces" for separators not comma's.
session=0
userfile=/usr/local/snort/sensor/conf/sensor.users
keyfile=/usr/local/snort/sensor/conf/sensor.pem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~












To Create An Out-Put Plug-In:

 Once you’ve edited the “allow=” field of “miniserv.conf” on the remote sensor you need to create a new out-put plug-in in Snort Center so the remote sensor knows which database to write to. In our case this database is a remote MySQL box.

Editing:
In the Snort Center GUI (On the Server) go to:
	-resources
	 -output plug-ins
	  -create output plug-in
And set up a new plug-in for remote sensor like the following:

Database:                                 -Log to a variety of databases
Sensor Name			-use keyword [AUTO] for automatic sensor_name
DB Name			-alert	
DB Type			-[mysql | postgresql | odbc | mssql | oracle]
DB Host			-(hostname or IP address) (either localhost or IP#)
DB Port			-(default: 3306)
User				-snort
Password			-sentinix
Ruletype			-[log | alert] (mine is set to alert)
Encoding			-[hex | base64 | ascii] (choose <enter> for default)
Detail				-[full | fast] (choose <enter> for default)

Note that the information in these fields would change if you had a different type of database or had changed your passwords etc.

Plug-in on Server: / this is the default plug-in to use if your database is on the same box as the sensor.
output database: alert, mysql, user=snort password=sentinix dbname=snort host=localhost port=3306 sensor_name=[AUTO]

Plug-in on Remote Sensor: / this is the plug-in to use if your database is remote.
output database: alert, mysql, user=snort password=sentinix dbname=snort host=xxx.xxx.xxx.xxx port=3306 sensor_name=[AUTO]








Continued on next page:
MySQL Database Configuration:

I recommend using the WebMin MySQL database admin tool.

You must add a MySQL database user to the MySQL database or Snort Center will produce an error when you try and "Push & Reload" the Snort rule and start the remote sensor.

The error is as follows:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ERROR: database: mysql_error: Access denied for user: '[email protected]' (Using password: YES)
Fatal Error, Quitting..
database: compiled support for ( mysql )
database: configured to use mysql
database: user = snort
database: password is set
database: database name = snort
database: host = 192.168.1.199
database: port = 3306
database: sensor name = Ren
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Here is an example detailing the problem:
Using: Sentinix Linux
snort + snortcenter + mysql + acid

On two boxes:
192.168.1.199 <sql server>
192.168.1.16  <remote snort>

Both boxes have the following installed.
snort
snortcenter
mysql
webmin
acid
nagios




MySQL Database Configuration continued:

 Both snort installs work fine if I direct them to log to their local MySQL databases
IE: (localhost)

The error appears when I try and redirect the output of sensor (xxx.xxx.xxx.16) to the dedicated MySQL server (xxx.xxx.xxx.199), the error is as follows:

Btw: I’m using the following output plug in:
output database: alert, mysql, user=snort password=sentinix dbname=snort
host=192.168.1.199 port=3306 sensor_name=[AUTO]

ERROR: database: mysql_error: Access denied for user: '[email protected]' (Using password: YES) (<<<how many times have you seen people asking about this one?)
Fatal Error, Quitting..
database: compiled support for ( mysql )
database: configured to use mysql
database: user = snort
database: password is set
database: database name = snort
database: host = 192.168.1.199
database: port = 3306
database: sensor name = Ren

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

To remedy this add “User” and “Database” permissions to the MySQL database for the remote sensor:

 Be certain to add "sentinix" as the password for the new user as it is the default password for the database table. 
 ED: Note, If you chose another password during your MySQL setup, (IE: if you installed MySQL yourself on different Linux Distro) enter it instead.

Connect to WebMin *On the Server* 
	-select Servers / MySQL / User Permissions:

Create a New database User with the following attributes:

User = snort
Host = < remote IP# >
Password (Set To :) sentinix    (it’s the default remember?)
Permissions: All (you may want to change this to omit “grant permissions” rights at some point)


MySQL Database Configuration continued:

Click “Save” and return to the User Permissions screen and you’ll see a new entry displaying the information you entered. (Ed. Note: the encrypted password displayed will be the same as the others in the list)

3 New “Database Permissions” have to be created as well, like this:
For Snort:
Create New Database Permissions:
Database = snort
User = snort
Host = 192.168.1.xxx
Permissions = All except “grant permissions”
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
For Snort Center:
Create New Database Permissions:
Database = snortcenter
User = snort
Host = 192.168.1.xxx
Permissions = All except “grant permissions”
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
For Snort Archive:
Create New Database Permissions:
Database = snort archive
User = snort
Host = 192.168.1.xxx
Permissions = All except “grant permissions”
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Next:
Return to the Snort Center GUI (on the server) and select sensor config / select output rules / select the remote out-put plug-in you created that will point the sensor NIC to the MySQL server.

Go to the Sensor Console (on the server) and select the new remote sensor (check box), select “push and reload” from the drop down menu, select “Start Sensor” and start the remote sensor.

All should be well at this point.

I like to do a quick ping sweep on the LAN segment to generate some snort alerts and verify that the sensor is working correctly and writing to appropriate database.


Notes:
-All unnecessary user permissions and accounts for the MySQL database should be removed.

-All default passwords should be changed.

-All access to both the MySQL server and remote sensor services should be restricted via access lists, additionally I recommend SSHD be configured to use RSA authentication.

-IP Tables should be configured on all machines.

-Dual NIC’s should be used with Snort sniffing one and the other on a trusted network for admin purposes. All connection attempts on the sniffed NIC (eth0) should be discarded.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Services and Ports list for each Sentinix Box:
Snort Center: port 2525
MySQL: TCP port 3306
SSH: TCP port 22 (enable RSA as soon as possible)
Underdog MySQL server: 192.168.1.199
Admin pc addresses: 192.168.1.77, 192.168.1.177
Network time protocol (NTP): UDP port 123
WebMin: TCP port 10000
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Software:
Sentinix Linux: Including the software that installs with it, IE: ACID, Snort, MySQL, Snort Center, Nagios, Nagat etc.
http://sentinix.org/

WebMin: 
<current>.tar.gz - ./setup.sh
(I installed it as Slackware 8; you may try installing as “Linux from Scratch” as well)
WebMin is very convenient for administering Linux without a desktop, particularly the MySQL database permissions, Post Fix for email alerts and the IP Tables plug in.  http://www.webmin.com/

*******************************************************************************************
This document is fairly “rough” and a work in progress, it addresses specific issues that I encountered and should be used with the pertinent documentation at:
www.mysql.com
www.sentinix.org
www.webmin.com
www.snort.org
And the ever popular:
www.tldp.org
*******************************************************************************************

Thanks,
Michael


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
M. Morgan
Network Administrator
SEBA
mikemorgan AT mindspring.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~