Re: [sentinix-list] Client-Server Sensor Config / How-To

Michel, 
 I will produce a cleaner how-to in a week or so, this one is rough. I'm going this afternoon and pick up two more sensor boxes and new server, I'll be rebuilding the whole system this coming week so the how-to will expand somewhat, wait on the newer version before you post it. Grand total will be 3 sensors (monitoring 2 subnets) and a single server, Ill include hardware specs.

 It is important to me to have these machines secured so I will be asking for advice on the firewalling methods after everything is built and running, thanks for the input thus far. I'll get it working first and then begin hardening a single machine so if it stops working I know what I did wrong.

 I email you the finished doc when its updated.

Thanks,
Michael

-----Original Message-----
From: Michel Blomgren <[email protected]>
Sent: Jan 9, 2004 4:40 PM
To: "M. Morgan" <[email protected]>, 
	The SENTINIX Mailing List <[email protected]>
Subject: Re: [sentinix-list] Client-Server Sensor Config / How-To

Great work!

You couldn't posibly produce a HTML page of this information?, then I could 
put it up on sentinix.org!

As far as I can see, it's correct.

Just some addition, the NIC used to gather packets to sniff should not be used 
for anything other than getting sniffing info, no INPUT or FORWARD or OUTPUT 
traffic should be allowed to/from it, if not using Netfilter (iptables) you 
could probably null route the entire interface (eth0, e.g.). The NIC should 
also have a bogus IP and a netmask of 255.255.255.255.   For security, there 
should be anti-spoof DROP rules on the admin NIC and rather strict INPUT 
rules. Stateful firewalling (-m state --state ...) for incoming traffic is 
best.  Also, very important, ip_forward is turned on by default, edit 
rc.inet1 and disable it, otherwise you _might_ route the duplicated traffic 
coming in on the sniffing interface through the admin interface, back into 
your network, that's not nice. :)

All this requires some work, but it pays off in the end.

Good instructions && good job!

	Michel

On Friday 09 January 2004 21:07, M. Morgan wrote:
> Hello all,
>  Here is a quick and dirty run down of what I had to do to get a
> client-server setup working. I'm going to rebuild the server and add 2 more
> sensors next week so I'll fine-tune this document with new information and
> submit the final draft when Im finished.
>
> In the meantime, here are my notes I'm going to use for my new sensors for
> those that are interested.
>
> ***************************************************************************
>************* Client-Server set-up of Snort, Snort Center Sensor Agent
> (remote) and MySQL Database with Sentinix Linux.
>
> This document describes the set-up of remote sensors reporting to a central
> database.
>
>  There are a few things to consider before you begin using this document.
> This document contains only what I deemed to be the “tricky parts” of
> the set-up process, it was time consuming to use the “trial and error”
> method like I did and I documented it in an effort to make future
> deployments more cost effective.
>
>  You should already have some ability administering Linux before you begin.
>
> The IP numbers listed here are LAN IP’s and will change depending on your
> configuration. I have them statically assigned to dual NIC’s, one NIC for
> administration purposes and one NIC being monitored by Snort. For (remote)
> administration purposes I recommend that the IP’s for your admin consoles
> be statically assigned as well, if your DHCP server changes your IP’s
> you’ll be locked out.
>
>  That being said, let’s begin.
>
>  1) When adding remote sensors to the Snort Center admin console the
> username and password are the following by default: -username: admin
> 	-password: change
>
>  If you change the Snort Center default login information this would
> probably change as well, I believe both services use the same user and
> pass.
>
> 2) When you install Snort Center on a box (it’s installed by default with
> Sentinix) the snort sensor "miniserv.conf" access list is blank. This
> prevents communication between the Snort Center admin console on the MySQL
> server and the remote Snort Center Agent node. IE: It will produce an
> “access not permitted” error when you try and add the sensor.
>
>  To remedy this, open the miniserv.conf file on the remote sensor box in
> vim and enter the IP#'s of any remote machines you would like to grant
> remote access to (like the Snort Center command console on the MySQL
> server). The path to this file is:
> 	/usr/local/snort/sensor/conf
> 		"cat miniserv.conf"
>
>
>
>
>
>
>
>
>
>
> miniserv.conf continued:
>
>  This file’s default contents are as follows:
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> [email protected]:/usr/local/snort/sensor/conf# cat miniserv.conf
> port=2525  <<< note that the miniserv listens on 2525, you’ll need this
> information latter when configuring your firewall. bind=
> root=/usr/local/snort/sensor/cgi
> host=localhost
> addtype_cgi=internal/cgi
> realm=SnortCenter Sensor
> logfile=/usr/local/snort/sensor/log/miniserv.log
> pidfile=/usr/local/snort/sensor/log/miniserv.pid
> errorlog=/usr/local/snort/sensor/log/miniserv.error
> logtime=168
> ssl=1
> env_SENSOR_CONFIG=/usr/local/snort/sensor/conf
> env_SENSOR_VAR=/usr/local/snort/sensor/log
> atboot=1
> logout=/usr/local/snort/sensor/conf/logout-flag
> denyfile=\.pl$
> log=1
> blockhost_failures=5
> blockhost_time=60
> passdelay=1
> syslog=1
> allow=localhost    <<< add IP numbers here, use "spaces" for separators not
> comma's. session=0
> userfile=/usr/local/snort/sensor/conf/sensor.users
> keyfile=/usr/local/snort/sensor/conf/sensor.pem
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>
>
>
>
>
>
>
>
>
>
>
> To Create An Out-Put Plug-In:
>
>  Once you’ve edited the “allow=” field of “miniserv.conf” on the
> remote sensor you need to create a new out-put plug-in in Snort Center so
> the remote sensor knows which database to write to. In our case this
> database is a remote MySQL box.
>
> Editing:
> In the Snort Center GUI (On the Server) go to:
> 	-resources
> 	 -output plug-ins
> 	  -create output plug-in
> And set up a new plug-in for remote sensor like the following:
>
> Database:                                 -Log to a variety of databases
> Sensor Name			-use keyword [AUTO] for automatic sensor_name
> DB Name			-alert
> DB Type			-[mysql | postgresql | odbc | mssql | oracle]
> DB Host			-(hostname or IP address) (either localhost or IP#)
> DB Port			-(default: 3306)
> User				-snort
> Password			-sentinix
> Ruletype			-[log | alert] (mine is set to alert)
> Encoding			-[hex | base64 | ascii] (choose <enter> for default)
> Detail				-[full | fast] (choose <enter> for default)
>
> Note that the information in these fields would change if you had a
> different type of database or had changed your passwords etc.
>
> Plug-in on Server: / this is the default plug-in to use if your database is
> on the same box as the sensor. output database: alert, mysql, user=snort
> password=sentinix dbname=snort host=localhost port=3306 sensor_name=[AUTO]
>
> Plug-in on Remote Sensor: / this is the plug-in to use if your database is
> remote. output database: alert, mysql, user=snort password=sentinix
> dbname=snort host=xxx.xxx.xxx.xxx port=3306 sensor_name=[AUTO]
>
>
>
>
>
>
>
>
> Continued on next page:
> MySQL Database Configuration:
>
> I recommend using the WebMin MySQL database admin tool.
>
> You must add a MySQL database user to the MySQL database or Snort Center
> will produce an error when you try and "Push & Reload" the Snort rule and
> start the remote sensor.
>
> The error is as follows:
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ERROR: database: mysql_error: Access denied for user: '[email protected]'
> (Using password: YES) Fatal Error, Quitting..
> database: compiled support for ( mysql )
> database: configured to use mysql
> database: user = snort
> database: password is set
> database: database name = snort
> database: host = 192.168.1.199
> database: port = 3306
> database: sensor name = Ren
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Here is an example detailing the problem:
> Using: Sentinix Linux
> snort + snortcenter + mysql + acid
>
> On two boxes:
> 192.168.1.199 <sql server>
> 192.168.1.16  <remote snort>
>
> Both boxes have the following installed.
> snort
> snortcenter
> mysql
> webmin
> acid
> nagios
>
>
>
>
> MySQL Database Configuration continued:
>
>  Both snort installs work fine if I direct them to log to their local MySQL
> databases IE: (localhost)
>
> The error appears when I try and redirect the output of sensor
> (xxx.xxx.xxx.16) to the dedicated MySQL server (xxx.xxx.xxx.199), the error
> is as follows:
>
> Btw: I’m using the following output plug in:
> output database: alert, mysql, user=snort password=sentinix dbname=snort
> host=192.168.1.199 port=3306 sensor_name=[AUTO]
>
> ERROR: database: mysql_error: Access denied for user: '[email protected]'
> (Using password: YES) (<<<how many times have you seen people asking about
> this one?) Fatal Error, Quitting..
> database: compiled support for ( mysql )
> database: configured to use mysql
> database: user = snort
> database: password is set
> database: database name = snort
> database: host = 192.168.1.199
> database: port = 3306
> database: sensor name = Ren
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> To remedy this add “User” and “Database” permissions to the MySQL
> database for the remote sensor:
>
>  Be certain to add "sentinix" as the password for the new user as it is the
> default password for the database table. ED: Note, If you chose another
> password during your MySQL setup, (IE: if you installed MySQL yourself on
> different Linux Distro) enter it instead.
>
> Connect to WebMin *On the Server*
> 	-select Servers / MySQL / User Permissions:
>
> Create a New database User with the following attributes:
>
> User = snort
> Host = < remote IP# >
> Password (Set To :) sentinix    (it’s the default remember?)
> Permissions: All (you may want to change this to omit “grant
> permissions” rights at some point)
>
>
> MySQL Database Configuration continued:
>
> Click “Save” and return to the User Permissions screen and you’ll see
> a new entry displaying the information you entered. (Ed. Note: the
> encrypted password displayed will be the same as the others in the list)
>
> 3 New “Database Permissions” have to be created as well, like this:
> For Snort:
> Create New Database Permissions:
> Database = snort
> User = snort
> Host = 192.168.1.xxx
> Permissions = All except “grant permissions”
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> For Snort Center:
> Create New Database Permissions:
> Database = snortcenter
> User = snort
> Host = 192.168.1.xxx
> Permissions = All except “grant permissions”
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> For Snort Archive:
> Create New Database Permissions:
> Database = snort archive
> User = snort
> Host = 192.168.1.xxx
> Permissions = All except “grant permissions”
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> Next:
> Return to the Snort Center GUI (on the server) and select sensor config /
> select output rules / select the remote out-put plug-in you created that
> will point the sensor NIC to the MySQL server.
>
> Go to the Sensor Console (on the server) and select the new remote sensor
> (check box), select “push and reload” from the drop down menu, select
> “Start Sensor” and start the remote sensor.
>
> All should be well at this point.
>
> I like to do a quick ping sweep on the LAN segment to generate some snort
> alerts and verify that the sensor is working correctly and writing to
> appropriate database.
>
>
> Notes:
> -All unnecessary user permissions and accounts for the MySQL database
> should be removed.
>
> -All default passwords should be changed.
>
> -All access to both the MySQL server and remote sensor services should be
> restricted via access lists, additionally I recommend SSHD be configured to
> use RSA authentication.
>
> -IP Tables should be configured on all machines.
>
> -Dual NIC’s should be used with Snort sniffing one and the other on a
> trusted network for admin purposes. All connection attempts on the sniffed
> NIC (eth0) should be discarded.
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Services and Ports list for each Sentinix Box:
> Snort Center: port 2525
> MySQL: TCP port 3306
> SSH: TCP port 22 (enable RSA as soon as possible)
> Underdog MySQL server: 192.168.1.199
> Admin pc addresses: 192.168.1.77, 192.168.1.177
> Network time protocol (NTP): UDP port 123
> WebMin: TCP port 10000
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Software:
> Sentinix Linux: Including the software that installs with it, IE: ACID,
> Snort, MySQL, Snort Center, Nagios, Nagat etc. http://sentinix.org/
>
> WebMin:
> <current>.tar.gz - ./setup.sh
> (I installed it as Slackware 8; you may try installing as “Linux from
> Scratch” as well) WebMin is very convenient for administering Linux
> without a desktop, particularly the MySQL database permissions, Post Fix
> for email alerts and the IP Tables plug in.  http://www.webmin.com/
>
> ***************************************************************************
>**************** This document is fairly “rough” and a work in progress,
> it addresses specific issues that I encountered and should be used with the
> pertinent documentation at: www.mysql.com
> www.sentinix.org
> www.webmin.com
> www.snort.org
> And the ever popular:
> www.tldp.org
> ***************************************************************************
>****************
>
> Thanks,
> Michael
>
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> M. Morgan
> Network Administrator
> SEBA
> mikemorgan AT mindspring.com
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix