snortの機能を使い尽くす＆ hogwashも使ってみる

Size: px

Start display at page:

Download "snortの機能を使い尽くす＆ hogwashも使ってみる"

ちかこかみいしづ
5 years ago
Views:

1 presented by P snort hogwash

2 snort1.8.2(3) Martin Roesch IDS IDS

3 hogwash snort1.7 FW+NIDS 100M IP IP

4 snort./configure;make su make install configure Flexresp database snmp snmp alert idmef xml smbalert SMB alert Windows

5 Flexresp RST ICMP-unreachable FTP

6 Flexresp resp:hoge hoge rst_snd rst_rcv rst_all TCP icmp_host icmp_net icmp_port icmp_all UDP) :shikap FTP alert tcp any any -> (msg: shikap is coming ; content: USER ; content: shikap ;nocase;resp:rst_all;)

7 ftp shikap]$ ftp ponta Connected to ponta. 220 ponta FTP server ready. Name (ponta:shikap): shikap 421 Service not available, remote server has closed connection Login failed. No control connection for command: Transport endpoint is not connected ftp> bye

8 ftp kazumi > ponta.ftp: S : (0) ponta.ftp > kazumi.32850: S : (0) ack kazumi > ponta.ftp:. ack 1 3way-handshake ponta.ftp > kazumi.32850: P 1:81(80) ack 1 ftp kazumi > ponta.ftp:. ack 81 kazumi > ponta.ftp: P 1:14(13) ack 81 USER shikap ponta.ftp > kazumi.32850:. ack 14 ftp kazumi > ponta.ftp: R : (0) RST

9 Flexresp libnet snort1.8.2 Flexresp (1.8.3 OK RedHat

10 detabase postgresql mysql ODBC oracle postgresql mysql ACID IDS ACID:Analysis Console for Intrusion Database

11 trap_snmp alert snmp trap snmp snmp IPA

12 trap Nov 24 21:26:30 kazumi snmptrapd[2102]: kazumi [ ]: Trap system.sysuptime.0 = Timeticks: ( ) 5:56:17.06.iso.org.dod.internet.snmpV2.snmpModules.snmpMIB.snmpMIBOb jectssnmptrap.snmptrapoid.0 = OID: enterprises enterprises = "Snort! <*-.Version (Build 87)" enterprises = 0 enterprises = "== NA ==" enterprises = " " enterprises = "ICMP PING *NIX" enterprises = "Protocol: ICMP" enterprises = 1 enterprises = " " enterprises = 1 enterprises = " "

13 trap_snmp snort.conf trap_snmp: alert, internal, trap, -v2c , private snmp snmp snort

14 smb_alert NetBIOS Windows alert Windows popup_window Windows samba smbclient

15 XML IDMEF) XML XML IDMEF Intrusion Detection Message Exchange Format) -> XML

16 snort.conf XML output xml:log, file=output output xml:log, protocol=https host=air.cert.org file=alert.snort cert=mycert key=mykey.pem ca=ca.crt server=srv_list.lst tcp http https iap Intrusion Alert Protocol

17 XML <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE snort-message-version-0.1 (View Source for full doctype...)> - <file> + <event version="1.0"> - <event version="1.0"> - <sensor encoding="hex" detail="full"> - <interface>eth0</interface> - <ipaddr version="4"> </ipaddr> - <hostname>kazumi</hostname> - </sensor> - <signature id="366" revision="4" class="28" priority="3">icmp PING *NIX</signature> - <timestamp> :26:29+09</timestamp> - - <packet> - - <iphdr saddr=" " daddr=" " proto="1" ver="4" hlen="5" len="84" ttl="64" csum="47235"> - - <icmphdr type="8" code="0" csum="44299"> <data>634d0d a0b0c0d0e0f a1b1c1d1e1f A2B2C2D2E2F </data> - </icmphdr> - </iphdr> - </packet> - </event> - </file>

18 /var/log/snort/ syslog /var/log/snort/ -l syslog alert snort.conf -s Nov 24 21:26:29 kazumi snort: [1:366:4] ICMP PING *NIX [Classification: Misc activity] [Priority: 3]: {ICMP} >

19 tcpdump unified snort CSV UNIX

20 snort FW

21 tcpdump ethereal ( IIS UNICODE TRAVERSAL

22 hogwash snort1.7+flexresp 0.01d README configure src.rpm

23 FW

24 snort1.7 snort drop pass alert log sdrop 0.02 alert

25 drop drop /bin/sh drop alert IIS UNICODE TRAVERSAL IP FW FW

27 RST ip_forward 1 pcap eth0 eth1 eth0 FW

28 snort hogwash snort Flexresp hogwash

29 configure hogwash pcap pre6

2 1: OSI OSI,,,,,,,,, 4 TCP/IP TCP/IP, TCP, IP 2,, IP, IP. IP, ICMP, TCP, UDP, TELNET, FTP, HTTP TCP IP

1.,.. 2 OSI,,,,,,,,, TCP/IP,, IP, ICMP, ARP, TCP, UDP, FTP, TELNET, ssh,,,,,,,, IP,,, 3 OSI OSI(Open Systems Interconnection: ). 1 OSI 7. ( 1) 4 ( 4),,,,.,.,..,,... 1 2 1: OSI OSI,,,,,,,,, 4 TCP/IP TCP/IP,

snortの機能を使い尽くす ＆ hogwashも使ってみる

snortの機能を使い尽くす＆ hogwashも使ってみる