snort_inline
Link http://snort-inline.sourceforge.net/oldhome.html
What is snort_inline?
snort_inline is basically a modified version of Snort that accepts packets from iptables and IPFW via libipq(linux) or divert sockets(FreeBSD), instead of libpcap. It then uses new rule types (drop, sdrop, reject) to tell iptables/IPFW whether the packet should be dropped, rejected, modified, or allowed to pass based on a snort rule set. Think of this as an Intrusion Prevention System (IPS) that uses existing Intrusion Detection System (IDS) signatures to make decisions on packets that traverse snort_inline.
Contact Info
The code is currently maintained by William Metcalf and Victor Julien. Major contributions have also come from Dave Remien and Nick Rogness. Check out the monitored snort_inline mailing list for discussions on bugs and enhancements. You must become a member in order to be able to send and receive messages to and from this mailing list. This was done in order to reduce the amount of spam. Click here and follow the directions to become a member.
Downloads
snort_inline comes in three forms: source code, statically compiled binary, and patch.
https://sourceforge.net/projects/snort-inline/files/
FAQ
- I am having problems compiling snort_inline.
- I am having problems running snort_inline.
- Snort_inline is not dropping any packets.
- Which version of libnet do I need?
- I want to handle only selected traffic with snort_inline
Mailing List
The code is currently maintained by William Metcalf.
Links
Related information that may help with the deployment of snort_inline.
- Ebtables: The bridging firewall kernel patch may be required if you intend to use snort_inline on a bridge.
- Honeynet Project: Contains information regarding the deployment of snort_inline in a honeynet environment.
- iptables: This is how snort_inline receives packets.
- Libnet: This library allows snort_inline to reject packets.
- libpcap: This is the packet capture library used to by snort, snort_inline, and many other network analyzers.
- Snort: The core of snort_inline.
- snort_inline: The SourceForge project page.
- snort_inline blog: The snort_inline blog page.
-----------------------------------------------
http://www.clamav.net/documents/clamav-virus-database-faq
I’m running ClamAV on a lot of clients on my local network. Can I serve the cvd files from a local server so that each client doesn’t have to download them from your servers?
Sure, you can find more details on our Mirror page.
-
If you want to take advantage of incremental updates, install a proxy server and then configure your freshclam clients to use it (watch for the HTTPProxyServer parameter in man freshclam.conf).
-
The second possible solution is to:
-
Configure a local webserver on one of your machines (say
machine1.mylan) -
Let freshclam download the
*.cvdfiles from http://database.clamav.net to the webserver’s DocumentRoot. -
Finally, change
freshclam.confon your clients so that it includes:DatabaseMirror machine1.mylanScriptedUpdates offFirst the database will be downloaded to the local webserver and then the other clients on the network will update their copy of the database from it.
Important: For this to work, you have to add
ScriptedUpdates offon all of your machines!
Virus Database
For ClamAV to work properly, both the ClamAV engine and the ClamAV Virus Database (CVD) must be kept up to date.
Freshclam should perform these updates automatically. Instructions for setting up Freshclam can be found in the documentation section.
If your network is segmented or the end hosts are unable to reach the Internet, you should investigate setting up a private local mirror. If this is not viable, you may use these direct download links: main.cvd | daily.cvd | bytecode.cvd
http://database.clamav.net/main.cvd
http://database.clamav.net/daily.cvd
http://database.clamav.net/bytecode.cvd
------------------------------------------
Snort-Inline + ClamAV
整合snort-inline與掃毒程式clamav
snort-line會去讀clamav的資料庫病毒碼來過濾所傳送的封包，並擋掉有病毒的封包，但snort-inline+clamav無法擋掉壓縮檔、email附件，及OLE2 病毒
以上來說明來自 README.clamav
[1.] apt-get install clamav-db clamav-devel clamav
[2.] 編譯時加入clamav
./configure – -enable-clamav
make
make install
[3.] vi /etc/snort_inline/snort_inline.conf
preprocessor clamav: ports all !22 !443, action-drop, dbdir /var/clamav, dbreload-time 43200
# preprocessor clamav: ports all !22 !443, toclientonly, dbdir /usr/share/clamav, dbreload-time 43200, file-descriptor-mode
預設定檔中clamav項目中的file-descriptor-mode參數在新版中已不用了。
設定只要 "preprocessor clamav: ports all !22 !443, dbdir /var/clamav, dbreload-time 43200" 即可，試驗結果它已直接 action-drop了，或者你要將連線一直重置就設定為 action-reset。
toclientonly只對 gateway後面的作 drop，而 toserveronly則只對 gateway，而 toclientonly與 toserveronly都不用，則雙方應該是都作 drop。
[4.] 下載 eicar測試
wget http://www.eicar.org/download/eicar.com
病毒
http://www.gfos.hr/~dragovic/nest/
[5.] log記錄訊息
[**] [122:1:1] (spp_clamav) Virus Found: Eicar-Test-Signature [**]
12/09-11:18:40.345607 81.3.3.133:80 -> 10.10.1.100:44902
TCP TTL:50 TOS:0x0 ID:2639 IpLen:20 DgmLen:478 DF
***AP*** Seq: 0x7A232F0D Ack: 0x462705E2 Win: 0x1920 TcpLen: 32
TCP Options (3) => NOP NOP TS: 63382852 259450410
重要引用:
From: Will Metcalf <william@gm…>
Eicar and ClamAV
2005-03-12 14:47
It seems as if the clam guy"s updated the signature database with a new definition for Eicar, and it is no longer detected in the same manner. I was wrong, about Clam being broken as it still seems to pick-up other virii ok. In addition, it appears as if Victor thinks
he has figured out a way to scan file descriptors via writing packet contents to tmp files. We actually should be able to detect more virii using this method.
Regards,
Will
Clamav官方改變了定義，所以測試eicar.com病毒，是失敗的
不過在2006/04/22測試新版的Snort-Inline時，clamav已working
註: 2006/04/22
clamav配合 preprocessor stickydrop-timeouts: sfportscan 3000, portscan2 3000, clamav 3000
的時後，一開始的連線是被drop的沒錯，不過要等3000秒後，對目的端的全部連線才能再次溝通。
-------------------------------------
snort_inline with clamav on pfsense
============ End