Installation Help

Insta-Snorby 0.8.0 Install Notes (Rough Draft)

Install Steps:

1. Put LAN connection on eth0 (management interface). NOTE: More than one NIC may result in no NICs being initialized due to an Ubuntu 10.04 LTS bug.
2. Install Insta-Snorby by following the Insta-Snorby Configuration Console
   a. Set eth0 as the Snort monitoring port
   b. Choose to enter your Oinkcode
   c. Choose to install the security updates
3. SSH to the server and configure the following:
   a. NTP – Edit /etc/ntp.conf (add ntp.hs.uab.edu or 10.20.60.11)
   b. Apache Ports – Edit /etc/apache2/ports.conf to disable listening on port 80 (if desired)
   i. Comment out (add “#”) at the start of both lines referencing port 80
   ii. Restart command is “/etc/init.d/apache2 restart” or wait until reboot
   c. Change Snort monitoring port to eth1 (SPAN interface)
   i. Change interface to eth1 in /usr/lib/inithooks/everyboot.d/88snortstart
   ii. Change interface to eth1 in /etc/snort/barnyard2.conf
   iii. Identify and kill snort and barnyard processes ps aux | grep snort
   iv. Restart snort: /usr/local/bin/snort -g snort -u snort -c /etc/snort/snort.conf -i eth1 -D v. Restart barnyard: /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -G /etc/snort/gen-msg.map -S /etc/sid-msg.map -d /var/log/snort -f snort.u2 -w /var/log/snort/barnyard2.waldo -D
   d. Snort Config – Edit /etc/snort/snort.conf
   iii. Define “$HOME_NET” and “$EXTERNAL_NET” variables
   iv. Consider and edit all other lines with caution. Reference: https://www.snort.org/docs
   v. Consider configuring a BPF file to dump undesired traffic
   e. Pulledpork 0.6.1 Fix – This version of pulledpork contains an incorrect version reference to 0.5.0
   vi. /usr/lib/inithooks/bin/pulledpork.py
   vii. /usr/lib/inithooks/bin/oinkcode.py
   viii. /root/crontmp
   ix. /usr/lib/inithooks/bin/interface_select.py
   f. Openfpc - /usr/lib/inithooks/bin/interface_select.py contains a reference to version 0.4-267, which should be 0.6-314. Reference: http://www.openfpc.org/home
   i. Change interface to eth1 in /etc/openfpc/openfpc-default.conf
   g. Add desired linux user accounts
   h. Logout of SSH
4. Connect SPAN cable to eth1 interface
5. Configure network interfaces to static IPs. NOTE: I’ve experienced some odd DNS behavior and have had to reboot or restart the network interfaces twice before I was able to reach it. There may be an Ubuntu bug associated with this behavior.
6. Reboot the server using the Insta-Snorby configuration console
   Manually Clear/Update Dashboard: go to the main snorby directory (in my case it is /var/www/snorby) then execute this command: sudo rails c and then use this commands: Snorby::Jobs.clear_cache(true) Snorby::Jobs.run_now! Run Pulledpork Manually: /root/pulledpork-0.6.1/pulledpork.pl -c /root/pulledpork-0.6.1/etc/pulledpork.conf -H -v >> /var/log/pulledpork 2>&1

Snorby 2.0.0 Dependence Help. A few suggestions & tips incase you have installation issues.

Nokogiri

• libxml
• libxslt

PDFkit & wkhtmltopdf

gem install pdfkit
pdfkit --install-wkhtmltopdf

Edit snorby/config/application.rb line #23 and add the following line

 /usr/local/bin/wkhtmltopdf

ImageMagick & rmagick

Snort

Barnyard

Installing on CentOS 5.5

Here are my notes from a fresh CentOS 5.5 Install:

Install CentOS 5.5 yum update yum install ncurses-devel readline-devel gcc-c++ httpd-devel mysql-server openssl-devel mysql-devel curl-devel zlib-devel gcc libxml2-devel libxslt-devel

Be sure to install all needed deps

Change the mysqld root password

    /usr/bin/mysqladmin -u root password 'new-password'

Download ruby from http://www.ruby-lang.org/en/downloads/

Untar and cd into the ruby source dir

Compile ruby with

    ./configure
    make
    make install

    cd ext/openssl
    ruby extconf.rb
    make
    make install

    gem install rails

Download and compile git from: http://www.kernel.org/pub/software/scm/git/ current ver = 1.7.3

Untar and cd into the git dir

    ./configure
    make
    make install

Download ImageMagick from source: wget ftp://ftp.imagemagick.org/pub/ImageMagick/ImageMagick.tar.gz Untar tarball, cd to ImageMagick dir

    ./configure
    make
    make install

execute

    gem install rmagick
    gem install passenger

execute: /usr/local/lib/ruby/gems/1.9.1/gems/passenger-3.0.2/bin/passenger-install-apache2-module

(above version # may change)

Edit Apache conf: DocumentRoot "/var/www/html/snorby/public/" RailsBaseURI /var/www/html

cd to your apache document root directory git clone http://github.com/Snorby/snorby.git or git://github.com/Snorby/snorby.git

cd snorby (dir that was created in the doc root) edit config/database.yml for db user account

back in document root snorby dir: bundle install rake snorby:setup

disable selinux: echo 0 >/selinux/enforce (Be sure to re-enable after everything is working)

Start Apache service httpd start Allow access though iptables: -A RH-Firewall-1-INPUT -s x.x.x.x -m tcp -p tcp --dport 443 -j ACCEPT (or port 80)

If any errors reference to ezprint: from /var/www/html/snorby (or whatever your doc root is) bundle pack bundle install --path vender/cache

If any readline problems:

            cd /ruby-source-dir/ext/readline
            ruby extconf.rb
            make install

Add to rc.local:

            cd /var/www/snorby && /usr/local/bin/ruby script/delayed_job start
            cd /var/www/snorby && /usr/local/bin/rails runner 'Snorby::Jobs::SensorCacheJob.new(false).perform; Snorby::Jobs::DailyCacheJob.new(false).perform'