Honeypots

Apply Your Knowledge

Intrusion detection is an important part of a good network defense. Intrusion detection can be performed on a network or host. Network-based intrusion detection systems monitor traffic passing across the network for evidence of hostile or unusual activity. Snort is one of the leading freeware network-based IDSs.

Exercises

10.1. Setting Up Snort IDS

This exercise steps you through the process of installing and configuring Snort on a Windows PC, as well as introduces you to the analyzation of its output. Requirements include a Windows 2000, XP, or 2003 computer and Snort software.

Win32 Snort v2.1.1. is available from www.snort.org/dl/binaries/win32/.

Estimated Time: 30 minutes.

1. You will need to go to www.winpcap.org/install/default.htm and download a copy of Winpcap.exe. This low level packet driver will be needed to get Snort to work. After you install Winpcap, reboot if prompted.
2. Download the latest version of Snort from www.snort.org/dl/binaries/win32/. As of the printing of this book, that version is 2.43. After starting the download, start the Snort install.
3. Click I Agree to accept the license agreement.
4. Check support for flexibility response and click Next.
5. Verify that all components are checked and click Next to continue the installation.
6. Accept the defaults for location and click Install. The folder C:Snort will be used.
7. Click Close to finish the Snort installation. During the actual installation, Snort creates a directory structure under C:Snort that looks as follows:

   C:snortin C:snortcontrib C:snortdoc C:snortetc C:snortlog C:snort ules

8. Click OK to close the Snort Setup information box if necessary. Use Wordpad to open the Snort configuration file to function properly in your environment.
9. In the snort.conf file, search for the variable statement that begins with var rule_path ./ If necessary, change the statement to refer to the path of your Snort rules folders, which is var RULE_PATH c:snort ules.
10. Search for the variable statement var HOME_NET Any. Change it to the setting for your network, as an example: var HOME_NET 172.16.0.0/24.
11. Search for the statement include classification.config and change it to

    include c:snortetcclassification.config

12. Search for the statement include reference.config and change it to

    include c:snortetc eference.config

13. Save and close the file.
14. Reboot your machine and log back on to Windows. To check that Snort was properly configured, open two command prompts.
15. At one of the command prompts, navigate to the C:snortin folder and enter snort -W. You should see a list of possible adapters on which you can install the sensor. The adapters are numbered 1, 2, 3, and so forth.
16. At the c:snortin> prompt, enter snort v ix, where x is the number of the NIC to place your Snort sensor on. Record the number of the adaptor here: ________
17. Switch to the second command prompt you opened and ping another computer such as the gateway. When ping is complete, switch back to the first command prompt window running Snort, and press Ctrl+C to stop Snort. A sample capture is shown here:

    11/01-23:09:51.398772 192.168.13.10 -> 192.168.13.254 ICMP TTL:64 TOS:0x0 ID:38 ID:1039 Seq:0 ECHO 9E 85 00 3B 84 15 06 00 08 09 0A 0B 0C 0D 0E 0F ...:............ 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F ................ 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F !"#$%&'()*+,-./ 30 31 32 33 34 35 36 37 01234567

    Although this demonstrates the basic capabilities of Snort, not everyone has the time or ability to constantly monitor the console. Therefore, what is needed is a way to log the activity for later review. To do this, continue with the following steps.

18. If you are not already there, change to the directory where you installed Snort. Then from the command prompt, enter snort -ix -dev -lsnortlog. This command will start Snort and instruct it to record headers in the snortlog folder.
19. Now ping some other devices such as the gateway. If you have a second computer on the network, you can use it to ping the computer you have installed on or even scan it with Nmap. The idea here is to generate some traffic to be logged in the Snortlog folder for review.
20. After you have generated some ping traffic or run some scans against the local machine, press Ctrl+C to stop the packet capture.
21. Use Windows Explorer to navigate to the snortlog folder.
22. You should see some files there. Examine the contents of one of these files by using Notepad to examine the contents of the capture.
23. This is a great feature, as now you can go back and review activity. There are additional add-on tools to make log review easier. ACID is one such tool. If you would like to experiment with it, it can be downloaded from www.andrew.cmu.edu/user/rdanyliw/snort/snortacid.html.

10.2. Install and Configure Snort IDS Center

In this exercise, you will install and configure the Snort IDS Center on a Windows computer using the components you prepared in Exercise 10.1.

Estimated Time: 30 minutes.

1. Download IDS Center from www.engagesecurity.com/downloads/#idscenter. After the download completes, install the application. Accept the default settings for the install.
2. After the install is complete, use Explorer to go to the c:snortlog directory, and then create a file called alert.ids. Open the snort.conf file, and verify that the following include statements point to the proper files:

   var HOME_NET (Your Subnet for example 192.168.12.0/24) var RULE_PATH c:snort ules include c:snortetcclassification.config include c:snortetc eference.config

3. In your system tray, you will notice the IDS Center icon; double-click it to open IDS Center's Settings window. The Main Configuration window should be displayed. You can select other windows by changing your selection on the left side tabs (General, IDS Rules, Log Settings, Alerts, and Explorer). Under each tab are a few more possible selections for configuration changes.
4. Under the Main Configuration tab, verify that the correct Snort version is selected.
5. Select the ... button next to Snort Executable File, and select the path to your snort.exe file (c:snortinsnort.exe).
6. Now click the button next to Log Folder and select the path to your alert.ids file (c:snortlogalert.ids).
7. If the General tab contains an Activity Log icon, click it and check Enable Activity. Logging Activate the Alert. Events tab and check both check boxes.
8. On the left of the program screen, click the IDS Rules tab. Click the Snort Config icon, click the ... button, and navigate to your snort.conf file (c:snortetcsnort.conf). You should see a copy of the snort.conf file that you can edit in the window. This was the file you modified in Exercise 10.1.
9. Click the Network Variables icon and make sure that your home network is correct. This is the subnet on which the computer resides; click Edit Variable and enter the correct value. This value should be the IP address of your network. As an example, HOME_NET 192.168.13.0/24
10. On the left of the program screen, click the Preprocessors icon. Activate the Portscan Detection tab and check Portscan Detection. Set Monitored Hosts/Networks to EXTERNAL_NET.
11. Click the icon for Rules/Signatures.
12. Verify that the top line reads c:snortetcclassification.config. Highlight that line and click the Select button near the bottom of the window to tell IDScenter that this is the classification definition's files.
13. Uncheck all the $RULE_PATH/ lines except for $RULE_PATH/scan.rules.
14. Click the Log Settings tab and the Logging Parameters icon. Check Decode Link Layer Headers (-e) and Dump Application Layer (-d).
15. Click the Alerts tab and the Alert Detection icon. Click the Add Alert Log File button.
16. Click the Alert Notification icon. This is the icon that looks like a pig.
17. In the right pane, click Start Alarm Beep When Alert Is Logged. This should use your computer's case speaker for those who don't have external speakers and sound cards. Click the Start Sound Test button to be sure that you get an alert sound.
18. Check Start This Program When Receiving An Alert, click the ... button, and navigate to and then select c:scan_alert.bat.
19. When you are finished with this configuration, click the Apply button at the top of the window.
20. Now, it's time to test your settings, click the Test Settings button at the top of the window. If all rules and chains are successful, press Enter to close the test window.
21. Click the Start Snort button.
22. Now, you can perform some pings or use another computer to ping this host or scan it. Once it is scanned, you should see your alert occur.
23. Click the Stop Snort button and right-click the IDS Center icon. Choose View Alerts to see what alerts have been logged. You might be able to see at the top of the alert log if the scan were generated by ping, Nmap, or another type of program. Navigate to your c:snortlogs directory; you might be able to see the packets that have been logged along with the alerts.
24. If you were configuring this system as an actual IDS system, it would not be unreasonable to plan on spending a week or so to get the system properly tuned and setup. While IDS systems are powerful devices, the setup and tuning is critical; otherwise, there can be a large number of false negatives and false positives.

Exam Prep Questions

Answers to Exam Questions

Suggested Reading and Resources

www.hping.orgThe hping homepage.

www.snort.orgThe Snort homepage. A good site to explore to learn more about Snort.

www.networkworld.com/news/2005/072805-cisco-black-hat.htmlCisco vulnerabilities unveiled at Black Hat.

www.securiteam.com/tools/6V0011PEBY.htmlCisco password cracker.

www.networkclue.com/routing/Cisco/access-lists/index.aspxACL basics.

www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO.htmlUsing IPTables for packet filtering.

www.fwbuilder.orgMultipurpose firewall ruleset builder.

www.packetfactory.net/projects/firewalkFirewalk homepage.

www.honeynet.org/papers/individual/DefeatingHPs-IAW05.pdfDetecting honeypots.

www.tldp.org/HOWTO/Firewall-HOWTO-2.htmlUnderstanding firewall types and configurations.

www.securitystats.com/tools/index.htmlSecurity stats and password cracking tools.

www.cisco.com/warp/public/707/cisco-sn-20040326-exploits.shtmlCisco router.cfg vulnerability.

www.insecure.org/stf/secnet_ids/secnet_ids.htmlEvading IDS.

http://packetstorm.widexs.nl/UNIX/IDS/nidsbench/nidsbench.htmlNIDSbench.