Integrating Snort with Webmin
Problem
You have already set up a Unix management system using Webmin. You would like to integrate Snort with this management system.
Solution
- Download the Snort Webmin module from MSB Networks (available at: http://www.msbnetworks.net/snort). This allows you to configure, monitor, and maintain Snort from within Webmin.
- Once you have downloaded the module, insert it into Webmin through the web interface by selecting the Webmin Configuration icon from the main screen (Figure 5-34).
Figure 5-34. Webmin main screen
- Select the Webmin Modules icon (Figure 5-35). This will show the information in the Webmin Modules (Figure 5-36).
Figure 5-35. Webmin Configuration
Figure 5-36. Webmin Modules
- In the Install Module box, select the From uploaded file radio button, and click the Browse button to navigate to the file that you downloaded.
- Click the Install Module button. You will get a confirmation screen (Figure 5-37).
Figure 5-37. Install Module
Discussion
Webmin is a web-based system-administration interface for Unix. It allows you to manage your Unix system and softwarein this case, Snort. Once you have installed the Snort Webmin Module, you need to configure the various settings by clicking on the Snort IDS Admin link in the Install Module window, or by navigating to the plug-in through the Webmin interface. On first use, you are presented with a screen prompting for the details of your Snort installation (Figure 5-38). Note that Webmin can handle only the control of one Snort daemon running on the machine.
Figure 5-38. Initial configuration
You need to set the full path to your Snort executable, the Snort configuration file, the rules directory, and the Snort PID file. Optionally, you can set the command to start Snort and set the URL to your ACID installation. Once you have filled in the information, click Save.
There are five main sections to the Webmin interface to Snort: Rulesets, Network Settings, PreProcessors, Alerts & Logging, and Edit Config File (Figure 5-39). Start in the Rulesets screen to select which rules you wish to enable. Note that changes will take effect only once you have restarted Snort. To facilitate this, there is a Restart Snort button at the bottom of this screen.
Figure 5-39. Snort IDS
The Network Settings screen allows you to set the various network options, including your Home and External networks, various servers, and port selections (Figure 5-40).
Figure 5-40. Network settings
The PreProcessors screen allows you to enable and disable the various preprocessors, along with setting required options (Figure 5-41).
Figure 5-41. Preprocessors
The Alerts & Logging screen allows you to enable, disable, and set the options on the assorted output plug-ins (Figure 5-42).
Figure 5-42. Alerts & Logging
The final screen, Edit Config File, allows you to directly edit the Snort configuration file by hand (Figure 5-43).
Figure 5-43. Edit Config File
In all the screens, you should set up Snort per your requirements, following the recommendations that we have provided in the other recipes in this book.
See Also
http://www.msbnetworks.net/snort
http://www.webmin.com
Administering Snort with HenWen
|