2007 - Debian 4 - FWsnort

|=------------------------------=[ FWSnort ]=------------------------------=|
+---------------------------------------------------------------------------+
|                                                                           |
|                                  FWSnort                                  |
|                              Debian 4.0 Etch                              |
|                                                                           |
+---------------------------------------------------------------------------+
|=-------------------------------=[ BH 2007 ]=-----------------------------=|

Predpoklad: Nainstalovany zakladny system Debian 4.0

 fwsnort parses the rule files that come with the IDS Snort and generates
 ekvivalentne pravidla pre Linuxovy packet filter (iptables) pre co mozno
 najvacsie mnozstvo pravidiel. fwsnort pouziva modul packet filtra s nazvom
'string match' na detekovanie utokov na aplikacnej urovni.

 Download
----------

        # cd /tmp
        # wget http://www.cipherdyne.org/fwsnort/download/fwsnort-1.0.3.tar.gz
        # wget http://www.cipherdyne.org/fwsnort/download/fwsnort-1.0.3.tar_gz.asc
        # wget http://www.cipherdyne.org/fwsnort/download/fwsnort-1.0.3.tar.gz.md5

        Overime kontrolny sucet md5 balicka
        -----------------------------------
        # md5sum -c fwsnort-1.0.3.tar.gz.md5

        Ak mame verejny kluc Michaela Rasha tak overime balicek pomocu GPG
        ------------------------------------------------------------------
        # gpg --verify fwsnort-1.0.3.tar_gz.asc

        Inak si importneme verejny kluc - Michaela Rasha
        ------------------------------------------------
        # gpg --keyserver pgpkeys.pca.dfn.de --search-keys mbr@cipherdyne.com

        # gpg --keyserver pgpkeys.pca.dfn.de --recv-keys 75C089FE
        # gpg --fingerprint  75C089FE
        # gpg --export -a 75C089FE | apt-key add -

        GPG KEY_SERVERS_PORT: 11371
        ---------------------------

 Download RULES
----------------

        http://www.bleedingthreats.net/rules/
        http://www.bleedingthreats.net/rules/bleeding.rules.tar.gz
        http://doc.bleedingthreats.net/bin/view/Main/AllRulesets

 Install
---------

        # tar -xvf fwsnort-1.0.3.tar.gz
        # su
        # cd fwsnort-1.0.3
        # ./install.pl

 Subory
--------

        BASH skript vygenerovany fwsnortom. Spustenim tohoto skriptu naplnime packet filter (iptables)
        skonvertovanymi SNORT pravidlami.
        ---------------------------------
        /etc/fwsnort/fwsnort.sh

        A log file with notes from converting the SNORT rules into IPTABLES rules.
        --------------------------------------------------------------------------
        /var/log/fwsnort.log

 Triedy pravidiel
------------------

        attack-responses.rules
        backdoor.rules
        bad-traffic.rules
        bleeding-all.rules
        chat.rules
        ddos.rules
        dns.rules
        dos.rules
        experimental.rules
        exploit.rules
        finger.rules
        ftp.rules
        icmp-info.rules
        icmp.rules
        imap.rules
        info.rules
        local.rules
        misc.rules
        multimedia.rules
        mysql.rules
        netbios.rules
        nntp.rules
        oracle.rules
        other-ids.rules
        p2p.rules
        policy.rules
        pop2.rules
        pop3.rules
        porn.rules
        rpc.rules
        rservices.rules
        scan.rules
        shellcode.rules
        smtp.rules
        snmp.rules
        sql.rules
        telnet.rules
        tftp.rules
        virus.rules
        web-attacks.rules
        web-cgi.rules
        web-client.rules
        web-coldfusion.rules
        web-frontpage.rules
        web-iis.rules
        web-misc.rules
        web-php.rules
        x11.rules

 Pouzitie
----------

 * Generovanie iptables pravidiel

        Vygeneruje iptables pravidla pre rozumne mnozstvo SNORT pravidiel
        -----------------------------------------------------------------
        # fwsnort --include-type attack-responses,bad-traffic,ddos,dos,exploit,info,scan,shellcode

        Vygeneruje iptables pravidla pre co mozno najviac SNORT pravidiel
        -----------------------------------------------------------------
        # fwsnort

        Vygeneruje iptables pravidla pre ddos a backdoor SNORT pravidla
        ---------------------------------------------------------------
        # fwsnort --include-type ddos,backdoor

        Vygeneruje iptables pravidla pre pravidla SNORTu s ID 1834 a 2001842
        --------------------------------------------------------------------
        # fwsnort --snort-sid 1834,2001842

        Tell fwsnort to watch traffic only on the devices eth0 and eth1
        ---------------------------------------------------------------
        # fwsnort --restrict-intf eth0,eth1

 * Aktivovanie novo vytvorenych pravidiel

        Ak mame skonvertovane SNORT pravidla a tym padom aj vegenerovany subor /etc/fwsnort/fwsnort.sh
        run this script, which fills the packet filter with those rules.
        ----------------------------------------------------------------
        # /etc/fwsnort/fwsnort.sh

 * Kontrola novo pridanych pravidiel do iptables

        Check the newly created iptables rules
        --------------------------------------
        # iptables -nvL

http://www.cipherdyne.org/fwsnort/
http://www.cipherdyne.org/fwsnort/
http://www.nostarch.com/download/firewalls_ch10.pdf