Configure postgresql and snort
Configure postgresql
First we shall make a database for snort. As you proceed with the configuration you might wish to use alternate database names, database user, and password. For this tutorial I will use :
snort postgresql database = snort_db
snort postgresql user = snort
snort posgresql password = snort_password
At the postgres user prompt :
Code:
# Create the database for snort
createdb snort_db
# Configure the database
zcat /usr/share/doc/snort-pgsql/create_postgresql.gz | psql snort_db
# Create a postgresql user for snort
createuser -P snort
Enter and confirm a password for snort, answer n to the next 3 questions :
Enter password for new user: snort_password
Enter it again: snort_password
Shall the new user be a superuser? (y/n) n
Shall the new user be allowed to create databases? (y/n) n
Shall the new user be allowed to create more new users? (y/n) n
Log into the new database
At the psql prompt ( snort_db=# ) enter ( copy - paste ) the following long command:
Note: "snort_db=#" indicates the prompt, the command you want to copy-paste starts with "Grant All ..." and ends with a ;
Code:
snort_db=# GRANT ALL ON TABLE data, detail, encoding, event, icmphdr, iphdr, opt, reference, reference_ref_id_seq, reference_system, reference_system_ref_system_id_seq, schema, sensor, sensor_sid_seq, sig_class, sig_class_sig_class_id_seq, sig_reference, signature, signature_sig_id_seq, tcphdr, udphdr TO snort;
\q to exit psql
exit to return to a root shell (exit the "sudo su postgres")
Configure snort
Remove the "db-pending-config" file.
Code:
cd /etc/snort
sudo rm db-pending-config
Using any editor, open /etc/snort/snort.conf
Code:
sudo nano -B /etc/snort/snort.conf
Find and change the following lines:
Use the search function (Ctrl-W) search for "var HOME_NET any" , note HOME_NET is used more then once, you want the line var HOME_NET any , as below ...
Change "var HOME_NET any" to "var HOME_NET 192.168.0.0/16,127.0.0.0/8"
Comment out (add a # in front of) "var EXTERNAL_NET any"
Uncomment (remove the #) "var EXTERNAL_NET !$HOME_NET
so it looks similar this:
Code:
var HOME_NET 192.168.0.0/24,127.0.0.0/8
#var EXTERNAL_NET any
var EXTERNAL_NET !$HOME_NET
You may need to change "192.168.0.0/24" to a range appropriate for your LAN.
Next, find the line "output database: alert, postgresql ...."
Hint: Search as above for "localhost" .
Uncomment (remove the #) the line and update it to include the database and user you set up.
Code:
output database: alert, postgresql, user=snort dbname=snort_db password=snort_password host=localhost
Save the file and close nano (Ctrl-X , when asked to save answer yes).
You can test snort with the following command :
Code:
sudo snort -c /etc/snort/snort.conf -T
If you see the ascii pig, it is working!
--== Initialization Complete ==--
,,_ -*> Snort! <*-
o" )~ Version 2.8.5.2 (Build 121)
'''' By Martin Roesch & The Snort Team:
http://www.snort.org/snort/snort-team
Copyright (C) 1998-2009 Sourcefire, Inc., et al.
Using PCRE version: 7.8 2008-09-05
<clip>
Snort successfully loaded all rules and checked all rule chains !
database: Closing connection to database "snort_db"
Snort exiting
YOU DO NOT NEED TO DO ANYTHING ELSE TO "TEST SNORT" !!!!
Back to top
