NethServer 6

• Dependencies:
  • libnetfilter_queue (from epel)
  • libnfnetlink from (centalt)
  • libmnl
  • libdnet
  • daq, need to be built
• Configuration:
  • create a simple template for snort.conf
• Add pulledpork dependency
• Pulledpork rpm: ftp://ftp.pbone.net/mirror/ftp5.gwdg.de/pub/opensuse/repositories/home:/deadpoint/openSUSE_12.3/src/pulledpork-0.6.1-5.1.src.rpm
  • Depends on: perl-Crypt-SSLeay perl-Archive-Tar
• Fixes:
  

  touch /etc/snort/rules/black_list.rules
  touch /etc/snort/rules/white_list.rules
  mkdir -p /usr/lib/snort_dynamicrules
  mkdir /etc/snort/rules/iplists/ 
  

• Fix init script and sysconfig
  

  --- /etc/init.d/snortd.ori    2013-10-15 09:36:44.375726032 +0200
  +++ /etc/init.d/snortd    2013-10-15 10:25:13.615957284 +0200
  @@ -45,6 +45,8 @@
  
   if [ "$INTERFACE"X = "X" ]; then
      INTERFACE="-i eth0" 
  +elif [ "$INTERFACE"X = "NFQX" ]; then
  +   INTERFACE="-Q" 
   else 
      INTERFACE="-i $INTERFACE" 
   fi
  @@ -98,7 +100,9 @@
     start)
           echo -n "Starting snort: " 
           cd $LOGDIR
  -        if [ "$INTERFACE" = "-i ALL" ]; then
  +        if [ "$INTERFACE" = "-Q" ]; then
  +                daemon /usr/sbin/snort $ALERTMODE $BINARY_LOG $NO_PACKET_LOG $DUMP_APP -D $PRINT_INTERFACE -u $USER -g $GROUP $CONF $PASS_FIRST $BPFFILE $BPF $INTERFACE
  +        elif [ "$INTERFACE" = "-i ALL" ]; then
              for i in `cat /proc/net/dev|grep eth|awk -F ":" '{ print $1; }'`
              do
                   mkdir -p "$LOGDIR/$i" 
  
  --- /etc/sysconfig/snort.ori    2013-10-15 09:35:37.972316309 +0200
  +++ /etc/sysconfig/snort    2013-10-15 10:14:19.865403270 +0200
  @@ -12,7 +12,7 @@
   # What interface should snort listen on?  [Pick only 1 of the next 3!]
   # This is -i {interface} on the command line
   # This is the snort.conf config interface: {interface} directive
  -INTERFACE=eth0
  +INTERFACE=NFQ
   #
   # The following two options are not directly supported on the command line
   # or in the conf file and assume the same Snort configuration for all
  @@ -23,6 +23,9 @@
   #
   # To listen only on given interfaces use this:
   #INTERFACE="eth1 eth2 eth3 eth4 eth5" 
  +#
  +# To use NFQ mode
  +#INTERFACE=NFQ
  
   # Where is Snort's configuration file?
  

• Add Shorewall NFQUEUE support

• snort
• daq
• snortalog
• pulledpork
• nethserver-pulledpork
• nethserver-snort

TODO: add inline help and manual pages. See: nethserver-snort.

• nethserver-pulledpork-0.0.1-1.ns6.noarch.rpm
• nethserver-snort-0.0.1-6.0gite92f8f26.ns6.noarch.rpm
• snortalog-0.0.1-1.ns6.noarch.rpm
• daq-2.0.2-1.x86_64.rpm
• snort-2.9.6.1-1.x86_64.rpm
• pulledpork-0.7.0-2.noarch.rpm

• nethserver-firewall-base-1.1.0-50.0git08bb326d.ns6.noarch
• nethserver-base-2.2.1-42.0git6cfa99e8.ns6.noarch

• Enable Snort from web interface
• Check nfqueue is enabled and snort is running

• Change policy from web interface
• Check changes are reflected in pulledpork and snort

Test case 1 and 2 verified, everything worked as expected.

Just a little note: snort is logging a lot and when it restarts syslogd starts to drop snort messages due to massive logging, i.g.:

Jun 5 15:29:44 server rsyslogd-2177: imuxsock begins to drop messages from pid 5715 due to rate-limiting

Because of this behaviour we can't see the active rules on the log file because they're dropped from syslogd.

Before release, wait for: #2719 #2716

Rebuilt with snort-2.9.6.2, to fix logrotate patch

In nethserver-testing:
snort-2.9.6.2-1.x86_64.rpm
snort-debuginfo-2.9.6.2-1.x86_64.rpm
nethserver-snort-0.0.1-8.0giteb37c66e.ns6.noarch.rpm

Packager note
Release with nethserver-snort-0.0.1-8.0giteb37c66e.ns6.noarch.rpm

Installed nethserver-snort on a new system, snort starts, rules are correct and logrotation works.

Aug 19 14:43:09 localhost snort[12207]: 16381 Snort rules read

In nethserver-updates:
nethserver-snort-1.0.0-1.ns6.noarch.rpm
nethserver-openvpn-1.1.0-1.ns6.noarch.rpm
nethserver-firewall-base-2.0.0-1.ns6.noarch.rpm

...and also dependencies:
nethserver-pulledpork-1.0.0-1.ns6.src.rpm
pulledpork-0.7.0-2.noarch.rpm