Motherboard - Intel Desktop Board D510MO CPU - Intel Atom D510 (Dual-core with HT) RAM - 4GB (2 x 2GB) Hard Drive - 320GB Network Card 0 (eth0) - Onboard Gigabit Network Card 1 (eth1) - TP-Link TG-3269 Gigabit PCI Network Adapter (with low profile) Network Card 2 (eth2) - D-Link DUB-E100 USB 2.0 Fast Ethernet Adapter (up to 200MB) * You can select (1) Level One USB-0401 USB Gigabit Ethernet Adapter or (2) PCi USB 3.0 Gigabit LAN Adapter UE-1000T-G3 for eth2. However, you need to compile and install the driver yourself. Update : If you are using Backports latest kernel, the Level One USB-0401 and PCi UE-1000T-G3 are workable out of the box. Router - Motherboard - Intel Desktop Board D510MO CPU - Intel Atom D510 (Dual-core with HT) RAM - 4GB (2 x 2GB) Hard Drive - 320GB Network Card 0 (eth0) - Onboard Gigabit Network Card 1 (eth1) - TP-Link TG-3269 Gigabit PCI Network Adapter (with low profile) (B) Software IDS/IPS - Operating System - Debian 7.0 (Wheezy) IDS/IPS Pre-configure system - SmoothSec 3.4 (64-bit) IDS/IPS Engine - Snort (or Suricata) Unified2 Spooler - Pigsty Web Interface - Snorby Rules Management - PulledPork Router - Operating System - Untangle 9.4.2 (64-bit) * Basically, Untangle is a router and Unified Threat Management System (UTM). (C) Hardware Setup
Internet ---- Router ---- SmoothSec ---- Switch ---- Personal Computers
Router -- eth0 connect to Internet; eth1 connect to SmoothSec
SmoothSec -- eth0 connect to Router; eth1 connect to Switch (uplink or port 1); eth2 connect to Switch (any port at 2 to 4)
* You can use any router to replace Untangle.
(D) Installation of SmoothSec
Download SmoothSec 3.4 at here or here.
Make sure the SmoothSec box can surf the internet; otherwise, installation will be failed. Or, you may re-arrange the cables when necessary.
Updated : Since the scripts for 3.4 has been updated to 3.4.1, you should follow the below link to upgrade the script to 3.4.1.
Upgrade to scripts version 3.4.1
The scripts 3.4.1 will install Backports newest kernel instead of Unstable kernel for Suricata IPS mode with AF_PACKET.
After installed SmoothSec, type the following :
smoothsec.first.setup
Snort -
Select "ips-standard" and following the instruction to install. Please also refer to here for the configuration of the config file. Make sure "AF_ENGINE" is set to "snort". The rules are "et" by default.
After install, reboot your box.
Suricata -
Select "ips-standard" and following the instruction to install. Please also refer to here for the configuration of the config file. Make sure "AF_ENGINE" is set to "suricata". The rules are "et" by default.
A new Linux kernel 3.10.2 will be installed at the end.
After install, reboot your box.
(E) Configuration of IDS/IPS
You may need to disable or/and drop some rules (sid).
Snort -
You may need to configure the /etc/snort/snort.conf :
nano /etc/snort/snort.conf
For example, the subnet is 192.168.1.0/24.
Replace "ipvar HOME_NET any" with "ipvar HOME_NET [192.168.1.0/24]"
Replace "ipvar EXTERNAL_NET any" with "ipvar EXTERNAL_NET ![192.168.1.0/24]"
Restart Snort :
/etc/init.d/snort restart
Disable rules :
nano /etc/pulledpork/snort/disablesid.conf
Drop rules :
nano /etc/pulledpork/snort/dropsid.conf
After doing that, reload the rules :
smoothsec.snort.rules.update
Suricata -
Disable rules :
nano /etc/pulledpork/suricata/disablesid.conf
Drop rules :
nano /etc/pulledpork/suricata/dropsid.conf
After doing that, reload the rules :
smoothsec.suricata.rules.update
* If the rule is too long to disable or drop, you may consider to edit "modifysid.conf". For example, to disable and drop the following rule :
To disable the rule :
2013437 "alert" "##alert";
To drop the rule :
2013437 "alert" "drop";
(F) Configuration of Snorby
For example, the sensor IP address is 192.168.1.180.
Point your browser to https://192.168.1.180. Enter the username and password of Snorby.
Setup the Snorby according to SmoothSec WiKi.
* If you want to sent your Snorby reports by Postfix, you need to install yourself and configure it then.
sudo apt-get install postfix
Select "Internet Site" when asked.
(G) IDS/IPS Tuning
There may be some false positive records. You need to tune the setting by adding the sid to the disablesid.conf or dropsid.conf when necessary. When use with dropsid.conf, yon may need to set firewall at Router to make the job done.
(H) Remarks
In the captioned setting, the SmoothSec acts as IDS and IPS in one box.
If you want to install IDS only, your SmoothSec only requires one Network Card which is connected to Switch.
In addition, SmoothSec 3.4 comes with Distributed IDS/IPS which allows you to deploy multi-sensors with one control panel (Snorby).
Furthermore, you can also reset your box to the fresh install environment :
smoothsec.reset
When using Snorby, you may need to browse for the rules sid. This link is for the rules lookup.
Make sure you create an empty file namely restart.txt under /var/www/snorby/tmp :touch /var/www/snorby/tmp/restart.txtThat's all! See you.