Since the previous setup (HOWTO) of SmoothSec are not perfect, I am going to use AF_PACKET as packet acquisition engine. In this setting, you are required to have at least 3 network interfaces, one for the management purpose.
As AF_PACKET has high performance, even the very low-end hardware is benefited. The following setup is ideal for home/SOHO environment.
(A) Hardware
Motherboard - Intel Desktop Board D510MO
CPU - Intel Atom D510 (2-core with HT)
RAM - 4GB (2 x 2GB)
Hard Drive - 320GB
Network Card 0 (eth0) - Onboard Gigabit
Network Card 1 (eth1) - TP-Link TG-3269 Gigabit PCI Network Adapter (with low profile)
Network Card 2 (eth2) - D-Link DUB-E100 USB 2.0 Fast Ethernet Adapter (up to 200MB)
(B) Software
Operating System - Debian 7.0 (Wheezy)
IDS/IPS pre-configure system - SmoothSec 3.2 (64-bit)
IDS/IPS Engine - Suricata
Spooler - Pigsty
Web Interface - Snorby
Rules Management - PulledPork
(C) Setup
Internet -- Router -- SmoothSec -- Switch -- Personal Computers
The SmoothSec will monitor all the incoming and outgoing traffic between router and the switch.
Step a - Cable connection :
First of all, SmoothSec (Network Card 2) is connected to the Switch while Network Card 0 and 1 do not connect to the router at the moment. It is because you need to access the internet for the SmoothSec installation.
Step -1 - Installation of SmoothSec :
Install SmoothSec as usual or refer to
SmoothSec Wiki. When you are prompted to install non-free network interface firmware, you just ignore it. It is because Debian missed some firmware for Realtek 8169. After the installation, reboot the box as advice. The username is "
root" while the password is "
toor".
Step 0 - Install the missing packages :
apt-get install ethtool postfix fail2ban openjdk-7-jre
If you want to use Postfix as mail server for the Snorby report, you should install it and configure it after the install. For the configuration of Postfix, you may ask Google if you do not know how to.
Make sure you select "
Internet Site" when installing Postfix.
You may consider to install fail2ban to protect your ssh connection inside the network.
To improve the SmoothSec :
apt-get --purge remove arpwatch
apt-get install arpalert
cd /etc/arpalert/
mv oui.txt oui.txt.old
wget http://standards.ieee.org/regauth/oui/oui.txt
Step 1 - Get new Linux Kernel :
In order to install a high performance IDS/IPS, you need a newer kernel that the version should be 3.7 or greater.
apt-cache search linux-image
To look for Linux Kernel version that is greater than 3.7. If not, just add the following repos :
nano /etc/apt/sources.list
Append the following line (the address of the source may be different from yours, but it must be "
unstable" :
deb http://ftp.us.debian.org/debian/ unstable main
deb-src http://ftp.us.debian.org/debian/ unstable main
Then look for Linux Kernel version that is greater than 3.7 :
apt-get update
I select the version 3.10 :
apt-get install linux-image-3.10-2-amd64 linux-headers-3.10-2-amd64
When you are asked to restart some services when install, just reply "
yes".
You will be warned for some firmware missing, just ignore it. It is because Debian do not has some firmware for Realtek 8169. Anyway, it is harmless.
After the new kernel install, comment out what you added in "
/etc/apt/sources.list". This step is VERY IMPORTANT as the newer version of Apache (2.4.x) and Perl will break the Snorby and PulledPork, the web interface of the SmoothSec and rules management tool.
Then reboot the SmoothSec and select the new kernel when it is available.
Step 2 - Configure Suricata :
nano /etc/suricata/suricata.yaml
Locate "
#- delayed-detect: yes" and replace with "
- delayed-detect: yes".
Locate "
- fast:" and replace "
enabled: no" with "
enabled: yes".
Locate "
- drop:" and replace "
enabled: no" with "
enabled: yes".
Locate "
af-packet:" and replace "
threads: 1" with "
threads: 4". Or, the number of core of CPU you have.
Locate "
#checksum-checks: kernel" and replace it with "
checksum-checks: kernel".
Locate "
#copy-mode: ips" and replace it with "
copy-mode: ips".
Locate "
#copy-iface: eth1" and replace it with "
copy-iface: eth1".
Add "
buffer-size: 64535" just below "
copy-iface: eth1".
Locate "
- interface: eth1" and replace "
threads: 1" with "
threads: 4". Or, the number of core of CPU you have.
Add the following lines just below "
# disable-promisc: no" :
buffer-size: 64535
copy-mode: ips
copy-iface: eth0
use-mmap: yes
checksum-checks: kernel
Locate "
rule-files:" and add "
- local.rules" just below "
- emerging.rules".
touch /etc/suricata/rules/local.rules
nano /etc/init.d/suricata
Locate "
/usr/local/bin/suricata --user suricata -c /etc/suricata/suricata.yaml -i $INTERFACES -D" with "
/usr/local/bin/suricata --user suricata -c /etc/suricata/suricata.yaml --af-packet -D"
There are 2 entries, you should replace them all.
Step 3 - Time Zone :
Make sure your SmoothSec is UTC no matter your time zone is. It is because, Snorby is only working on UTC. Otherwise, the timestamp of Snorby will be wrong.
To check time zone of SmoothSec :
date
If the time is not UTC, you need to change back to it :
dpkg-reconfigure tzdata
Set the time zone to "
UTC" at "
None of the above".
Step 4 - Configure email feature of Snorby :
If you installed Postfix, configure it properly according to your network at "
/etc/postfix/main.cf".
nano /var/www/snorby/config/initializers/mail_config.rb
Then uncomment the lines just below "#Sendmail Example:". Or, refer to the
SmoothSec Wiki for the installation.
Step 5 - Configure network interfaces :
Make it looks like the following. Make sure your eth2 has your IP "
address" and "
gateway" instead of "
192.168.2.180" as it is an example only :
nano /etc/network/interfaces
# The loopback network interface
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet manual
up ifconfig eth0 0.0.0.0 up
down ifconfig eth0 down
post-up ethtool -K eth0 gro off
auto eth1
iface eth1 inet manual
up ifconfig eth1 0.0.0.0 up
down ifconfig eth1 down
post-up ethtool -K eth1 gro off
# The primary network interface
#allow-hotplug eth2
#iface eth2 inet dhcp
auto eth2
iface eth2 inet static
address 192.168.2.180
netmask 255.255.255.0
gateway 192.168.2.1
* Please note that ethtool is used as the Realtek network interfaces will produce error when working as AF_PACKET method.
Error messages when doing debugging with "
suricata -c /etc/suricata/suricata.yaml --af-packet" :
[ERRCODE: SC_ERR_SOCKET(200)] - Sending packet failed on socket 10: Message too long
[ERRCODE: SC_ERR_INVALID_ACTION(142)] - Unable to release packet data
Step 6 - Configure SmoothSec :
Run the following script to setup SmoothSec :
smoothsec.first.setup
Type "
eth0" when asks for the monitor interface. Enter "
192.168.2.0/24" when asked for the network. Please note that the address here is an example only. When asked for Intrusion Detection Engine, you type "
2" for Suricata. The email address and password asked are for the login purpose of Snorby (web interface).
Step b - Cable connection :
Connect Network Card 0 to the router and Network Card 1 to the switch. Network Card 2 connect to the switch.
When done, reboot the SmoothSec.
Step 7 - Browse Snorby :
You need to wait for several minutes before you can connect to the internet as Suricata need some time to do with the rules.
Open your browser and enter the following url :
https://192.168.2.180
Accept the certificate and wait for about a minute the Snorby will show up.
Step 8 - IPS Setup :
Now your SmoothSec is running as IDS (Intrusion Detection System) and it will not block or drop any malicious traffic.
To configure the SmoothSec to running as IPS (Intrusion Prevention System), you need to :
nano /etc/pulledpork/suricata/dropsid.conf
Append the following :
pcre:MS(0[0-9]|1[0-9])-\d+,bugtraq:\d+,cve:20[0-9][0-9]-\d+
So, you will drop/block any malicious traffic that match the vulnerabilities in the vulnerability reports, such as cve and bugtraq as well as Microsoft's. Meanwhile, you can add your own rules in "
/etc/suricata/rules/local.rules". Make sure to run "
smoothsec.suricata.rules.update" after your add them.
You may want to disable some rules :
nano /etc/pulledpork/suricata/disablesid.conf
Append the following :
1:2210000-1:2210049
It will disable the rules serial 2210000 to 2210049. A total of 50 rules to be disabled.
After done, run the following script :
smoothsec.suricata.rules.update
* Please also note that you are required to wait for several minutes before you can connect to the internet as Suricata requires some time to do with the rules.
(D) Troubleshooting
(1) In case you find there is no GeoIP information on the events, you should check if the file "
snorby-geoip.dat" in
/var/www/snorby/config/ or not. If not, just download it, please follow the below commands. If the file does not exist, that mean you cannot connect to the internet when installing Snorby.
cd /tmp/
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
gzip -d GeoIP.dat.gz
mv GeoIP.dat snorby-geoip.dat
chown www-data:www-data snorby-geoip.dat
cp snorby-geoip.dat /var/www/snorby/config/
(2) In case you do not capture the events, you should make sure the correct interface name (such as eth0, eth1 and eth2) are connected properly. You should examine the MAC address of the Network Card to determine the correct interface name.
(E) Performance
The SmoothSec is installed on a low-end hardware (Intel Atom D510 CPU with Realtek Gigabit NICs). It is also behind a router, which is running Untangle (Intel Atom D510 CPU with Realtek Gigabit NICs). Untangle is an UTM (Unified Threat Management System) which can block some malicious traffic (but a few only). The switch is D-Link DGS-1008D (Home) Gigabit switch.
To test the performance, I am watching a youtube at 1080p on PC-1 (via wifi), watching a youtube at 720p on PC-2 (via wifi) and watching a youtube at HD on Android smartphone with wifi. The result is very smooth without any lagging for all the devices.
The CPU loading for the test is below 4.x and memory used is below 3GB.
AF_PACKET is ideal for IDS/IPS implementation when you have a very low-end hardware.
(F) Limitation
Since SmoothSec 3.2 is build on Debian 7.0 (Wheezy), the system will be broken when you upgrade to Sid (Unstable). The newer version of Apache (2.4.x) and Perl will refuse to run due to error. Therefore, when you installed the newer kernel (for AF_PACKET purpose), make sure you comment out the repos that you added in order to prevent the system upgrade to the Sid (Unstable) by accident.
Another limitation is that you are requested to have at least 3 NICs for IDS or IPS.
One more limitation is the Snorby cannot show the dropped traffic at the moment.
Known Issue
Pigsty will crash randomly. As a result, no capture in Snorby. The problem has been reported, see
here.
--> The workaround is to run a testing bash script on every 5 minutes to start Pigsty again.
nano /root/chkpigstylog
#!/bin/bash
# Check if "Error: " in pigsty.log or not. If yes, start Pigsty again.
STRING="Error: "
if grep -R "$STRING" /var/log/pigsty.log
then
/root/runpigsty
fi
nano /root/runpigsty
#!/bin/bash
/usr/local/bin/pigsty -c /etc/pigsty/suricata.pigsty.config.js -i eth0 -n "Suricata" -d /var/log/suricata/ -m unified2.alert.* -D
crontab -e
*/5 * * * * /root/chkpigstylog
Update
Developers just fixed the problem. You just upgrade the Pigsty with the following command :
npm update pigsty-mysql -g
npm update pigsty -g
That's all! See you.
