network/barnyard2: Added (log parser for snort)
Signed-off-by: Robby Workman <rworkman@slackbuilds.org>
This commit is contained in:
Niels Horn
Robby Workman
parent
91e62177b4
commit
3ecfa23e5c
|
|
@ -0,0 +1,7 @@
|
|||
Barnyard2 is a fork of the original barnyard project, designed
|
||||
specifically for Snort's new unified2 file format. It is a
|
||||
critical tool for the parsing of Snort's binary log files to a
|
||||
variety of output plugins, capable of asynchronous processing,
|
||||
while Snort continues it's job.
|
||||
|
||||
See README.SLACKWARE for some instructions on setting up Barnyard2.
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
README.SLACKWARE
|
||||
================
|
||||
|
||||
0) Preparation
|
||||
--------------
|
||||
|
||||
For Barnyard2 to be useful, you will need a working setup of Snort, saving
|
||||
output to a log in the binary "unified2" format.
|
||||
Check the Snort documentation to find out how to do this.
|
||||
|
||||
You will also need a working database server. These instructions are based
|
||||
on using MySQL, as it is included with Slackware, but other databases can
|
||||
be used as well.
|
||||
|
||||
|
||||
1) Test Barnyard2
|
||||
-----------------
|
||||
|
||||
Before starting Barnyard2 as a daemon, do a quick test to see if it can read
|
||||
the Snort log:
|
||||
|
||||
# barnyard2 -d /var/log/snort -f snort.log
|
||||
|
||||
Barnyard2 will parse the its configuration file and start processing the Snort
|
||||
log file.
|
||||
If there are already events in the log, it will show them with their
|
||||
classification.
|
||||
|
||||
Now check if Snort is working by doing a port scan from another computer on
|
||||
the network (this won't work if done from another terminal on the same system)
|
||||
|
||||
# nmap -A <ip_address_of_snort_box>
|
||||
|
||||
Snort should detect the port scan, write the event to the log, and Barnyard2
|
||||
should display it.
|
||||
|
||||
|
||||
2) Configure Barnyard2
|
||||
----------------------
|
||||
|
||||
2.1 Setting up your database
|
||||
|
||||
Follow these steps to set up the database in MySQL:
|
||||
(replacing the <...> fields with your passwords)
|
||||
|
||||
# cd /usr/doc/barnyard2-*/schemas
|
||||
# mysql -p
|
||||
Enter password: <your_mysql_root_password>
|
||||
|
||||
mysql> create database snort;
|
||||
mysql> grant create,select,update,insert,delete on snort.* to snort@localhost;
|
||||
mysql> set password for snort@localhost=PASSWORD('<your_mysql_snort_password>');
|
||||
mysql> exit
|
||||
|
||||
# mysql -p < create_mysql snort
|
||||
Enter password: <your_mysql_root_password>
|
||||
|
||||
This will create the snort database and the tables.
|
||||
|
||||
2.2 Edit the configuration file
|
||||
|
||||
Open the /etc/barnyard2.conf file with your favorite editor, go to the end and
|
||||
edit the sample mysql configuration so that it looks like this:
|
||||
|
||||
output database: log, mysql, user=snort password=<your_mysql_snort_password> dbname=snort host=localhost
|
||||
|
||||
2.3 Start barnyard2 as a daemon
|
||||
|
||||
The Barnyard2 package installs a script to start and stop the daemon. Use it
|
||||
like this to start Barnyard2:
|
||||
|
||||
# /etc/rc.d/rc.barnyard2 start
|
||||
|
||||
You can repeat the test with the port scan and the event should be logged in
|
||||
your database now.
|
||||
|
||||
|
||||
3) Automatic startup and shutdown of Barnyard2
|
||||
----------------------------------------------
|
||||
|
||||
If you want Barnyard2 to start / stop automatically at boot and shutdown, use
|
||||
these lines in your /etc/rc.d/rc.local:
|
||||
|
||||
# Start barnyard2
|
||||
if [ -x /etc/rc.d/rc.barnyard2 ] ; then
|
||||
echo "Starting Barnyard2..."
|
||||
/etc/rc.d/rc.barnyard2 start
|
||||
fi
|
||||
|
||||
And include this in your /etc/rc.d/rc.local_shutdown:
|
||||
|
||||
# Stop barnyard2
|
||||
if [ -x /etc/rc.d/rc.barnyard2 ] ; then
|
||||
echo "Stopping Barnyard2..."
|
||||
/etc/rc.d/rc.barnyard2 stop
|
||||
fi
|
||||
|
||||
|
|
@ -0,0 +1,102 @@
|
|||
#!/bin/sh
|
||||
|
||||
# Slackware build script for barnyard2
|
||||
# Snort binary log processor
|
||||
|
||||
# Written by Niels Horn <niels.horn@gmail.com>
|
||||
# Revision date 2010/09/21
|
||||
|
||||
PRGNAM=barnyard2
|
||||
VERSION=${VERSION:-1.8}
|
||||
BUILD=${BUILD:-1}
|
||||
TAG=${TAG:-_SBo}
|
||||
|
||||
if [ -z "$ARCH" ]; then
|
||||
case "$( uname -m )" in
|
||||
i?86) ARCH=i486 ;;
|
||||
arm*) ARCH=arm ;;
|
||||
*) ARCH=$( uname -m ) ;;
|
||||
esac
|
||||
fi
|
||||
|
||||
CWD=$(pwd)
|
||||
TMP=${TMP:-/tmp/SBo}
|
||||
PKG=$TMP/package-$PRGNAM
|
||||
OUTPUT=${OUTPUT:-/tmp}
|
||||
|
||||
if [ "$ARCH" = "i486" ]; then
|
||||
SLKCFLAGS="-O2 -march=i486 -mtune=i686"
|
||||
LIBDIRSUFFIX=""
|
||||
elif [ "$ARCH" = "i686" ]; then
|
||||
SLKCFLAGS="-O2 -march=i686 -mtune=i686"
|
||||
LIBDIRSUFFIX=""
|
||||
elif [ "$ARCH" = "x86_64" ]; then
|
||||
SLKCFLAGS="-O2 -fPIC"
|
||||
LIBDIRSUFFIX="64"
|
||||
else
|
||||
SLKCFLAGS="-O2"
|
||||
LIBDIRSUFFIX=""
|
||||
fi
|
||||
|
||||
set -e
|
||||
|
||||
rm -rf $PKG
|
||||
mkdir -p $TMP $PKG $OUTPUT
|
||||
cd $TMP
|
||||
rm -rf $PRGNAM-$VERSION
|
||||
tar xvf $CWD/$PRGNAM-$VERSION.tar.gz
|
||||
cd $PRGNAM-$VERSION
|
||||
chown -R root:root .
|
||||
find . \
|
||||
\( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \
|
||||
-exec chmod 755 {} \; -o \
|
||||
\( -perm 666 -o -perm 664 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \
|
||||
-exec chmod 644 {} \;
|
||||
|
||||
CFLAGS="$SLKCFLAGS" \
|
||||
CXXFLAGS="$SLKCFLAGS" \
|
||||
./configure \
|
||||
--prefix=/usr \
|
||||
--libdir=/usr/lib${LIBDIRSUFFIX} \
|
||||
--sysconfdir=/etc \
|
||||
--docdir=/usr/doc/$PRGNAM-$VERSION \
|
||||
--mandir=/usr/man \
|
||||
--localstatedir=/var \
|
||||
--with-mysql-libraries=/usr/lib${LIBDIRSUFFIX}/mysql \
|
||||
--with-mysql-includes=/usr/include/mysql \
|
||||
--build=$ARCH-slackware-linux
|
||||
|
||||
make
|
||||
make install DESTDIR=$PKG
|
||||
|
||||
find $PKG | xargs file | grep -e "executable" -e "shared object" | grep ELF \
|
||||
| cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null || true
|
||||
|
||||
mv $PKG/etc/$PRGNAM.conf $PKG/etc/$PRGNAM.conf.new
|
||||
|
||||
# Include rc.barnyard2 file
|
||||
mkdir -p $PKG/etc/rc.d
|
||||
cat $CWD/rc.barnyard2 > $PKG/etc/rc.d/rc.barnyard2.new
|
||||
chmod 0755 $PKG/etc/rc.d/rc.barnyard2.new
|
||||
|
||||
# Create directory for log
|
||||
mkdir -p $PKG/var/log/$PRGNAM
|
||||
|
||||
# Copy database schemas and docs
|
||||
mkdir -p $PKG/usr/doc/$PRGNAM-$VERSION/schemas
|
||||
for sc in schemas/create_*; do
|
||||
cat $sc > $PKG/usr/doc/$PRGNAM-$VERSION/$sc
|
||||
done
|
||||
cp -a \
|
||||
COPYING LICENSE RELEASE.NOTES doc/* \
|
||||
$PKG/usr/doc/$PRGNAM-$VERSION
|
||||
find $PKG/usr/doc/$PRGNAM-$VERSION -name "Makefile*" -exec rm -f {} \;
|
||||
cat $CWD/$PRGNAM.SlackBuild > $PKG/usr/doc/$PRGNAM-$VERSION/$PRGNAM.SlackBuild
|
||||
cat $CWD/README.SLACKWARE > $PKG/usr/doc/$PRGNAM-$VERSION/README.SLACKWARE
|
||||
|
||||
mkdir -p $PKG/install
|
||||
cat $CWD/slack-desc > $PKG/install/slack-desc
|
||||
cat $CWD/doinst.sh > $PKG/install/doinst.sh
|
||||
|
||||
cd $PKG
|
||||
/sbin/makepkg -l y -c n $OUTPUT/$PRGNAM-$VERSION-$ARCH-$BUILD$TAG.${PKGTYPE:-tgz}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
PRGNAM="barnyard2"
|
||||
VERSION="1.8"
|
||||
HOMEPAGE="http://www.securixlive.com/barnyard2/"
|
||||
DOWNLOAD="http://www.securixlive.com/download/barnyard2/barnyard2-1.8.tar.gz"
|
||||
MD5SUM="72fc6c490db6ea6a0f46c27d24998067"
|
||||
DOWNLOAD_x86_64=""
|
||||
MD5SUM_x86_64=""
|
||||
MAINTAINER="Niels Horn"
|
||||
EMAIL="niels.horn@gmail.com"
|
||||
APPROVED="rworkman"
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
config() {
|
||||
NEW="$1"
|
||||
OLD="$(dirname $NEW)/$(basename $NEW .new)"
|
||||
# If there's no config file by that name, mv it over:
|
||||
if [ ! -r $OLD ]; then
|
||||
mv $NEW $OLD
|
||||
elif [ "$(cat $OLD | md5sum)" = "$(cat $NEW | md5sum)" ]; then # toss the redundant copy
|
||||
rm $NEW
|
||||
fi
|
||||
# Otherwise, we leave the .new copy for the admin to consider...
|
||||
}
|
||||
|
||||
preserve_perms() {
|
||||
NEW="$1"
|
||||
OLD="$(dirname $NEW)/$(basename $NEW .new)"
|
||||
if [ -e $OLD ]; then
|
||||
cp -a $OLD ${NEW}.incoming
|
||||
cat $NEW > ${NEW}.incoming
|
||||
mv ${NEW}.incoming $NEW
|
||||
fi
|
||||
config $NEW
|
||||
}
|
||||
|
||||
preserve_perms etc/rc.d/rc.barnyard2.new
|
||||
config etc/barnyard2.conf.new
|
||||
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
#!/bin/sh
|
||||
# Start/stop/restart barnyard2
|
||||
|
||||
# Settings
|
||||
SNORTLOGDIR=${SNORTLOGDIR:-/var/log/snort}
|
||||
SNORTLOGFILE=${SNORTLOGFILE:-snort.log}
|
||||
IFACE=${IFACE:-any}
|
||||
PIDFILE=/var/run/barnyard2_$IFACE.pid
|
||||
LOGDIR=/var/log/barnyard2
|
||||
|
||||
|
||||
# Start snort:
|
||||
by2_start() {
|
||||
CMDLINE="/usr/bin/barnyard2 -i $IFACE -d $SNORTLOGDIR -f $SNORTLOGFILE -n -D "
|
||||
echo -n "Starting Barnyard2 daemon: $CMDLINE"
|
||||
$CMDLINE --pid-path /var/run --create-pidfile -l $LOGDIR
|
||||
echo
|
||||
}
|
||||
|
||||
# Stop snort:
|
||||
by2_stop() {
|
||||
echo -n "Stopping Barnyard2 daemon..."
|
||||
kill $(cat $PIDFILE)
|
||||
echo
|
||||
sleep 1
|
||||
rm -f $PIDFILE
|
||||
}
|
||||
|
||||
# Restart snort:
|
||||
by2_restart() {
|
||||
by2_stop
|
||||
sleep 1
|
||||
by2_start
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
'start')
|
||||
by2_start
|
||||
;;
|
||||
'stop')
|
||||
by2_stop
|
||||
;;
|
||||
'restart')
|
||||
by2_restart
|
||||
;;
|
||||
*)
|
||||
echo "usage $0 start|stop|restart"
|
||||
esac
|
||||
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
# HOW TO EDIT THIS FILE:
|
||||
# The "handy ruler" below makes it easier to edit a package description. Line
|
||||
# up the first '|' above the ':' following the base package name, and the '|'
|
||||
# on the right side marks the last column you can put a character in. You must
|
||||
# make exactly 11 lines for the formatting to be correct. It's also
|
||||
# customary to leave one space after the ':'.
|
||||
|
||||
|-----handy-ruler------------------------------------------------------|
|
||||
barnyard2: barnyard2 (Snort output processor)
|
||||
barnyard2:
|
||||
barnyard2: Barnyard2 is a fork of the original barnyard project, designed
|
||||
barnyard2: specifically for Snort's new unified2 file format. It is a critical
|
||||
barnyard2: tool for the parsing of Snort's binary log files to a variety of
|
||||
barnyard2: output plugins, capable of asynchronously processing, while Snort
|
||||
barnyard2: continues it's job.
|
||||
barnyard2:
|
||||
barnyard2: Homepage: http://www.securixlive.com/barnyard2/
|
||||
barnyard2:
|
||||
barnyard2:
|
||||
Loading…
Reference in New Issue