Intrusion Detection with the Snort IDS
Prevention or Detection
Snort provides several options for preventing (and detecting) intrusion. The three main modes for preventing intrusion are inline filtering, cooperation with an existing iptables-based firewall, and TCP-RST mode.
When Snort is working as an inline filter, all traffic must pass through the Snort system before it passes to the internal network. If the traffic triggers a rule in the Snort system, the packets are dropped. The inline solution offers advanced firewall-style security with a regularly updated rule set. However, the IPS can also prevent access to systems through false positives and will slow down your network if you have more traffic than the Snort sensor to handle. For inline mode, you'll need to add – enable-inline to your ./configure command.
If you already have an existing iptables-based firewall, you can configure Snort to provide dynamic rule changes. The iptables option reduces some of the lag on inbound traffic, but as a trade-off, your system will be slower to respond to attacks. Once the malicious traffic triggers an alert, Snort sends a command to the iptables system to block the attacker. This style of IPS, if not correctly configured, can be manipulated by a creative attacker to force a denial of service on your own systems.
If an attacker spoofs malicious traffic from your ISP's router or DNS server, you could end up blacklisting services you need to maintain a reliable network presence. To combat this, use a whitelist of addresses you never ban. However, an attacker who discovers the address of your whitelist can spoof attacks from this address without fear of being blocked.
The final option is to allow Snort to disconnect unwanted connections through the use of TCP-RST packets (through the use of the flexresp2 patch). This option can terminate an unwanted connection from both ends. However, this solution causes a race condition between your IPS and the malicious traffic. The IPS attempts to close the connection before the attacker can complete the attack. The attacker will already have an advantage in this case, because the malicious traffic is already inside your network before Snort can act. This mode of operation helps prevent certain attacks, but it might be less reliable than the other techniques.
How you configure your IDS/IPS is dependent on your security requirements. If you intend to set up Snort as an IPS, test the server in IDS mode until you've correctly tuned the configuration and reduced false positives.
Once you're happy with the configuration, move Snort to its new role as a prevention system.
Conclusion
Snort has many other features to discover. For example, I never got to mention the retro ASCII art pig (Figure 5).
Numerous books and online resources will help you get started with the Snort intrusion detection system. The Snort project website offers a great number documents that can help solve problems. Snort's website also offer a community forum that provides user assistance and news.
Infos
- Snort homepage: http://www.snort.org
- Sourcefire: http://www.sourcefire.com
- BASE: Basic Analysis and Security Engine: http://base.secureideas.net
- ADOdb database abstraction library for PHP: http://adodb.sourceforge.net
- BPF (Berkeley Packet Filter): http://tcpdump.org
« Previous 1 2 3
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
News
-
The GNU Project Celebrates Its 40th Birthday
September 27 marks the 40th anniversary of the GNU Project, and it was celebrated with a hacker meeting in Biel/Bienne, Switzerland.
-
Linux Kernel Reducing Long-Term Support
LTS support for the Linux kernel is about to undergo some serious changes that will have a considerable impact on the future.
-
Fedora 39 Beta Now Available for Testing
For fans and users of Fedora Linux, the first beta of release 39 is now available, which is a minor upgrade but does include GNOME 45.
-
Fedora Linux 40 to Drop X11 for KDE Plasma
When Fedora 40 arrives in 2024, there will be a few big changes coming, especially for the KDE Plasma option.
-
Real-Time Ubuntu Available in AWS Marketplace
Anyone looking for a Linux distribution for real-time processing could do a whole lot worse than Real-Time Ubuntu.
-
KSMBD Finally Reaches a Stable State
For those who've been looking forward to the first release of KSMBD, after two years it's no longer considered experimental.
-
Nitrux 3.0.0 Has Been Released
The latest version of Nitrux brings plenty of innovation and fresh apps to the table.
-
Linux From Scratch 12.0 Now Available
If you're looking to roll your own Linux distribution, the latest version of Linux From Scratch is now available with plenty of updates.
-
Linux Kernel 6.5 Has Been Released
The newest Linux kernel, version 6.5, now includes initial support for two very exciting features.
-
UbuntuDDE 23.04 Now Available
A new version of the UbuntuDDE remix has finally arrived with all the updates from the Deepin desktop and everything that comes with the Ubuntu 23.04 base.