├── tests ├── inventory ├── .ansible-lint ├── test.yml ├── Dockerfile.ubuntu-xenial ├── Dockerfile.debian-stretch ├── Dockerfile.ubuntu-bionic ├── Dockerfile.debian-jessie ├── Dockerfile.ubuntu-trusty ├── Dockerfile.fedora-24 ├── Dockerfile.fedora-25 ├── Dockerfile.fedora-26 ├── Dockerfile.fedora-27 ├── Dockerfile.fedora-28 ├── Dockerfile.fedora-29 └── Dockerfile.centos-7 ├── vars └── main.yml ├── requirements.yml ├── templates ├── etc │ ├── oinkmaster.conf.j2 │ ├── sysconfig │ │ └── snort.j2 │ ├── init.d │ │ └── barnyard2.j2 │ └── snort │ │ ├── barnyard2.conf.j2 │ │ ├── snort.debian.conf.j2 │ │ └── snort.conf.j2 └── lib │ └── systemd │ └── system │ └── barnyard2.service.j2 ├── handlers └── main.yml ├── playbook.yml ├── filter_plugins └── snort_interface.py ├── tasks ├── main.yml ├── config_snort.yml ├── redhat.yml ├── debian.yml ├── config_oinkmaster.yml └── barnyard2.yml ├── setup_travis_tests.sh ├── README.md ├── meta └── main.yml ├── .yamllint.yml ├── .travis.yml ├── files └── create_mysql └── defaults └── main.yml /tests/inventory: -------------------------------------------------------------------------------- 1 | localhost 2 | -------------------------------------------------------------------------------- /tests/.ansible-lint: -------------------------------------------------------------------------------- 1 | skip_list: ["401", "503"] 2 | -------------------------------------------------------------------------------- /vars/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # vars file for ansible-snort 3 | -------------------------------------------------------------------------------- /tests/test.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: localhost 3 | connection: local 4 | roles: 5 | - ansible-snort 6 | -------------------------------------------------------------------------------- /requirements.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - src: https://github.com/mrlesmithjr/ansible-mysql.git 3 | - src: https://github.com/mrlesmithjr/ansible-snort.git 4 | -------------------------------------------------------------------------------- /templates/etc/oinkmaster.conf.j2: -------------------------------------------------------------------------------- 1 | {{ ansible_managed|comment }} 2 | 3 | url= {{ snort_oinkmaster_rules_url }} 4 | path = /bin:/usr/bin:/usr/local/bin 5 | update_files = \.rules$|\.config$|\.conf$|\.txt$|\.map$ 6 | 7 | skipfile local.rules 8 | skipfile deleted.rules 9 | skipfile snort.conf -------------------------------------------------------------------------------- /handlers/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # handlers file for ansible-snort 3 | 4 | - name: restart snort 5 | service: 6 | name: snort 7 | state: restarted 8 | become: true 9 | 10 | - name: restart snortd 11 | service: 12 | name: snortd 13 | state: restarted 14 | become: true 15 | -------------------------------------------------------------------------------- /playbook.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: provisions snort 3 | hosts: all 4 | sudo: true 5 | vars: 6 | - snort_barnyard2_enable: true 7 | roles: 8 | - role: ansible-mysql 9 | when: snort_barnyard2_enable is defined and snort_barnyard2_enable 10 | - role: ansible-snort 11 | tasks: 12 | -------------------------------------------------------------------------------- /templates/etc/sysconfig/snort.j2: -------------------------------------------------------------------------------- 1 | {{ ansible_managed|comment }} 2 | 3 | INTERFACE={{ snort_interface }} 4 | CONF=/etc/snort/snort.conf 5 | USER=snort 6 | GROUP=snort 7 | PASS_FIRST=0 8 | LOGDIR=/var/log/snort 9 | ALERTMODE=fast 10 | DUMP_APP=1 11 | BINARY_LOG=1 12 | NO_PACKET_LOG=0 13 | PRINT_INTERFACE=0 14 | SYSLOG=/var/log/messages 15 | SECS=5 16 | -------------------------------------------------------------------------------- /templates/lib/systemd/system/barnyard2.service.j2: -------------------------------------------------------------------------------- 1 | [Unit] 2 | Description=Barnyard2 Daemon 3 | After=syslog.target network.target 4 | 5 | [Service] 6 | Type=simple 7 | ExecStart=/usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d {{ snort_barnyard2_logdir }} -f snort.log -w {{ snort_barnyard2_waldo_file }} -g snort -u snort 8 | 9 | [Install] 10 | WantedBy=multi-user.target -------------------------------------------------------------------------------- /tests/Dockerfile.ubuntu-xenial: -------------------------------------------------------------------------------- 1 | FROM ubuntu:xenial 2 | ENV container=docker 3 | 4 | RUN apt-get update && \ 5 | apt-get install -y --no-install-recommends build-essential libffi-dev \ 6 | libssl-dev python-dev python-minimal python-pip python-setuptools \ 7 | python-virtualenv && \ 8 | rm -rf /var/lib/apt/lists/* 9 | 10 | RUN pip install enum34 ipaddress wheel && \ 11 | pip install ansible ansible-lint 12 | 13 | COPY .ansible-lint / 14 | -------------------------------------------------------------------------------- /filter_plugins/snort_interface.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python 2 | class FilterModule(object): 3 | def filters(self): 4 | return { 5 | 'snort_interface': self.filter_snort_interface, 6 | } 7 | 8 | def filter_snort_interface(self, interfaces): 9 | for interface in interfaces: 10 | if interface != 'lo': 11 | snort_interface = interface 12 | break 13 | return snort_interface 14 | -------------------------------------------------------------------------------- /tasks/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # tasks file for ansible-snort 3 | 4 | - include_tasks: debian.yml 5 | when: ansible_os_family == "Debian" 6 | 7 | - include_tasks: redhat.yml 8 | when: ansible_os_family == "RedHat" 9 | 10 | - include_tasks: config_snort.yml 11 | when: snort_config_snort|bool 12 | 13 | - include_tasks: config_oinkmaster.yml 14 | when: snort_config_oinkmaster|bool 15 | 16 | - include_tasks: barnyard2.yml 17 | when: snort_barnyard2_enable|bool 18 | -------------------------------------------------------------------------------- /tests/Dockerfile.debian-stretch: -------------------------------------------------------------------------------- 1 | FROM debian:stretch 2 | ENV container=docker 3 | 4 | RUN apt-get update && \ 5 | apt-get install -y --no-install-recommends build-essential libffi-dev \ 6 | libssl-dev python-dev python-minimal python-pip python-setuptools \ 7 | python-virtualenv systemd && \ 8 | rm -rf /var/lib/apt/lists/* 9 | 10 | RUN pip install enum34 ipaddress wheel && \ 11 | pip install ansible ansible-lint 12 | 13 | COPY .ansible-lint / 14 | -------------------------------------------------------------------------------- /tests/Dockerfile.ubuntu-bionic: -------------------------------------------------------------------------------- 1 | FROM ubuntu:bionic 2 | ENV container=docker 3 | 4 | RUN apt-get update && \ 5 | apt-get install -y --no-install-recommends build-essential libffi-dev \ 6 | libssl-dev python-dev python-minimal python-pip python-setuptools \ 7 | python-virtualenv systemd && \ 8 | rm -rf /var/lib/apt/lists/* 9 | 10 | RUN pip install enum34 ipaddress wheel && \ 11 | pip install ansible ansible-lint 12 | 13 | COPY .ansible-lint / 14 | -------------------------------------------------------------------------------- /tests/Dockerfile.debian-jessie: -------------------------------------------------------------------------------- 1 | FROM debian:jessie 2 | ENV container=docker 3 | 4 | RUN apt-get update && \ 5 | apt-get install -y --no-install-recommends build-essential libffi-dev \ 6 | libssl-dev python-dev python-minimal python-pip python-setuptools \ 7 | python-virtualenv && \ 8 | rm -rf /var/lib/apt/lists/* 9 | 10 | RUN pip install --upgrade pip setuptools && \ 11 | pip install enum34 ipaddress wheel && \ 12 | pip install ansible ansible-lint 13 | 14 | COPY .ansible-lint / 15 | -------------------------------------------------------------------------------- /tests/Dockerfile.ubuntu-trusty: -------------------------------------------------------------------------------- 1 | FROM ubuntu:trusty 2 | ENV container=docker 3 | 4 | RUN apt-get update && \ 5 | apt-get install -y --no-install-recommends build-essential libffi-dev \ 6 | libssl-dev python-dev python-minimal python-pip python-setuptools \ 7 | python-virtualenv && \ 8 | rm -rf /var/lib/apt/lists/* 9 | 10 | RUN pip install --upgrade pip setuptools && \ 11 | pip install enum34 ipaddress wheel && \ 12 | pip install ansible ansible-lint 13 | 14 | COPY .ansible-lint / 15 | -------------------------------------------------------------------------------- /setup_travis_tests.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | TRAVIS_TEST_VER="v1.6.2" 3 | 4 | TAR_FILE="$TRAVIS_TEST_VER.tar.gz" 5 | 6 | # Prompt for Ansible role name 7 | read -r -p "Enter the Ansible role name: " input 8 | 9 | # Update .travis.yml with Ansible role name 10 | sed -i '' "s/replace_role/${input}/g" ".travis.yml" 11 | 12 | # Update tests/test.yml with Ansible role name 13 | sed -i '' "s/replace_role/${input}/g" "tests/test.yml" 14 | 15 | # Cleanup 16 | if [ -f $TAR_FILE ]; then 17 | rm $TAR_FILE 18 | fi 19 | -------------------------------------------------------------------------------- /templates/etc/init.d/barnyard2.j2: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | case $1 in 4 | start) 5 | echo "Starting Barnyard2" 6 | sudo bash -c "barnyard2 -c /etc/snort/barnyard2.conf -d {{ snort_barnyard2_logdir }} -f snort.log -w {{ snort_barnyard2_waldo_file }} -g snort -u snort" 7 | echo 'Barnyard2 started.' 8 | ;; 9 | stop) 10 | echo "Stopping Barnyard2" 11 | sudo killall barnyard2 12 | echo 'Barnyard2 stopped.' 13 | ;; 14 | restart) 15 | $0 stop 16 | sleep 4 17 | $0 start 18 | ;; 19 | *) 20 | echo "usage: $0 (start|stop|restart)" 21 | ;; 22 | esac 23 | 24 | exit 0 25 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ansible-snort 2 | 3 | Installs and configures [Snort IDS](https://snort.org/) 4 | 5 | ## Requirements 6 | 7 | None 8 | 9 | ## Role Variables 10 | 11 | [defaults/main.yml](defaults/main.yml) 12 | 13 | ## Dependencies 14 | 15 | None 16 | 17 | ## Example Playbook 18 | 19 | ```yaml 20 | --- 21 | - hosts: all 22 | become: true 23 | vars: 24 | roles: 25 | - role: ansible-snort 26 | tasks: 27 | ``` 28 | 29 | ## License 30 | 31 | MIT 32 | 33 | ## Author Information 34 | 35 | Larry Smith Jr. 36 | 37 | - [@mrlesmithjr](https://www.twitter.com/mrlesmithjr) 38 | - [EverythingShouldBeVirtual](http://www.everythingshouldbevirtual.com) 39 | - [mrlesmithjr@gmail.com](mailto:mrlesmithjr@gmail.com) 40 | -------------------------------------------------------------------------------- /templates/etc/snort/barnyard2.conf.j2: -------------------------------------------------------------------------------- 1 | {{ ansible_managed|comment }} 2 | 3 | config reference_file: /etc/snort/reference.config 4 | config classification_file: /etc/snort/classification.config 5 | config gen_file: /etc/snort/gen-msg.map 6 | config sid_file: /etc/snort/sid-msg.map 7 | config logdir: {{ snort_barnyard2_logdir }} 8 | config hostname: {{ ansible_hostname }} 9 | config interface: {{ ansible_default_ipv4.interface|default(ansible_interfaces|snort_interface) }} 10 | config daemon 11 | config waldo_file: {{ snort_barnyard2_waldo_file }} 12 | 13 | input unified2 14 | 15 | output alert_fast: stdout 16 | 17 | output database: log, mysql, user={{ snort_barnyard2_db_info.user }} password={{ snort_barnyard2_db_info.pass }} dbname={{ snort_barnyard2_db_info.name }} host={{ snort_barnyard2_db_info.host }} 18 | -------------------------------------------------------------------------------- /meta/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | galaxy_info: 3 | author: Larry Smith Jr. 4 | description: Installs and configures Snort IDS https://snort.org/ 5 | 6 | license: MIT 7 | min_ansible_version: 1.2 8 | 9 | platforms: 10 | - name: EL 11 | versions: 12 | - 7 13 | - name: Fedora 14 | versions: 15 | - 22 16 | - 23 17 | - 24 18 | - 25 19 | - 26 20 | - 27 21 | - 28 22 | - 29 23 | - name: Ubuntu 24 | versions: 25 | - bionic 26 | - dingo 27 | - precise 28 | - trusty 29 | - vivid 30 | - xenial 31 | - name: Debian 32 | versions: 33 | - buster 34 | - jessie 35 | - wheezy 36 | - stretch 37 | 38 | galaxy_tags: 39 | - monitoring 40 | - networking 41 | - system 42 | 43 | dependencies: [] 44 | -------------------------------------------------------------------------------- /tests/Dockerfile.fedora-24: -------------------------------------------------------------------------------- 1 | FROM fedora:24 2 | ENV container=docker 3 | 4 | RUN dnf -y install gmp-devel libffi-devel openssl-devel python-crypto \ 5 | python-devel python-dnf python-pip python-setuptools python-virtualenv \ 6 | redhat-rpm-config systemd && \ 7 | dnf -y group install "C Development Tools and Libraries" 8 | 9 | # Install systemd -- See https://hub.docker.com/_/centos/ 10 | RUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \ 11 | rm -f /lib/systemd/system/multi-user.target.wants/*;\ 12 | rm -f /etc/systemd/system/*.wants/*;\ 13 | rm -f /lib/systemd/system/local-fs.target.wants/*; \ 14 | rm -f /lib/systemd/system/sockets.target.wants/*udev*; \ 15 | rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \ 16 | rm -f /lib/systemd/system/basic.target.wants/*;\ 17 | rm -f /lib/systemd/system/anaconda.target.wants/*; 18 | 19 | RUN pip install enum34 ipaddress wheel && \ 20 | pip install ansible ansible-lint 21 | 22 | COPY .ansible-lint / 23 | 24 | VOLUME ["/sys/fs/cgroup"] 25 | 26 | CMD ["/usr/sbin/init"] 27 | -------------------------------------------------------------------------------- /tests/Dockerfile.fedora-25: -------------------------------------------------------------------------------- 1 | FROM fedora:25 2 | ENV container=docker 3 | 4 | RUN dnf -y install gmp-devel libffi-devel openssl-devel python-crypto \ 5 | python-devel python-dnf python-pip python-setuptools python-virtualenv \ 6 | redhat-rpm-config systemd && \ 7 | dnf -y group install "C Development Tools and Libraries" 8 | 9 | # Install systemd -- See https://hub.docker.com/_/centos/ 10 | RUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \ 11 | rm -f /lib/systemd/system/multi-user.target.wants/*;\ 12 | rm -f /etc/systemd/system/*.wants/*;\ 13 | rm -f /lib/systemd/system/local-fs.target.wants/*; \ 14 | rm -f /lib/systemd/system/sockets.target.wants/*udev*; \ 15 | rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \ 16 | rm -f /lib/systemd/system/basic.target.wants/*;\ 17 | rm -f /lib/systemd/system/anaconda.target.wants/*; 18 | 19 | RUN pip install enum34 ipaddress wheel && \ 20 | pip install ansible ansible-lint 21 | 22 | COPY .ansible-lint / 23 | 24 | VOLUME ["/sys/fs/cgroup"] 25 | 26 | CMD ["/usr/sbin/init"] 27 | -------------------------------------------------------------------------------- /tests/Dockerfile.fedora-26: -------------------------------------------------------------------------------- 1 | FROM fedora:26 2 | ENV container=docker 3 | 4 | RUN dnf -y install gmp-devel libffi-devel openssl-devel python-crypto \ 5 | python-devel python-dnf python-pip python-setuptools python-virtualenv \ 6 | redhat-rpm-config systemd && \ 7 | dnf -y group install "C Development Tools and Libraries" 8 | 9 | # Install systemd -- See https://hub.docker.com/_/centos/ 10 | RUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \ 11 | rm -f /lib/systemd/system/multi-user.target.wants/*;\ 12 | rm -f /etc/systemd/system/*.wants/*;\ 13 | rm -f /lib/systemd/system/local-fs.target.wants/*; \ 14 | rm -f /lib/systemd/system/sockets.target.wants/*udev*; \ 15 | rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \ 16 | rm -f /lib/systemd/system/basic.target.wants/*;\ 17 | rm -f /lib/systemd/system/anaconda.target.wants/*; 18 | 19 | RUN pip install enum34 ipaddress wheel && \ 20 | pip install ansible ansible-lint 21 | 22 | COPY .ansible-lint / 23 | 24 | VOLUME ["/sys/fs/cgroup"] 25 | 26 | CMD ["/usr/sbin/init"] 27 | -------------------------------------------------------------------------------- /tests/Dockerfile.fedora-27: -------------------------------------------------------------------------------- 1 | FROM fedora:27 2 | ENV container=docker 3 | 4 | RUN dnf -y install gmp-devel libffi-devel openssl-devel python-crypto \ 5 | python-devel python-dnf python-pip python-setuptools python-virtualenv \ 6 | redhat-rpm-config systemd && \ 7 | dnf -y group install "C Development Tools and Libraries" 8 | 9 | # Install systemd -- See https://hub.docker.com/_/centos/ 10 | RUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \ 11 | rm -f /lib/systemd/system/multi-user.target.wants/*;\ 12 | rm -f /etc/systemd/system/*.wants/*;\ 13 | rm -f /lib/systemd/system/local-fs.target.wants/*; \ 14 | rm -f /lib/systemd/system/sockets.target.wants/*udev*; \ 15 | rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \ 16 | rm -f /lib/systemd/system/basic.target.wants/*;\ 17 | rm -f /lib/systemd/system/anaconda.target.wants/*; 18 | 19 | RUN pip install enum34 ipaddress wheel && \ 20 | pip install ansible ansible-lint 21 | 22 | COPY .ansible-lint / 23 | 24 | VOLUME ["/sys/fs/cgroup"] 25 | 26 | CMD ["/usr/sbin/init"] 27 | -------------------------------------------------------------------------------- /tests/Dockerfile.fedora-28: -------------------------------------------------------------------------------- 1 | FROM fedora:28 2 | ENV container=docker 3 | 4 | RUN dnf -y install gmp-devel libffi-devel openssl-devel python-crypto \ 5 | python-devel python-dnf python-pip python-setuptools python-virtualenv \ 6 | redhat-rpm-config systemd && \ 7 | dnf -y group install "C Development Tools and Libraries" 8 | 9 | # Install systemd -- See https://hub.docker.com/_/centos/ 10 | RUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \ 11 | rm -f /lib/systemd/system/multi-user.target.wants/*;\ 12 | rm -f /etc/systemd/system/*.wants/*;\ 13 | rm -f /lib/systemd/system/local-fs.target.wants/*; \ 14 | rm -f /lib/systemd/system/sockets.target.wants/*udev*; \ 15 | rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \ 16 | rm -f /lib/systemd/system/basic.target.wants/*;\ 17 | rm -f /lib/systemd/system/anaconda.target.wants/*; 18 | 19 | RUN pip install enum34 ipaddress wheel && \ 20 | pip install ansible ansible-lint 21 | 22 | COPY .ansible-lint / 23 | 24 | VOLUME ["/sys/fs/cgroup"] 25 | 26 | CMD ["/usr/sbin/init"] 27 | -------------------------------------------------------------------------------- /tests/Dockerfile.fedora-29: -------------------------------------------------------------------------------- 1 | FROM fedora:29 2 | ENV container=docker 3 | 4 | RUN dnf -y install gmp-devel libffi-devel openssl-devel python-crypto \ 5 | python-devel python-dnf python-pip python-setuptools python-virtualenv \ 6 | redhat-rpm-config systemd && \ 7 | dnf -y group install "C Development Tools and Libraries" 8 | 9 | # Install systemd -- See https://hub.docker.com/_/centos/ 10 | RUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \ 11 | rm -f /lib/systemd/system/multi-user.target.wants/*;\ 12 | rm -f /etc/systemd/system/*.wants/*;\ 13 | rm -f /lib/systemd/system/local-fs.target.wants/*; \ 14 | rm -f /lib/systemd/system/sockets.target.wants/*udev*; \ 15 | rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \ 16 | rm -f /lib/systemd/system/basic.target.wants/*;\ 17 | rm -f /lib/systemd/system/anaconda.target.wants/*; 18 | 19 | RUN pip install enum34 ipaddress wheel && \ 20 | pip install ansible ansible-lint 21 | 22 | COPY .ansible-lint / 23 | 24 | VOLUME ["/sys/fs/cgroup"] 25 | 26 | CMD ["/usr/sbin/init"] 27 | -------------------------------------------------------------------------------- /tests/Dockerfile.centos-7: -------------------------------------------------------------------------------- 1 | FROM centos:7 2 | ENV container=docker 3 | 4 | RUN yum -y install epel-release && \ 5 | yum -y install gmp-devel libffi-devel openssl-devel python-crypto \ 6 | python-devel python-pip python-setuptools python-virtualenv \ 7 | redhat-rpm-config && \ 8 | yum -y group install "Development Tools" 9 | 10 | # Install systemd -- See https://hub.docker.com/_/centos/ 11 | RUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \ 12 | rm -f /lib/systemd/system/multi-user.target.wants/*;\ 13 | rm -f /etc/systemd/system/*.wants/*;\ 14 | rm -f /lib/systemd/system/local-fs.target.wants/*; \ 15 | rm -f /lib/systemd/system/sockets.target.wants/*udev*; \ 16 | rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \ 17 | rm -f /lib/systemd/system/basic.target.wants/*;\ 18 | rm -f /lib/systemd/system/anaconda.target.wants/*; 19 | 20 | RUN pip install enum34 ipaddress wheel && \ 21 | pip install ansible ansible-lint 22 | 23 | COPY .ansible-lint / 24 | 25 | VOLUME ["/sys/fs/cgroup"] 26 | 27 | CMD ["/usr/sbin/init"] 28 | -------------------------------------------------------------------------------- /templates/etc/snort/snort.debian.conf.j2: -------------------------------------------------------------------------------- 1 | {{ ansible_managed|comment }} 2 | 3 | {% if snort_startup is defined %} 4 | DEBIAN_SNORT_STARTUP="{{ snort_startup }}" 5 | {% elif snort_startup is not defined %} 6 | DEBIAN_SNORT_STARTUP="boot" 7 | {% endif %} 8 | {% if snort_home_net is defined %} 9 | DEBIAN_SNORT_HOME_NET="{{ snort_home_net }}" 10 | {% elif snort_home_net is not defined %} 11 | DEBIAN_SNORT_HOME_NET="192.168.0.0/16" 12 | {% endif %} 13 | {% if snort_options is defined %} 14 | DEBIAN_SNORT_OPTIONS="{{ snort_options }}" 15 | {% elif snort_options is not defined %} 16 | DEBIAN_SNORT_OPTIONS="" 17 | {% endif %} 18 | {% if snort_interface is defined %} 19 | DEBIAN_SNORT_INTERFACE="{{ snort_interface }}" 20 | {% elif snort_interface is not defined %} 21 | DEBIAN_SNORT_INTERFACE="eth0" 22 | {% endif %} 23 | {% if (snort_send_stats is defined and snort_send_stats) or snort_send_stats is not defined %} 24 | DEBIAN_SNORT_SEND_STATS="true" 25 | {% elif snort_send_stats is defined and not snort_send_stats %} 26 | DEBIAN_SNORT_SEND_STATS="false" 27 | {% endif %} 28 | DEBIAN_SNORT_STATS_RCPT="root" 29 | {% if snort_stats_threshold is defined %} 30 | DEBIAN_SNORT_STATS_THRESHOLD="{{ snort_stats_threshold }}" 31 | {% elif snort_stats_threshold is not defined %} 32 | DEBIAN_SNORT_STATS_THRESHOLD="1" 33 | {% endif %} 34 | -------------------------------------------------------------------------------- /tasks/config_snort.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: config_snort | configuring snort 3 | template: 4 | src: etc/snort/snort.conf.j2 5 | dest: /etc/snort/snort.conf 6 | owner: root 7 | group: root 8 | mode: 0644 9 | become: true 10 | notify: restart snort 11 | when: ansible_os_family == "Debian" 12 | 13 | - name: config_snort | configuring snort 14 | template: 15 | src: etc/snort/snort.conf.j2 16 | dest: /etc/snort/snort.conf 17 | owner: root 18 | group: root 19 | mode: 0644 20 | become: true 21 | notify: restart snortd 22 | when: ansible_os_family == "RedHat" 23 | 24 | - name: config_snort | configuring snort 25 | template: 26 | src: etc/sysconfig/snort.j2 27 | dest: /etc/sysconfig/snort 28 | owner: root 29 | group: root 30 | mode: 0644 31 | become: true 32 | notify: restart snortd 33 | when: ansible_os_family == "RedHat" 34 | 35 | - name: config_snort | downloading snort commmunity rules 36 | get_url: 37 | url: "{{ snort_community_rules_url }}/{{ snort_community_rules_package }}" 38 | dest: "/usr/local/src/{{ snort_community_rules_package }}" 39 | become: true 40 | when: ansible_os_family == "RedHat" 41 | 42 | - name: config_snort | extracting snort commmunity rules 43 | unarchive: 44 | src: "/usr/local/src/{{ snort_community_rules_package }}" 45 | dest: "{{ snort_rule_path }}" 46 | copy: false 47 | become: true 48 | when: ansible_os_family == "RedHat" 49 | -------------------------------------------------------------------------------- /tasks/redhat.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: redhat | installing pre-reqs 3 | package: 4 | name: "{{ snort_redhat_prereqs }}" 5 | state: present 6 | become: true 7 | 8 | - name: redhat | installing snort daq 9 | yum: 10 | name: "{{ snort_redhat_daq_package }}" 11 | state: present 12 | become: true 13 | when: ansible_distribution != "Fedora" 14 | 15 | - name: redhat | installing snort 16 | yum: 17 | name: "{{ snort_redhat_package }}" 18 | state: present 19 | become: true 20 | when: ansible_distribution != "Fedora" 21 | 22 | - name: redhat | installing snort daq 23 | dnf: 24 | name: "{{ snort_fedora_daq_package }}" 25 | state: present 26 | become: true 27 | when: ansible_distribution == "Fedora" 28 | 29 | - name: redhat | installing snort 30 | dnf: 31 | name: "{{ snort_fedora_package }}" 32 | state: present 33 | become: true 34 | when: ansible_distribution == "Fedora" 35 | 36 | - name: redhat | ensuring directory exists (/usr/local/lib/snort_dynamicrules) 37 | file: 38 | dest: /usr/local/lib/snort_dynamicrules 39 | state: directory 40 | owner: root 41 | group: root 42 | mode: 0755 43 | recurse: true 44 | become: true 45 | 46 | # Has Snort been packaged incorrectly? Shouldn't need to do this 47 | - name: redhat | ensuring libdnet.1 symlink exists 48 | file: 49 | dest: /usr/lib64/libdnet.1 50 | src: /usr/lib64/libdnet.so.1 51 | state: link 52 | become: true 53 | 54 | - name: redhat | ensuring snort is enabled 55 | service: 56 | name: snortd 57 | enabled: true 58 | become: true 59 | -------------------------------------------------------------------------------- /.yamllint.yml: -------------------------------------------------------------------------------- 1 | --- 2 | extends: default 3 | 4 | rules: 5 | braces: 6 | # Defaults 7 | # min-spaces-inside: 0 8 | # max-spaces-inside: 0 9 | 10 | # Keeping 0 min-spaces to not error on empty collection definitions 11 | min-spaces-inside: 0 12 | # Allowing one space inside braces to improve code readability 13 | max-spaces-inside: 1 14 | 15 | brackets: 16 | # Defaults 17 | # min-spaces-inside: 0 18 | # max-spaces-inside: 0 19 | 20 | # Keeping 0 min-spaces to not error on empty collection definitions 21 | min-spaces-inside: 0 22 | # Allowing one space inside braces to improve code readability 23 | max-spaces-inside: 1 24 | 25 | colons: 26 | # Defaults 27 | # max-spaces-before: 0 28 | # max-spaces-after: 1 29 | 30 | max-spaces-before: 0 31 | # Allowing more than one space for code readability 32 | max-spaces-after: -1 33 | 34 | comments: 35 | # Defaults 36 | # level: warning 37 | # require-starting-space: true 38 | # min-spaces-from-content: 2 39 | 40 | # Disabling to allow for code comment blocks and #!/usr/bin/ansible-playbook 41 | require-starting-space: false 42 | 43 | indentation: 44 | # Defaults 45 | # spaces: consistent 46 | # indent-sequences: true 47 | # check-multi-line-strings: false 48 | 49 | # Requiring 2 space indentation 50 | spaces: 2 51 | # Requiring consistent indentation within a file, either indented or not 52 | indent-sequences: consistent 53 | 54 | # Disabling due to copious amounts of long lines in the code which would 55 | # require a code style change to resolve 56 | line-length: disable 57 | 58 | truthy: disable 59 | -------------------------------------------------------------------------------- /tasks/debian.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: debian | updating apt-cache 3 | apt: 4 | update_cache: true 5 | cache_valid_time: 86400 6 | become: true 7 | 8 | - name: debian | Installing iproute 9 | apt: 10 | name: iproute 11 | state: present 12 | become: true 13 | register: result 14 | until: result is successful 15 | when: > 16 | (ansible_distribution == "Ubuntu" and 17 | ansible_distribution_major_version < "18") or 18 | (ansible_distribution == "Debian" and 19 | ansible_distribution_major_version < "10") 20 | 21 | - name: debian | Installing iproute2 22 | apt: 23 | name: iproute2 24 | state: present 25 | become: true 26 | register: result 27 | until: result is successful 28 | when: > 29 | (ansible_distribution == "Ubuntu" and 30 | ansible_distribution_major_version >= "18") or 31 | (ansible_distribution == "Debian" and 32 | ansible_distribution_major_version >= "10") 33 | 34 | - name: debian | installing pre-reqs 35 | apt: 36 | name: "{{ snort_debian_pre_reqs }}" 37 | state: present 38 | become: true 39 | register: result 40 | until: result is successful 41 | 42 | - name: debian | installing snort 43 | apt: 44 | name: ["oinkmaster", "snort"] 45 | state: present 46 | environment: 47 | RUNLEVEL: 1 48 | become: true 49 | # We need to skip errors as Snort tries to start and is not configured yet 50 | ignore_errors: true 51 | register: result 52 | until: result is successful 53 | 54 | - name: debian | configuring snort daemon 55 | template: 56 | src: etc/snort/snort.debian.conf.j2 57 | dest: /etc/snort/snort.debian.conf 58 | owner: root 59 | group: root 60 | mode: 0600 61 | become: true 62 | notify: restart snort 63 | 64 | - name: debian | ensuring directory exists (/usr/lib/snort_dynamicrules) 65 | file: 66 | dest: /usr/lib/snort_dynamicrules 67 | state: directory 68 | owner: root 69 | group: root 70 | mode: 0755 71 | recurse: yes 72 | become: true 73 | when: > 74 | ansible_distribution_release == "precise" or 75 | ansible_distribution_release == "wheezy" 76 | -------------------------------------------------------------------------------- /tasks/config_oinkmaster.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: config_oinkmaster | configuring oinkmaster 3 | template: 4 | src: etc/oinkmaster.conf.j2 5 | dest: /etc/oinkmaster.conf 6 | owner: root 7 | group: root 8 | mode: 0644 9 | become: true 10 | when: ansible_os_family == "Debian" 11 | 12 | - name: config_oinkmaster | configuring oinkmaster cron job 13 | cron: 14 | name: oinkmaster rules update 15 | special_time: daily 16 | user: root 17 | job: "/usr/sbin/oinkmaster -C /etc/oinkmaster.conf -o {{ snort_rule_path }}" 18 | cron_file: oinkmaster_rule_updates 19 | become: true 20 | when: ansible_os_family == "Debian" 21 | 22 | - name: config_oinkmaster | downloading oinkmaster package 23 | get_url: 24 | url: "{{ snort_oinkmaster_dl_url }}/{{ snort_oinkmaster_dl_package }}" 25 | dest: "/usr/local/src/{{ snort_oinkmaster_dl_package }}" 26 | become: true 27 | when: ansible_os_family == "RedHat" 28 | 29 | - name: config_oinkmaster | extracting oinkmaster package 30 | unarchive: 31 | src: "/usr/local/src/{{ snort_oinkmaster_dl_package }}" 32 | dest: /etc/ 33 | copy: false 34 | creates: /etc/oinkmaster-2.0/oinkmaster.pl 35 | become: true 36 | when: ansible_os_family == "RedHat" 37 | 38 | - name: config_oinkmaster | creating symlink for oinkmaster 39 | file: 40 | src: /etc/oinkmaster-2.0 41 | dest: /etc/oinkmaster 42 | state: link 43 | become: true 44 | when: ansible_os_family == "RedHat" 45 | 46 | - name: config_oinkmaster | configuring oinkmaster 47 | template: 48 | src: etc/oinkmaster.conf.j2 49 | dest: /etc/oinkmaster/oinkmaster.conf 50 | owner: root 51 | group: root 52 | mode: 0644 53 | become: true 54 | when: ansible_os_family == "RedHat" 55 | 56 | - name: config_oinkmaster | configuring oinkmaster cron job 57 | cron: 58 | name: oinkmaster rules update 59 | special_time: daily 60 | user: root 61 | job: "/etc/oinkmaster/oinkmaster.pl -C /etc/oinkmaster/oinkmaster.conf -o {{ snort_rule_path }}" 62 | cron_file: oinkmaster_rule_updates 63 | become: true 64 | when: ansible_os_family == "RedHat" 65 | 66 | - name: config_oinkmaster | pulling initial rules 67 | command: "/etc/oinkmaster/oinkmaster.pl -C /etc/oinkmaster/oinkmaster.conf -o {{ snort_rule_path }}" 68 | # args: 69 | # creates: "{{ snort_rule_path }}/emerging.conf" 70 | become: true 71 | changed_when: false 72 | when: ansible_os_family == "RedHat" 73 | -------------------------------------------------------------------------------- /.travis.yml: -------------------------------------------------------------------------------- 1 | --- 2 | language: python 3 | python: "2.7" 4 | 5 | # Use the new container infrastructure 6 | sudo: required 7 | 8 | services: 9 | - docker 10 | 11 | env: 12 | - distribution: centos 13 | init: /usr/lib/systemd/systemd 14 | version: 7 15 | - distribution: fedora 16 | init: /usr/lib/systemd/systemd 17 | version: 29 18 | - distribution: fedora 19 | init: /usr/lib/systemd/systemd 20 | version: 28 21 | - distribution: fedora 22 | init: /usr/lib/systemd/systemd 23 | version: 27 24 | - distribution: fedora 25 | init: /usr/lib/systemd/systemd 26 | version: 26 27 | - distribution: fedora 28 | init: /usr/lib/systemd/systemd 29 | version: 25 30 | - distribution: fedora 31 | init: /usr/lib/systemd/systemd 32 | version: 24 33 | - distribution: ubuntu 34 | init: /lib/systemd/systemd 35 | version: bionic 36 | - distribution: ubuntu 37 | init: /lib/systemd/systemd 38 | version: xenial 39 | - distribution: ubuntu 40 | init: /sbin/init 41 | version: trusty 42 | - distribution: debian 43 | init: /lib/systemd/systemd 44 | version: stretch 45 | - distribution: debian 46 | init: /lib/systemd/systemd 47 | version: jessie 48 | 49 | before_install: 50 | - "sudo pip install yamllint" 51 | - yamllint -c .yamllint.yml . 52 | - "sudo docker pull ${distribution}:${version}" 53 | - "sudo docker build --no-cache --rm --file=tests/Dockerfile.${distribution}-${version} --tag=${distribution}-${version}:ansible tests" 54 | 55 | script: 56 | - container_id=$(mktemp) 57 | - role_name="ansible-snort" 58 | - 'sudo docker run --detach --privileged -v /sys/fs/cgroup:/sys/fs/cgroup:ro --volume="${PWD}":/etc/ansible/roles/${role_name}:ro ${distribution}-${version}:ansible ${init} > "${container_id}"' 59 | - 'sudo docker exec "$(cat ${container_id})" env ANSIBLE_FORCE_COLOR=1 ansible-lint -c /.ansible-lint /etc/ansible/roles/${role_name}/tests/test.yml' 60 | - 'sudo docker exec "$(cat ${container_id})" env ANSIBLE_FORCE_COLOR=1 ansible-playbook -v /etc/ansible/roles/${role_name}/tests/test.yml --syntax-check' 61 | - 'sudo docker exec "$(cat ${container_id})" env ANSIBLE_FORCE_COLOR=1 ansible-playbook -v /etc/ansible/roles/${role_name}/tests/test.yml' 62 | - > 63 | sudo docker exec "$(cat ${container_id})" env ANSIBLE_FORCE_COLOR=1 ansible-playbook -v /etc/ansible/roles/${role_name}/tests/test.yml 64 | | grep -q 'changed=0.*failed=0' 65 | && (echo 'Idempotence test: pass' && exit 0) 66 | || (echo 'Idempotence test: fail' && exit 1) 67 | - 'sudo docker rm -f "$(cat ${container_id})"' 68 | 69 | notifications: 70 | webhooks: https://galaxy.ansible.com/api/v1/notifications/ 71 | -------------------------------------------------------------------------------- /tasks/barnyard2.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: barnyard2 | installing pre-reqs 3 | apt: 4 | name: "{{ snort_barnyard2_debian_pre_reqs }}" 5 | state: present 6 | become: true 7 | register: result 8 | until: result is successful 9 | when: ansible_os_family == "Debian" 10 | 11 | - name: barnyard2 | installing add'l pre-reqs 12 | apt: 13 | name: libmariadbclient-dev 14 | state: present 15 | become: true 16 | register: result 17 | until: result is successful 18 | when: snort_barnyard2_db_type == "mariadb" 19 | 20 | - name: barnyard2 | installing add'l pre-reqs 21 | apt: 22 | name: libmysqlclient-dev 23 | state: present 24 | become: true 25 | register: result 26 | until: result is successful 27 | when: snort_barnyard2_db_type == "mysql" 28 | 29 | - name: barnyard2 | ensuring snort_src_dir exists 30 | file: 31 | path: "{{ snort_src_dir }}" 32 | state: directory 33 | become: true 34 | 35 | - name: barnyard2 | downloading snort daq 36 | get_url: 37 | url: "https://snort.org/downloads/snort/daq-{{ snort_daq_version }}.tar.gz" 38 | dest: "{{ snort_src_dir }}/daq-{{ snort_daq_version }}.tar.gz" 39 | become: true 40 | 41 | - name: barnyard2 | extracting snort daq 42 | unarchive: 43 | src: "{{ snort_src_dir }}/daq-{{ snort_daq_version }}.tar.gz" 44 | dest: "{{ snort_src_dir }}" 45 | creates: "{{ snort_src_dir }}/daq-{{ snort_daq_version }}/configure" 46 | copy: false 47 | become: true 48 | 49 | - name: barnyard2 | building snort daq 50 | command: "{{ item }}" 51 | args: 52 | chdir: "{{ snort_src_dir }}/daq-{{ snort_daq_version }}" 53 | creates: /usr/local/lib/daq/daq_pcap.so 54 | become: true 55 | with_items: 56 | - ./configure 57 | - make 58 | - make install 59 | 60 | - name: barnyard2 | cloning barnyard2 repo 61 | git: 62 | repo: https://github.com/firnsy/barnyard2 63 | dest: "{{ snort_src_dir }}/barnyard2" 64 | update: false 65 | become: true 66 | 67 | - name: barnyard2 | building barnyard2 68 | command: "{{ item }}" 69 | args: 70 | chdir: "{{ snort_src_dir }}/barnyard2" 71 | creates: /usr/local/bin/barnyard2 72 | with_items: 73 | - ./autogen.sh 74 | - ./configure --with-mysql --with-mysql-libraries=/usr/lib/ 75 | - ln -s /usr/include/dumbnet.h /usr/include/dnet.h 76 | - ldconfig 77 | - make 78 | - make install 79 | become: true 80 | when: snort_barnyard2_db_type == "mariadb" 81 | 82 | - name: barnyard2 | building barnyard2 83 | command: "{{ item }}" 84 | args: 85 | chdir: "{{ snort_src_dir }}/barnyard2" 86 | creates: /usr/local/bin/barnyard2 87 | with_items: 88 | - ./autogen.sh 89 | - ./configure --with-mysql --with-mysql-libraries=/usr/lib/{{ ansible_machine }}-linux-gnu/ 90 | - ln -s /usr/include/dumbnet.h /usr/include/dnet.h 91 | - ldconfig 92 | - make 93 | - make install 94 | become: true 95 | when: snort_barnyard2_db_type == "mysql" 96 | 97 | - name: barnyard2 | configuring barnyard2 98 | template: 99 | src: etc/snort/barnyard2.conf.j2 100 | dest: /etc/snort/barnyard2.conf 101 | owner: root 102 | group: root 103 | mode: 0644 104 | become: true 105 | 106 | - name: barnyard2 | ensuring /var/log/barnyard2 directory exists 107 | file: 108 | path: /var/log/barnyard2 109 | state: directory 110 | become: true 111 | 112 | - name: barnyard2 | checking if barnyard2 waldo file exists 113 | stat: 114 | path: "{{ snort_barnyard2_waldo_file }}" 115 | register: barnyard2_waldo_file 116 | 117 | - name: barnyard2 | creating barnyard2_waldo_file 118 | file: 119 | path: "{{ snort_barnyard2_waldo_file }}" 120 | state: touch 121 | owner: snort 122 | group: snort 123 | become: true 124 | when: not barnyard2_waldo_file.stat.exists 125 | 126 | - name: barnyard2 | creating snort sid-msg.map 127 | shell: ./create-sidmap.pl /etc/snort/rules > /etc/snort/sid-msg.map 128 | ignore_errors: true 129 | become: true 130 | args: 131 | chdir: /usr/share/oinkmaster/ 132 | creates: /etc/snort/sid-msg.map 133 | 134 | - name: barnyard2 | copying MySQL schema 135 | copy: 136 | src: create_mysql 137 | dest: /tmp/create_mysql 138 | become: true 139 | 140 | - name: barnyard2 | creating MySQL DBs 141 | mysql_db: 142 | name: "{{ item }}" 143 | state: present 144 | become: true 145 | with_items: 146 | - archive 147 | - snort 148 | 149 | - name: barnyard2 | setting MySQL DB permissions 150 | mysql_user: 151 | user: "{{ snort_barnyard2_db_info.user }}" 152 | password: "{{ snort_barnyard2_db_info.pass }}" 153 | priv: "{{ item }}.*:USAGE/{{ item }}.*:ALL" 154 | become: true 155 | with_items: 156 | - archive 157 | - snort 158 | 159 | - name: barnyard2 | checking if MySQL DB schema imported 160 | stat: 161 | path: /var/log/.db_schema_imported 162 | register: db_schema_imported 163 | 164 | - name: barnyard2 | importing MySQL DB Schema 165 | mysql_db: 166 | name: snort 167 | state: import 168 | target: /tmp/create_mysql 169 | become: true 170 | register: db_schema_import 171 | when: not db_schema_imported.stat.exists 172 | 173 | - name: barnyard2 | marking MySQL DB schema as imported 174 | file: 175 | path: /var/log/.db_schema_imported 176 | state: touch 177 | become: true 178 | when: db_schema_import.changed 179 | 180 | - name: barnyard2 | creating barnyard2 service 181 | template: 182 | src: lib/systemd/system/barnyard2.service.j2 183 | dest: /lib/systemd/system/barnyard2.service 184 | owner: root 185 | group: root 186 | mode: u=rw,g=r,o=r 187 | become: true 188 | when: ansible_service_mgr == "systemd" 189 | 190 | - name: barnyard2 | creating barnyard2 service 191 | template: 192 | src: etc/init.d/barnyard2.j2 193 | dest: /etc/init.d/barnyard2 194 | owner: root 195 | group: root 196 | mode: 0700 197 | become: true 198 | when: ansible_service_mgr == "SysV" 199 | 200 | - name: barnyard2 | starting and enabling barnyard2 service 201 | service: 202 | name: barnyard2 203 | state: started 204 | enabled: true 205 | become: true 206 | -------------------------------------------------------------------------------- /files/create_mysql: -------------------------------------------------------------------------------- 1 | # Copyright (C) 2000-2002 Carnegie Mellon University 2 | # 3 | # Maintainer: Roman Danyliw , 4 | # 5 | # Original Author(s): Jed Pickel (2000-2001) 6 | # Roman Danyliw 7 | # Todd Schrubb 8 | # 9 | # This program is free software; you can redistribute it and/or modify 10 | # it under the terms of the GNU General Public License Version 2 as 11 | # published by the Free Software Foundation. You may not use, modify or 12 | # distribute this program under any other version of the GNU General 13 | # Public License. 14 | # 15 | # This program is distributed in the hope that it will be useful, 16 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 17 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18 | # GNU General Public License for more details. 19 | # 20 | # You should have received a copy of the GNU General Public License 21 | # along with this program; if not, write to the Free Software 22 | # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. 23 | 24 | CREATE TABLE `schema` ( vseq INT UNSIGNED NOT NULL, 25 | ctime DATETIME NOT NULL, 26 | PRIMARY KEY (vseq)); 27 | INSERT INTO `schema` (vseq, ctime) VALUES ('107', now()); 28 | 29 | CREATE TABLE event ( sid INT UNSIGNED NOT NULL, 30 | cid INT UNSIGNED NOT NULL, 31 | signature INT UNSIGNED NOT NULL, 32 | timestamp DATETIME NOT NULL, 33 | PRIMARY KEY (sid,cid), 34 | INDEX sig (signature), 35 | INDEX time (timestamp)); 36 | 37 | CREATE TABLE signature ( sig_id INT UNSIGNED NOT NULL AUTO_INCREMENT, 38 | sig_name VARCHAR(255) NOT NULL, 39 | sig_class_id INT UNSIGNED NOT NULL, 40 | sig_priority INT UNSIGNED, 41 | sig_rev INT UNSIGNED, 42 | sig_sid INT UNSIGNED, 43 | sig_gid INT UNSIGNED, 44 | PRIMARY KEY (sig_id), 45 | INDEX sign_idx (sig_name(20)), 46 | INDEX sig_class_id_idx (sig_class_id)); 47 | 48 | CREATE TABLE sig_reference (sig_id INT UNSIGNED NOT NULL, 49 | ref_seq INT UNSIGNED NOT NULL, 50 | ref_id INT UNSIGNED NOT NULL, 51 | PRIMARY KEY(sig_id, ref_seq)); 52 | 53 | CREATE TABLE reference ( ref_id INT UNSIGNED NOT NULL AUTO_INCREMENT, 54 | ref_system_id INT UNSIGNED NOT NULL, 55 | ref_tag TEXT NOT NULL, 56 | PRIMARY KEY (ref_id)); 57 | 58 | CREATE TABLE reference_system ( ref_system_id INT UNSIGNED NOT NULL AUTO_INCREMENT, 59 | ref_system_name VARCHAR(20), 60 | PRIMARY KEY (ref_system_id)); 61 | 62 | CREATE TABLE sig_class ( sig_class_id INT UNSIGNED NOT NULL AUTO_INCREMENT, 63 | sig_class_name VARCHAR(60) NOT NULL, 64 | PRIMARY KEY (sig_class_id), 65 | INDEX (sig_class_id), 66 | INDEX (sig_class_name)); 67 | 68 | # store info about the sensor supplying data 69 | CREATE TABLE sensor ( sid INT UNSIGNED NOT NULL AUTO_INCREMENT, 70 | hostname TEXT, 71 | interface TEXT, 72 | filter TEXT, 73 | detail TINYINT, 74 | encoding TINYINT, 75 | last_cid INT UNSIGNED NOT NULL, 76 | PRIMARY KEY (sid)); 77 | 78 | # All of the fields of an ip header 79 | CREATE TABLE iphdr ( sid INT UNSIGNED NOT NULL, 80 | cid INT UNSIGNED NOT NULL, 81 | ip_src INT UNSIGNED NOT NULL, 82 | ip_dst INT UNSIGNED NOT NULL, 83 | ip_ver TINYINT UNSIGNED, 84 | ip_hlen TINYINT UNSIGNED, 85 | ip_tos TINYINT UNSIGNED, 86 | ip_len SMALLINT UNSIGNED, 87 | ip_id SMALLINT UNSIGNED, 88 | ip_flags TINYINT UNSIGNED, 89 | ip_off SMALLINT UNSIGNED, 90 | ip_ttl TINYINT UNSIGNED, 91 | ip_proto TINYINT UNSIGNED NOT NULL, 92 | ip_csum SMALLINT UNSIGNED, 93 | PRIMARY KEY (sid,cid), 94 | INDEX ip_src (ip_src), 95 | INDEX ip_dst (ip_dst)); 96 | 97 | # All of the fields of a tcp header 98 | CREATE TABLE tcphdr( sid INT UNSIGNED NOT NULL, 99 | cid INT UNSIGNED NOT NULL, 100 | tcp_sport SMALLINT UNSIGNED NOT NULL, 101 | tcp_dport SMALLINT UNSIGNED NOT NULL, 102 | tcp_seq INT UNSIGNED, 103 | tcp_ack INT UNSIGNED, 104 | tcp_off TINYINT UNSIGNED, 105 | tcp_res TINYINT UNSIGNED, 106 | tcp_flags TINYINT UNSIGNED NOT NULL, 107 | tcp_win SMALLINT UNSIGNED, 108 | tcp_csum SMALLINT UNSIGNED, 109 | tcp_urp SMALLINT UNSIGNED, 110 | PRIMARY KEY (sid,cid), 111 | INDEX tcp_sport (tcp_sport), 112 | INDEX tcp_dport (tcp_dport), 113 | INDEX tcp_flags (tcp_flags)); 114 | 115 | # All of the fields of a udp header 116 | CREATE TABLE udphdr( sid INT UNSIGNED NOT NULL, 117 | cid INT UNSIGNED NOT NULL, 118 | udp_sport SMALLINT UNSIGNED NOT NULL, 119 | udp_dport SMALLINT UNSIGNED NOT NULL, 120 | udp_len SMALLINT UNSIGNED, 121 | udp_csum SMALLINT UNSIGNED, 122 | PRIMARY KEY (sid,cid), 123 | INDEX udp_sport (udp_sport), 124 | INDEX udp_dport (udp_dport)); 125 | 126 | # All of the fields of an icmp header 127 | CREATE TABLE icmphdr( sid INT UNSIGNED NOT NULL, 128 | cid INT UNSIGNED NOT NULL, 129 | icmp_type TINYINT UNSIGNED NOT NULL, 130 | icmp_code TINYINT UNSIGNED NOT NULL, 131 | icmp_csum SMALLINT UNSIGNED, 132 | icmp_id SMALLINT UNSIGNED, 133 | icmp_seq SMALLINT UNSIGNED, 134 | PRIMARY KEY (sid,cid), 135 | INDEX icmp_type (icmp_type)); 136 | 137 | # Protocol options 138 | CREATE TABLE opt ( sid INT UNSIGNED NOT NULL, 139 | cid INT UNSIGNED NOT NULL, 140 | optid INT UNSIGNED NOT NULL, 141 | opt_proto TINYINT UNSIGNED NOT NULL, 142 | opt_code TINYINT UNSIGNED NOT NULL, 143 | opt_len SMALLINT, 144 | opt_data TEXT, 145 | PRIMARY KEY (sid,cid,optid)); 146 | 147 | # Packet payload 148 | CREATE TABLE data ( sid INT UNSIGNED NOT NULL, 149 | cid INT UNSIGNED NOT NULL, 150 | data_payload TEXT, 151 | PRIMARY KEY (sid,cid)); 152 | 153 | # encoding is a lookup table for storing encoding types 154 | CREATE TABLE encoding(encoding_type TINYINT UNSIGNED NOT NULL, 155 | encoding_text TEXT NOT NULL, 156 | PRIMARY KEY (encoding_type)); 157 | INSERT INTO encoding (encoding_type, encoding_text) VALUES (0, 'hex'); 158 | INSERT INTO encoding (encoding_type, encoding_text) VALUES (1, 'base64'); 159 | INSERT INTO encoding (encoding_type, encoding_text) VALUES (2, 'ascii'); 160 | 161 | # detail is a lookup table for storing different detail levels 162 | CREATE TABLE detail (detail_type TINYINT UNSIGNED NOT NULL, 163 | detail_text TEXT NOT NULL, 164 | PRIMARY KEY (detail_type)); 165 | INSERT INTO detail (detail_type, detail_text) VALUES (0, 'fast'); 166 | INSERT INTO detail (detail_type, detail_text) VALUES (1, 'full'); 167 | 168 | # be sure to also use the snortdb-extra tables if you want 169 | # mappings for tcp flags, protocols, and ports 170 | -------------------------------------------------------------------------------- /defaults/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # defaults file for ansible-snort 3 | snort_barnyard2_db_info: 4 | # DB host 5 | host: localhost 6 | # DB name 7 | name: snort 8 | # DB password 9 | pass: snort 10 | # DB user 11 | user: snort 12 | 13 | # Defines the DB type...options are mysql or mariadb 14 | snort_barnyard2_db_type: mysql 15 | 16 | snort_barnyard2_debian_pre_reqs: 17 | - autoconf 18 | - bison 19 | - flex 20 | - git 21 | - libdumbnet-dev 22 | - libpcap-dev 23 | - libpcre3-dev 24 | - libtool 25 | - mysql-client 26 | 27 | # Defines if barnyard2 should be installed and configured 28 | snort_barnyard2_enable: false 29 | 30 | snort_barnyard2_logdir: /var/log/snort 31 | snort_barnyard2_waldo_file: "{{ snort_barnyard2_logdir }}/barnyard2.waldo" 32 | snort_community_rules_package: community-rules.tar.gz 33 | snort_community_rules_url: https://snort.org/downloads/community 34 | 35 | # Defines if oinkmaster should be configured 36 | snort_config_oinkmaster: true 37 | 38 | # Defines if snort should be configured 39 | snort_config_snort: true 40 | 41 | snort_blacklist_path: /etc/snort/rules 42 | snort_daq_version: 2.0.6 43 | 44 | snort_debian_pre_reqs: 45 | - build-essential 46 | - ethtool 47 | - flex 48 | - libpcap-dev 49 | - libpcre3-dev 50 | - libdumbnet-dev 51 | - zlib1g-dev 52 | 53 | # These rules are installed by default on Debian 54 | snort_debian_rules: 55 | - local.rules 56 | #- app-detect.rules 57 | - attack-responses.rules 58 | - backdoor.rules 59 | - bad-traffic.rules 60 | #- blacklist.rules 61 | #- botnet-cnc.rules 62 | #- browser-chrome.rules 63 | #- browser-firefox.rules 64 | #- browser-ie.rules 65 | #- browser-other.rules 66 | #- browser-plugins.rules 67 | #- browser-webkit.rules 68 | - chat.rules 69 | - community-sql-injection.rules 70 | - community-web-client.rules 71 | - community-web-dos.rules 72 | - community-web-iis.rules 73 | - community-web-misc.rules 74 | - community-web-php.rules 75 | - community-sql-injection.rules 76 | - community-web-client.rules 77 | - community-web-dos.rules 78 | - community-web-iis.rules 79 | - community-web-misc.rules 80 | - community-web-php.rules 81 | #- content-replace.rules 82 | - ddos.rules 83 | - dns.rules 84 | - dos.rules 85 | - experimental.rules 86 | #- exploit-kit.rules 87 | - exploit.rules 88 | #- file-executable.rules 89 | #- file-flash.rules 90 | #- file-identify.rules 91 | #- file-image.rules 92 | #- file-java.rules 93 | #- file-multimedia.rules 94 | #- file-office.rules 95 | #- file-other.rules 96 | #- file-pdf.rules 97 | - finger.rules 98 | - ftp.rules 99 | - icmp-info.rules 100 | - icmp.rules 101 | - imap.rules 102 | #- indicator-compromise.rules 103 | #- indicator-obfuscation.rules 104 | #- indicator-scan.rules 105 | #- indicator-shellcode.rules 106 | - info.rules 107 | #- malware-backdoor.rules 108 | #- malware-cnc.rules 109 | #- malware-other.rules 110 | #- malware-tools.rules 111 | - misc.rules 112 | - multimedia.rules 113 | - mysql.rules 114 | - netbios.rules 115 | - nntp.rules 116 | - oracle.rules 117 | #- os-linux.rules 118 | #- os-mobile.rules 119 | #- os-other.rules 120 | #- os-solaris.rules 121 | #- os-windows.rules 122 | - other-ids.rules 123 | - p2p.rules 124 | #- phishing-spam.rules 125 | #- policy-multimedia.rules 126 | #- policy-other.rules 127 | - policy.rules 128 | #- policy-social.rules 129 | #- policy-spam.rules 130 | - pop2.rules 131 | - pop3.rules 132 | #- protocol-dns.rules 133 | #- protocol-finger.rules 134 | #- protocol-ftp.rules 135 | #- protocol-icmp.rules 136 | #- protocol-imap.rules 137 | #- protocol-nntp.rules 138 | #- protocol-pop.rules 139 | #- protocol-rpc.rules 140 | #- protocol-scada.rules 141 | #- protocol-services.rules 142 | #- protocol-snmp.rules 143 | #- protocol-telnet.rules 144 | #- protocol-tftp.rules 145 | #- protocol-voip.rules 146 | #- pua-adware.rules 147 | #- pua-other.rules 148 | #- pua-p2p.rules 149 | #- pua-toolbars.rules 150 | - rpc.rules 151 | - rservices.rules 152 | #- scada.rules 153 | - scan.rules 154 | #- server-apache.rules 155 | #- server-iis.rules 156 | #- server-mail.rules 157 | #- server-mssql.rules 158 | #- server-mysql.rules 159 | #- server-oracle.rules 160 | #- server-other.rules 161 | #- server-samba.rules 162 | #- server-webapp.rules 163 | #- shellcode.rules 164 | - smtp.rules 165 | - snmp.rules 166 | #- specific-threats.rules 167 | #- spyware-put.rules 168 | - sql.rules 169 | - telnet.rules 170 | - tftp.rules 171 | - virus.rules 172 | #- voip.rules 173 | #- web-activex.rules 174 | - web-attacks.rules 175 | - web-cgi.rules 176 | - web-client.rules 177 | - web-coldfusion.rules 178 | - web-frontpage.rules 179 | - web-iis.rules 180 | - web-misc.rules 181 | - web-php.rules 182 | - x11.rules 183 | 184 | snort_dynamic_library_rules: 185 | [] 186 | #- bad-traffic.rules 187 | #- chat.rules 188 | #- dos.rules 189 | #- exploit.rules 190 | #- icmp.rules 191 | #- imap.rules 192 | #- misc.rules 193 | #- multimedia.rules 194 | #- netbios.rules 195 | #- nntp.rules 196 | #- p2p.rules 197 | #- smtp.rules 198 | #- snmp.rules 199 | #- specific-threats.rules 200 | #- web-activex.rules 201 | #- web-client.rules 202 | #- web-iis.rules 203 | #- web-misc.rules 204 | 205 | # Define external networks..if snort_home_net is any then set this to any 206 | snort_external_net: "!$HOME_NET" 207 | 208 | snort_fedora_package: "https://www.snort.org/downloads/snort/snort-{{ snort_version }}-1.f29.x86_64.rpm" 209 | snort_fedora_daq_package: "https://www.snort.org/downloads/archive/snort/daq-{{ snort_daq_version }}-1.f21.x86_64.rpm" 210 | 211 | # Define your home_net..if snort_external_net is any then set this to any 212 | snort_home_net: 192.168.0.0/16 213 | 214 | # Defines snort interface to listen on 215 | snort_interface: "{{ ansible_default_ipv4.interface|default(ansible_interfaces|snort_interface) }}" 216 | 217 | snort_oinkmaster_dl_package: oinkmaster-2.0.tar.gz 218 | snort_oinkmaster_dl_url: http://prdownloads.sourceforge.net/oinkmaster 219 | snort_oinkmaster_rules_url: http://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz 220 | 221 | # Define additional snort options to pass to startup 222 | snort_options: "" 223 | 224 | # Defines if alerts should be sent to syslog 225 | snort_output_syslog: false 226 | 227 | snort_preproc_rule_path: /etc/snort/preproc_rules 228 | 229 | snort_preproc_rules: 230 | [] 231 | #- preprocessor.rules 232 | #- decoder.rules 233 | #- sensitive-data.rules 234 | 235 | snort_redhat_prereqs: 236 | # libpcap-devel 237 | - libdnet 238 | - libpcap-devel 239 | - perl 240 | - tcpdump 241 | - wget 242 | 243 | snort_redhat_daq_package: "https://www.snort.org/downloads/archive/snort/daq-{{ snort_daq_version }}-1.centos7.x86_64.rpm" 244 | snort_redhat_package: "https://www.snort.org/downloads/snort/snort-{{ snort_version }}-1.centos7.x86_64.rpm" 245 | 246 | # Defines rules downloaded from emerging threats using oinkmaster 247 | snort_redhat_rules: 248 | - community-rules/community.rules 249 | # - botcc.portgrouped.rules 250 | - botcc.rules 251 | # - ciarmy.rules 252 | - compromised.rules 253 | # - decoder-events.rules 254 | # - drop.rules 255 | - dshield.rules 256 | # - emerging-activex.rules 257 | # - emerging-attack_response.rules 258 | # - emerging-chat.rules 259 | # - emerging-current_events.rules 260 | # - emerging-deleted.rules 261 | # - emerging-dns.rules 262 | # - emerging-dos.rules 263 | # - emerging-exploit.rules 264 | # - emerging-ftp.rules 265 | # - emerging-games.rules 266 | # - emerging-icmp_info.rules 267 | # - emerging-icmp.rules 268 | # - emerging-imap.rules 269 | # - emerging-inappropriate.rules 270 | # - emerging-info.rules 271 | # - emerging-malware.rules 272 | # - emerging-misc.rules 273 | # - emerging-mobile_malware.rules 274 | # - emerging-netbios.rules 275 | # - emerging-p2p.rules 276 | # - emerging-policy.rules 277 | # - emerging-pop3.rules 278 | # - emerging-rpc.rules 279 | # - emerging-scada.rules 280 | # - emerging-scan.rules 281 | # - emerging-shellcode.rules 282 | # - emerging-smtp.rules 283 | # - emerging-snmp.rules 284 | # - emerging-sql.rules 285 | # - emerging-telnet.rules 286 | # - emerging-tftp.rules 287 | # - emerging-trojan.rules 288 | # - emerging-user_agents.rules 289 | # - emerging-voip.rules 290 | # - emerging-web_client.rules 291 | # - emerging-web_server.rules 292 | # - emerging-web_specific_apps.rules 293 | # - emerging-worm.rules 294 | # - files.rules 295 | # - http-events.rules 296 | # - rbn-malvertisers.rules 297 | # - rbn.rules 298 | # - smtp-events.rules 299 | # - stream-events.rules 300 | # - tls-events.rules 301 | # - tor.rules 302 | 303 | snort_rule_path: /etc/snort/rules 304 | snort_so_rule_path: /etc/snort/so_rules 305 | snort_send_stats: true 306 | 307 | # Defines where to download source packages to compile 308 | snort_src_dir: /opt/snort_src 309 | snort_startup: boot 310 | snort_stats_threshold: 1 311 | snort_version: 2.9.13 312 | snort_whitelist_path: /etc/snort/rules 313 | -------------------------------------------------------------------------------- /templates/etc/snort/snort.conf.j2: -------------------------------------------------------------------------------- 1 | {{ ansible_managed|comment }} 2 | 3 | ipvar HOME_NET {{ snort_home_net }} 4 | ipvar EXTERNAL_NET {{ snort_external_net }} 5 | ipvar DNS_SERVERS $HOME_NET 6 | ipvar SMTP_SERVERS $HOME_NET 7 | ipvar HTTP_SERVERS $HOME_NET 8 | ipvar SQL_SERVERS $HOME_NET 9 | ipvar TELNET_SERVERS $HOME_NET 10 | ipvar SSH_SERVERS $HOME_NET 11 | ipvar FTP_SERVERS $HOME_NET 12 | ipvar SIP_SERVERS $HOME_NET 13 | 14 | portvar HTTP_PORTS [36,80,81,82,83,84,85,86,87,88,89,90,311,383,555,591,593,631,801,808,818,901,972,1158,1220,1414,1533,1741,1830,2231,2301,2381,2809,3029,3037,3057,3128,3443,3702,4000,4343,4848,5117,5250,6080,6173,6988,7000,7001,7144,7145,7510,7770,7777,7779,8000,8008,8014,8028,8080,8081,8082,8085,8088,8090,8118,8123,8180,8181,8222,8243,8280,8300,8500,8509,8800,8888,8899,9000,9060,9080,9090,9091,9111,9443,9999,10000,11371,12601,15489,29991,33300,34412,34443,34444,41080,44449,50000,50002,51423,53331,55252,55555,56712] 15 | portvar SHELLCODE_PORTS !80 16 | portvar ORACLE_PORTS 1024: 17 | portvar SSH_PORTS 22 18 | portvar FTP_PORTS [21,2100,3535] 19 | portvar SIP_PORTS [5060,5061,5600] 20 | portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143] 21 | portvar GTP_PORTS [2123,2152,3386] 22 | 23 | ipvar AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] 24 | 25 | var RULE_PATH {{ snort_rule_path }} 26 | var SO_RULE_PATH {{ snort_so_rule_path }} 27 | var PREPROC_RULE_PATH {{ snort_preproc_rule_path }} 28 | var WHITE_LIST_PATH {{ snort_whitelist_path }} 29 | var BLACK_LIST_PATH {{ snort_blacklist_path }} 30 | 31 | config disable_decode_alerts 32 | config disable_tcpopt_experimental_alerts 33 | config disable_tcpopt_obsolete_alerts 34 | config disable_tcpopt_ttcp_alerts 35 | config disable_tcpopt_alerts 36 | config disable_ipopt_alerts 37 | config checksum_mode: all 38 | 39 | config pcre_match_limit: 3500 40 | config pcre_match_limit_recursion: 1500 41 | config detection: search-method ac-split search-optimize max-pattern-len 20 42 | config event_queue: max_queue 8 log 5 order_events content_length 43 | config paf_max: 16000 44 | 45 | {% if ansible_os_family == "Debian" %} 46 | dynamicpreprocessor directory /usr/lib/snort_dynamicpreprocessor/ 47 | {% elif ansible_os_family == "RedHat" %} 48 | dynamicpreprocessor directory /usr/lib64/snort-{{ snort_version }}_dynamicpreprocessor/ 49 | {% endif %} 50 | 51 | {% if ansible_os_family == "Debian" %} 52 | dynamicengine /usr/lib/snort_dynamicengine/libsf_engine.so 53 | {% elif ansible_os_family == "RedHat" %} 54 | dynamicengine /usr/lib64/snort-{{ snort_version }}_dynamicengine/libsf_engine.so 55 | {% endif %} 56 | 57 | {% if ansible_os_family == "Debian" %} 58 | dynamicdetection directory /usr/lib/snort_dynamicrules 59 | {% elif ansible_os_family == "RedHat" %} 60 | dynamicdetection directory /usr/local/lib/snort_dynamicrules 61 | {% endif %} 62 | 63 | preprocessor normalize_ip4 64 | preprocessor normalize_tcp: ips ecn stream 65 | preprocessor normalize_icmp4 66 | preprocessor normalize_ip6 67 | preprocessor normalize_icmp6 68 | preprocessor frag3_global: max_frags 65536 69 | preprocessor frag3_engine: policy windows detect_anomalies overlap_limit 10 min_fragment_length 100 timeout 180 70 | preprocessor stream5_global: track_tcp yes, \ 71 | track_udp yes, \ 72 | track_icmp no, \ 73 | max_tcp 262144, \ 74 | max_udp 131072, \ 75 | max_active_responses 2, \ 76 | min_response_seconds 5 77 | preprocessor stream5_tcp: policy windows, detect_anomalies, require_3whs 180, \ 78 | overlap_limit 10, small_segments 3 bytes 150, timeout 180, \ 79 | ports client 21 22 23 25 42 53 70 79 109 110 111 113 119 135 136 137 139 143 \ 80 | 161 445 513 514 587 593 691 1433 1521 1741 2100 3306 6070 6665 6666 6667 6668 6669 \ 81 | 7000 8181 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779, \ 82 | ports both 36 80 81 82 83 84 85 86 87 88 89 90 110 311 383 443 465 563 555 591 593 631 636 801 808 818 901 972 989 992 993 994 995 1158 1220 1414 1533 1741 1830 2231 2301 2381 2809 3029 3037 3057 3128 3443 3702 4000 4343 4848 5117 5250 6080 6173 6988 7907 7000 7001 7144 7145 7510 7802 7770 7777 7779 \ 83 | 7801 7900 7901 7902 7903 7904 7905 7906 7908 7909 7910 7911 7912 7913 7914 7915 7916 \ 84 | 7917 7918 7919 7920 8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 8123 8180 8181 8222 8243 8280 8300 8500 8509 8800 8888 8899 9000 9060 9080 9090 9091 9111 9443 9999 10000 11371 12601 15489 29991 33300 34412 34443 34444 41080 44449 50000 50002 51423 53331 55252 55555 56712 85 | preprocessor stream5_udp: timeout 180 86 | preprocessor http_inspect: global iis_unicode_map unicode.map 1252 compress_depth 65535 decompress_depth 65535 max_gzip_mem 104857600 87 | preprocessor http_inspect_server: server default \ 88 | http_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA RPC_ECHO_DATA } \ 89 | chunk_length 500000 \ 90 | server_flow_depth 0 \ 91 | client_flow_depth 0 \ 92 | post_depth 65495 \ 93 | oversize_dir_length 500 \ 94 | max_header_length 750 \ 95 | max_headers 100 \ 96 | max_spaces 200 \ 97 | small_chunk_length { 10 5 } \ 98 | ports { 36 80 81 82 83 84 85 86 87 88 89 90 311 383 555 591 593 631 801 808 818 901 972 1158 1220 1414 1741 1830 2231 2301 2381 2809 3029 3037 3057 3128 3443 3702 4000 4343 4848 5117 5250 6080 6173 6988 7000 7001 7144 7145 7510 7770 7777 7779 8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 8123 8180 8181 8222 8243 8280 8300 8500 8509 8800 8888 8899 9000 9060 9080 9090 9091 9111 9443 9999 10000 11371 12601 15489 29991 33300 34412 34443 34444 41080 44449 50000 50002 51423 53331 55252 55555 56712 } \ 99 | non_rfc_char { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 } \ 100 | enable_cookie \ 101 | extended_response_inspection \ 102 | inspect_gzip \ 103 | normalize_utf \ 104 | unlimited_decompress \ 105 | normalize_javascript \ 106 | apache_whitespace no \ 107 | ascii no \ 108 | bare_byte no \ 109 | directory no \ 110 | double_decode no \ 111 | iis_backslash no \ 112 | iis_delimiter no \ 113 | iis_unicode no \ 114 | multi_slash no \ 115 | utf_8 no \ 116 | u_encode yes \ 117 | webroot no 118 | 119 | preprocessor rpc_decode: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779 no_alert_multiple_requests no_alert_large_fragments no_alert_incomplete 120 | preprocessor bo 121 | preprocessor ftp_telnet: global inspection_type stateful encrypted_traffic no check_encrypted 122 | preprocessor ftp_telnet_protocol: telnet \ 123 | ayt_attack_thresh 20 \ 124 | normalize ports { 23 } \ 125 | detect_anomalies 126 | preprocessor ftp_telnet_protocol: ftp server default \ 127 | def_max_param_len 100 \ 128 | ports { 21 2100 3535 } \ 129 | telnet_cmds yes \ 130 | ignore_telnet_erase_cmds yes \ 131 | ftp_cmds { ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP } \ 132 | ftp_cmds { CEL CLNT CMD CONF CWD DELE ENC EPRT } \ 133 | ftp_cmds { EPSV ESTA ESTP FEAT HELP LANG LIST LPRT } \ 134 | ftp_cmds { LPSV MACB MAIL MDTM MIC MKD MLSD MLST } \ 135 | ftp_cmds { MODE NLST NOOP OPTS PASS PASV PBSZ PORT } \ 136 | ftp_cmds { PROT PWD QUIT REIN REST RETR RMD RNFR } \ 137 | ftp_cmds { RNTO SDUP SITE SIZE SMNT STAT STOR STOU } \ 138 | ftp_cmds { STRU SYST TEST TYPE USER XCUP XCRC XCWD } \ 139 | ftp_cmds { XMAS XMD5 XMKD XPWD XRCP XRMD XRSQ XSEM } \ 140 | ftp_cmds { XSEN XSHA1 XSHA256 } \ 141 | alt_max_param_len 0 { ABOR CCC CDUP ESTA FEAT LPSV NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD } \ 142 | alt_max_param_len 200 { ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD } \ 143 | alt_max_param_len 256 { CWD RNTO } \ 144 | alt_max_param_len 400 { PORT } \ 145 | alt_max_param_len 512 { SIZE } \ 146 | chk_str_fmt { ACCT ADAT ALLO APPE AUTH CEL CLNT CMD } \ 147 | chk_str_fmt { CONF CWD DELE ENC EPRT EPSV ESTP HELP } \ 148 | chk_str_fmt { LANG LIST LPRT MACB MAIL MDTM MIC MKD } \ 149 | chk_str_fmt { MLSD MLST MODE NLST OPTS PASS PBSZ PORT } \ 150 | chk_str_fmt { PROT REST RETR RMD RNFR RNTO SDUP SITE } \ 151 | chk_str_fmt { SIZE SMNT STAT STOR STRU TEST TYPE USER } \ 152 | chk_str_fmt { XCRC XCWD XMAS XMD5 XMKD XRCP XRMD XRSQ } \ 153 | chk_str_fmt { XSEM XSEN XSHA1 XSHA256 } \ 154 | cmd_validity ALLO < int [ char R int ] > \ 155 | cmd_validity EPSV < [ { char 12 | char A char L char L } ] > \ 156 | cmd_validity MACB < string > \ 157 | cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \ 158 | cmd_validity MODE < char ASBCZ > \ 159 | cmd_validity PORT < host_port > \ 160 | cmd_validity PROT < char CSEP > \ 161 | cmd_validity STRU < char FRPO [ string ] > \ 162 | cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } > 163 | preprocessor ftp_telnet_protocol: ftp client default \ 164 | max_resp_len 256 \ 165 | bounce yes \ 166 | ignore_telnet_erase_cmds yes \ 167 | telnet_cmds yes 168 | preprocessor smtp: ports { 25 465 587 691 } \ 169 | inspection_type stateful \ 170 | b64_decode_depth 0 \ 171 | qp_decode_depth 0 \ 172 | bitenc_decode_depth 0 \ 173 | uu_decode_depth 0 \ 174 | log_mailfrom \ 175 | log_rcptto \ 176 | log_filename \ 177 | log_email_hdrs \ 178 | normalize cmds \ 179 | normalize_cmds { ATRN AUTH BDAT CHUNKING DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN EVFY } \ 180 | normalize_cmds { EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND SOML } \ 181 | normalize_cmds { STARTTLS TICK TIME TURN TURNME VERB VRFY X-ADAT X-DRCP X-ERCP X-EXCH50 } \ 182 | normalize_cmds { X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \ 183 | max_command_line_len 512 \ 184 | max_header_line_len 1000 \ 185 | max_response_line_len 512 \ 186 | alt_max_command_line_len 260 { MAIL } \ 187 | alt_max_command_line_len 300 { RCPT } \ 188 | alt_max_command_line_len 500 { HELP HELO ETRN EHLO } \ 189 | alt_max_command_line_len 255 { EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET } \ 190 | alt_max_command_line_len 246 { SEND SAML SOML AUTH TURN ETRN DATA RSET QUIT ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \ 191 | valid_cmds { ATRN AUTH BDAT CHUNKING DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN EVFY } \ 192 | valid_cmds { EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND SOML } \ 193 | valid_cmds { STARTTLS TICK TIME TURN TURNME VERB VRFY X-ADAT X-DRCP X-ERCP X-EXCH50 } \ 194 | valid_cmds { X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \ 195 | xlink2state { enabled } 196 | 197 | preprocessor ssh: server_ports { 22 } \ 198 | autodetect \ 199 | max_client_bytes 19600 \ 200 | max_encrypted_packets 20 \ 201 | max_server_version_len 100 \ 202 | enable_respoverflow enable_ssh1crc32 \ 203 | enable_srvoverflow enable_protomismatch 204 | 205 | preprocessor dcerpc2: memcap 102400, events [co ] 206 | preprocessor dcerpc2_server: default, policy WinXP, \ 207 | detect [smb [139,445], tcp 135, udp 135, rpc-over-http-server 593], \ 208 | autodetect [tcp 1025:, udp 1025:, rpc-over-http-server 1025:], \ 209 | smb_max_chain 3, smb_invalid_shares ["C$", "D$", "ADMIN$"] 210 | 211 | preprocessor dns: ports { 53 } enable_rdata_overflow 212 | preprocessor ssl: ports { 443 465 563 636 989 992 993 994 995 7801 7802 7900 7901 7902 7903 7904 7905 7906 7907 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 }, trustservers, noinspect_encrypted 213 | preprocessor sensitive_data: alert_threshold 25 214 | preprocessor sip: max_sessions 40000, \ 215 | ports { 5060 5061 5600 }, \ 216 | methods { invite \ 217 | cancel \ 218 | ack \ 219 | bye \ 220 | register \ 221 | options \ 222 | refer \ 223 | subscribe \ 224 | update \ 225 | join \ 226 | info \ 227 | message \ 228 | notify \ 229 | benotify \ 230 | do \ 231 | qauth \ 232 | sprack \ 233 | publish \ 234 | service \ 235 | unsubscribe \ 236 | prack }, \ 237 | max_uri_len 512, \ 238 | max_call_id_len 80, \ 239 | max_requestName_len 20, \ 240 | max_from_len 256, \ 241 | max_to_len 256, \ 242 | max_via_len 1024, \ 243 | max_contact_len 512, \ 244 | max_content_len 2048 245 | 246 | preprocessor imap: \ 247 | ports { 143 } \ 248 | b64_decode_depth 0 \ 249 | qp_decode_depth 0 \ 250 | bitenc_decode_depth 0 \ 251 | uu_decode_depth 0 252 | 253 | preprocessor pop: \ 254 | ports { 110 } \ 255 | b64_decode_depth 0 \ 256 | qp_decode_depth 0 \ 257 | bitenc_decode_depth 0 \ 258 | uu_decode_depth 0 259 | 260 | preprocessor modbus: ports { 502 } 261 | 262 | preprocessor dnp3: ports { 20000 } \ 263 | memcap 262144 \ 264 | check_crc 265 | 266 | {% if not snort_barnyard2_enable %} 267 | output unified2: filename snort.log, limit 128, nostamp, mpls_event_types, vlan_event_types 268 | {% elif snort_barnyard2_enable %} 269 | output unified2: filename snort.log, limit 128 270 | {% endif %} 271 | 272 | {% if snort_output_syslog %} 273 | output alert_syslog: LOG_AUTH LOG_ALERT 274 | {% endif %} 275 | 276 | include classification.config 277 | include reference.config 278 | 279 | {% if ansible_os_family == "Debian" %} 280 | {% for item in snort_debian_rules %} 281 | {% if item != "None" %} 282 | include $RULE_PATH/{{ item }} 283 | {% endif %} 284 | {% endfor %} 285 | {% elif ansible_os_family == "RedHat" %} 286 | {% for item in snort_redhat_rules %} 287 | {% if item != "None" %} 288 | include rules/{{ item }} 289 | {% endif %} 290 | {% endfor %} 291 | {% endif %} 292 | 293 | {% for item in snort_preproc_rules %} 294 | {% if item != "None" %} 295 | include $PREPROC_RULE_PATH/{{ item }} 296 | {% endif %} 297 | {% endfor %} 298 | 299 | {% for item in snort_dynamic_library_rules %} 300 | {% if item != "None" %} 301 | include $SO_RULE_PATH/{{ item }} 302 | {% endif %} 303 | {% endfor %} 304 | 305 | include threshold.conf 306 | --------------------------------------------------------------------------------