Last active
August 17, 2019 14:46
-
-
Save DaveA-W/e3e9e95a21d418e9c83a3a3a0731e3cc to your computer and use it in GitHub Desktop.
ITUS Shield v2 script to update snort.rules, adapted from v1.5 `fw_upgrade`
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Uncommented rules/*.rules files below are included as DROPs within your snort.rules | |
| # updaterules.sh extracts them selectively from https://rules.emergingthreats.net/open/snort-edge/emerging.rules.tar.gz | |
| # Emerging Threats FAQ https://doc.emergingthreats.net/bin/view/Main/EmergingFAQ | |
| # BotCC: Detect hosts communicating with a known and active Bot or Malware command and control server. | |
| rules/emerging-botcc.portgrouped.rules | |
| rules/emerging-botcc.rules | |
| # CIArmy: Subset of CINS Active Threat Intelligence rules, where an IP's 'Rogue Packet' score is poor or it has tripped a number of trusted alerts around the world. | |
| rules/emerging-ciarmy.rules | |
| # Compromised: Hosts compromised by bots, phishing sites, or spewing hostile traffic. These are not your everyday infected and sending a bit of spam hosts, these are significantly infected and hostile hosts. | |
| rules/emerging-compromised.rules | |
| # Current Events | |
| # Most often simple sigs for the Storm binary URL of the day, sigs to catch CLSIDs of newly found vulnerable apps where we don't have detail on the exploit. | |
| # Useful sigs but not for the long term until they have been properly tested. | |
| rules/emerging-current_events.rules | |
| # Don't Route or Peer (DROP): Daily updated list of the Spamhaus Don't Route or Peer list. Primarily known professional spammers. More info at http://www.spamhaus.org | |
| rules/emerging-drop.rules | |
| # Dshield: Daily updated list of the DShield top attackers list. Reliable. More info at http://www.dshield.org | |
| rules/emerging-dshield.rules | |
| # Exploits: Detect direct exploits including Windows exploits, Veritas, etc. | |
| rules/emerging-exploit.rules | |
| # Malware: Spyware and other things you don't want running on your network. URL hooks for known update schemes, User-Agent strings of known malware, and a load of other goodies. | |
| rules/emerging-malware.rules | |
| rules/emerging-mobile_malware.rules | |
| # Scan: Things to detect reconnaissance and probing. Nessus, Nikto, portscanning, etc. Early warning stuff. | |
| rules/emerging-scan.rules | |
| rules/emerging-trojan.rules | |
| rules/emerging-user_agents.rules | |
| # Web clients: Some SQL Injection, web server overflows, vulnerable web apps, that kind of thing. Very important if you're running web servers, and pretty reasonable load. | |
| rules/emerging-web_client.rules | |
| rules/emerging-worm.rules | |
| # Optionally uncomment others below, depending on what you're running on your network | |
| # Descriptions at https://doc.emergingthreats.net/bin/view/Main/EmergingFAQ#What_is_the_general_intent_of_ea | |
| # rules/emerging-activex.rules | |
| # rules/emerging-attack_response.rules | |
| # rules/emerging-chat.rules | |
| # rules/emerging-deleted.rules | |
| # rules/emerging-dns.rules | |
| # rules/emerging-dos.rules | |
| # rules/emerging-ftp.rules | |
| # rules/emerging-games.rules | |
| # rules/emerging-icmp.rules | |
| # rules/emerging-icmp_info.rules | |
| # rules/emerging-imap.rules | |
| # rules/emerging-inappropriate.rules | |
| # rules/emerging-info.rules | |
| # rules/emerging-misc.rules | |
| # rules/emerging-netbios.rules | |
| # rules/emerging-p2p.rules | |
| # rules/emerging-policy.rules | |
| # rules/emerging-pop3.rules | |
| # rules/emerging-rpc.rules | |
| # rules/emerging-scada.rules | |
| # rules/emerging-shellcode.rules | |
| # rules/emerging-smtp.rules | |
| # rules/emerging-snmp.rules | |
| # rules/emerging-sql.rules | |
| # rules/emerging-telnet.rules | |
| # rules/emerging-tftp.rules | |
| # rules/emerging-tor.rules | |
| # rules/emerging-voip.rules | |
| # rules/emerging-web_server.rules | |
| # rules/emerging-web_specific_apps.rules |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/sh | |
| # Wrapper to handle downloads | |
| download () { | |
| # try | |
| { | |
| local ruleset=$1 | |
| local url=$2 | |
| local followRedirect=$3 | |
| local timeout=$4 | |
| if [ -z "$timeout" ] ; then timeout=120 ; fi | |
| echo " " | |
| echo "Downloading $ruleset" | |
| echo " $url" | |
| if [ "$followRedirect" == "true" ] | |
| then | |
| curl -k -1 -m $timeout -o $ruleset -L $url | |
| else | |
| curl -k -1 -m $timeout -o $ruleset $url | |
| fi | |
| } || { | |
| echo "Unable to download rules '$1' from $2" | |
| echo "*error* $1" >> rule_counter.log | |
| return 1 | |
| } | |
| } | |
| # Ingests files conforming to a specified filespec, appending lines from each to alert.list | |
| ingest () { | |
| # try | |
| { | |
| for filename in $(ls $1) | |
| do | |
| # Extract rules to alert.tmp | |
| cat $filename | sed '/^\#/d' | sed '/^$/d' > alert.tmp && | |
| # Append to alert.list | |
| cat alert.tmp >> alert.list && | |
| # Output count to rule_counter.log | |
| local count=$(wc -l alert.tmp | awk '{print $1}') | |
| printf "%7d\t%s\n" $count "$filename" >> rule_counter.log | |
| done | |
| return 0 | |
| } || { | |
| echo "Unable to ingest rules '$1'" | |
| echo "*error* $1" >> rule_counter.log | |
| return 1 | |
| } | |
| } | |
| # Downloads and ingests rules from an url | |
| # (gzips will be unpacked, resultant $filenames spec should be provided as the last argument) | |
| downloadAndIngest() { | |
| local ruleset=$1 | |
| local url=$2 | |
| local followRedirect=$3 | |
| local filenames=$4 | |
| if [ -n "$url" ] | |
| then | |
| if [ -z "$filenames" ] ; then | |
| filenames=$ruleset | |
| fi | |
| download "$ruleset" "$url" $followRedirect && | |
| ( | |
| (file "$ruleset" | grep -q gzip && | |
| mv "$ruleset" "$ruleset.tar.gz" && | |
| tar -zxf "$ruleset.tar.gz") || | |
| touch "$ruleset" # null op - no unzip required | |
| ) && | |
| ingest "$filenames" && | |
| return 0 | |
| fi | |
| return 1 | |
| } | |
| # Prepare /tmp/snort/ and cumulative output files | |
| echo " " | |
| echo "Preparing working directory for rule download and ingestion" | |
| echo "/tmp/snort" | |
| if [ ! -d "/tmp/snort" ] ; then mkdir /tmp/snort ; else rm -rf /tmp/snort/* ; fi | |
| cd /tmp/snort | |
| touch alert.list | |
| touch ip.list | |
| # Prepare rule_counter.log | |
| echo "# Rules Set processed by etc/snort/updaterules.sh" > rule_counter.log | |
| echo "-------- -----------------------------------------" >> rule_counter.log | |
| # NOTE: Snort Community Rules ~1.7MB (`true` below flags that 302 redirects should be followed -> actual file is in an Amazon S3 bucket) | |
| downloadAndIngest community-rules https://www.snort.org/downloads/community/community-rules.tar.gz true community-rules/*.rules | |
| # SSL Blacklist: Bad SSL certificates identified by abuse.ch to be associated with malware or botnet activities in the past 30 days. | |
| downloadAndIngest abuse-sslbl.rules https://sslbl.abuse.ch/blacklist/sslipblacklist.rules | |
| # SSL Aggressive: Bad SSL certificates *ever* identified by abuse.ch to be associated with malware or botnet activities. | |
| # Since IP addresses can change, may contain false positives - comment out by default | |
| # downloadAndIngest abuse-dyre.rules https://sslbl.abuse.ch/blacklist/dyre_sslipblacklist_aggressive.rules | |
| # ZeuS servers: DISCONTINUED 2019-07 https://zeustracker.abuse.ch/byebye.php?download=snort | |
| # downloadAndIngest zeus.rules https://zeustracker.abuse.ch/blocklist.php?download=snort | |
| # Emerging Threats zip ~2.3MB https://doc.emergingthreats.net/bin/view/Main/EmergingFAQ | |
| download emerging-threats.tar.gz https://rules.emergingthreats.net/open/snort-edge/emerging.rules.tar.gz && | |
| ( | |
| # Extract emerging-threats.tar.gz, assumed it will unzip to folder "rules" | |
| echo " " | |
| # Look for pre-defined subset of rules to extract | |
| if [ -f "/etc/snort/rules/emerging-threats.rules" ]; then | |
| echo "Extracting subset listed in /etc/snort/rules/emerging-threats.rules" | |
| # Expect errors due to commented lines, so send error output to null | |
| tar -zxvf "emerging-threats.tar.gz" -T "/etc/snort/rules/emerging-threats.rules" 2>/dev/null | |
| # Also extract IP blacklist and sid-msg.map for later use | |
| tar -zxvf "emerging-threats.tar.gz" "rules/compromised-ips.txt" "rules/sid-msg.map" | |
| else # unzip the lot | |
| echo "Extracting:" | |
| tar -zxvf "emerging-threats.tar.gz" | |
| fi | |
| # Now ingest *.rules | |
| ingest "rules/*.rules" | |
| ) | |
| echo " " | |
| echo "Changing rules that only alert to drop instead" | |
| sed -i 's/alert /drop /' alert.list | |
| # wc -l alert.list | |
| sed '/^\#/d' alert.list >> drop.list | |
| # wc -l drop.list | |
| sed '/^$/d' drop.list | sort | uniq > drop.sorted | |
| # wc -l drop.sorted | |
| # Snort only allows one sid number, so we have to delete where rules contain multiple revisions | |
| echo "Removing rules with extra sid revision numbers" | |
| cat drop.sorted | awk -F"sid:" '{print $2}' | awk -F";" '{print $1}' | sort | uniq -d > duplicate.sids | |
| touch duplicate.sed | |
| for i in $(cat duplicate.sids) | |
| do | |
| echo "0,/$i/{/$i/d}" >> duplicate.sed | |
| done | |
| cat drop.sorted | awk -F"sid:" '{print $2 $1}' | sort > drop.tmp | |
| sed -i -f duplicate.sed drop.tmp | |
| sed -i 's/^/sid:/' drop.tmp | |
| cat drop.tmp | awk -F";)" '{print $2 $1}' | sort > drop.sorted | |
| sed -i 's/$/;\)/' drop.sorted | |
| # Exclude rules determined by ITUS Networks to cause web site issues | |
| # Searching and removing ~100 rules takes a couple of minutes | |
| # (note: as of August 2019 though, none seem to be present in default sets above) | |
| if [ -f "/etc/snort/rules/exclude.rules" ]; then | |
| echo "-------- -----------------------------------------" >> rule_counter.log | |
| count=$(wc -l drop.sorted | awk '{print $1}') | |
| printf "%7d\t%s\n" $count "unique rules before applying exclude.rules" >> rule_counter.log | |
| original=$(wc -l drop.sorted | awk '{print $1}') | |
| total=$(wc -l /etc/snort/rules/exclude.rules | awk '{print $1}') | |
| pattern=0 | |
| for sid in $(cat /etc/snort/rules/exclude.rules) | |
| do | |
| if [ "$sid" -eq "$sid" ] 2>/dev/null | |
| then # it's an integer sid | |
| percent=$((++pattern*100/total)) | |
| printf "\rExcluding rules that can cause web site issues: %3d%%" $percent; | |
| sed -i "/sid:$sid/s/^/#/" drop.sorted | |
| fi | |
| done | |
| printf "\rExcluding rules that can cause web site issues: 100%%\n"; | |
| final=$(wc -l drop.sorted | awk '{print $1}') | |
| if [ "$final" -eq "$original" ] 2>/dev/null | |
| then | |
| echo "No rules excluded - consider removing old sids from /etc/snort/rules/exclude.rules" | |
| else | |
| removed=$((final-original)) | |
| echo "$removed rules removed" | |
| fi | |
| fi | |
| # Remove carriage return characters and blank lines | |
| tr -d '\r' < drop.sorted | awk 'NF' > snort.rules | |
| # Cleanup working files | |
| echo "Cleaning up working files" | |
| rm -f ip.list alert.* duplicate.* drop.* | |
| # Update IP blacklists --------------------------------- | |
| echo " " | |
| echo "Updating IP blacklists" | |
| echo "-------- -----------------------------------------" >> rule_counter.log | |
| # rules/compromised-ips.txt comes from emerging-threats.tar.gz downloaded above | |
| if [ -f "rules/compromised-ips.txt" ]; then | |
| cat rules/compromised-ips.txt >> ip.list | |
| count=$(wc -l rules/compromised-ips.txt | awk '{print $1}') | |
| printf "%7d\t%s\n" $count "rules/compromised-ips.txt" >> rule_counter.log | |
| fi | |
| # Snort Community blacklist url found via https://blog.snort.org/2015/09/ip-blacklist-feed-has-moved-locations.html | |
| # Note other potentially useful urls within https://github.com/shirkdog/pulledpork/blob/master/etc/pulledpork.conf | |
| download talos-ip-blacklist.txt https://talosintelligence.com/documents/ip-blacklist true # follow url 302 redirects | |
| if [ -f "talos-ip-blacklist.txt" ]; then | |
| cat talos-ip-blacklist.txt >> ip.list | |
| count=$(wc -l talos-ip-blacklist.txt | awk '{print $1}') | |
| printf "%7d\t%s\n" $count "talos-ip-blacklist.txt" >> rule_counter.log | |
| fi | |
| # Output unique IPs from our downloaded blacklist(s) to L2.blacklist | |
| awk '!seen[$0]++' ip.list > L2.blacklist | |
| # Update rule_counter.log with final results | |
| echo "-------- -----------------------------------------" >> rule_counter.log | |
| count=$(wc -l snort.rules | awk '{print $1}') | |
| printf "%7d\t%s\n" $count "snort.rules" >> rule_counter.log | |
| count=$(wc -l L2.blacklist | awk '{print $1}') | |
| printf "%7d\t%s\n" $count "L2.blacklist" >> rule_counter.log | |
| echo \ >> rule_counter.log | |
| echo " " | |
| echo "Displaying rule_counter.log" | |
| echo " " | |
| cat rule_counter.log | |
| # Replace snort files and restart ---------------------- | |
| if [ -s "snort.rules" ]; then | |
| echo "Replacing /etc/snort/rules/snort.rules" | |
| mv /etc/snort/rules/snort.rules /etc/snort/rules/snort.rules.bak | |
| mv snort.rules /etc/snort/rules/snort.rules | |
| else | |
| echo "No snort rules downloaded" | |
| fi | |
| if [ -s "L2.blacklist" ]; then | |
| echo "Replacing /etc/snort/rules/iplists/L2.blacklist" | |
| mv /etc/snort/rules/iplists/L2.blacklist /etc/snort/rules/iplists/L2.blacklist.bak | |
| mv L2.blacklist /etc/snort/rules/iplists/L2.blacklist | |
| else | |
| echo "No IP blacklists downloaded" | |
| fi | |
| cp -f rule_counter.log /var/log/snort/rule_counter.log | |
| echo "Restarting SNORT service" | |
| # service snort restart | |
| /etc/init.d/snort restart | |
| sleep 1 | |
| echo " " | |
| cd /etc/snort | |
| exit 0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --[[ | |
| LuCI Snort module | |
| Copyright (C) 2015, Itus Networks, Inc. | |
| Licensed under the Apache License, Version 2.0 (the "License"); | |
| you may not use this file except in compliance with the License. | |
| You may obtain a copy of the License at | |
| http://www.apache.org/licenses/LICENSE-2.0 | |
| Author: Luka Perkov <[email protected]> | |
| Version 4: | |
| Redo some of the system calls and file paths for the updated Firmware | |
| version 3 | |
| Modified by Roadrunnere42 added if then statement to choose which mode the shield's in and display in >>services >> intrusion prevention window | |
| either one snort config file or 2 snort config files if running in router mode. | |
| version 2 | |
| Modified by Roadrunnere42 to include a tab called priority 1 logs in intrusion prevention window, which displays any IPS rules that has trigger a priority 1 log in the IPS log. | |
| /usr/lib/lua/luci/model/cbi/snort.lua - changed | |
| /tmp/snort/priority1 - added to hold priority 1 logs | |
| version 1 | |
| Modified by Roadrunnere42 to include a tab called rule counter in intrusion prevention window, which displays the number of rules that each rule set has. | |
| This requires the following files to be changed or added | |
| /tmp/rule_counter.log - created when run | |
| /sbin/fw_upgrade.sh - changed | |
| /usr/lib/lua/luci/model/cbi/snort.lua - changed | |
| ]]-- | |
| local fs = require "nixio.fs" | |
| local sys = require "luci.sys" | |
| require "ubus" | |
| m = Map("snort", translate("Intrusion Prevention"), translate("<p>Changes may take a couple of minutes to take effect, service may be interrupted during that time. Where you have edited rules, the system will need to download and re-process the new rulesets and any exclusions specified.</p><p>The IPS engine will restart each time you click the Save & Apply or On/Off button.</p><p><b>DO NOT REFRESH</b> if you see a <b>Bad Gateway</b> timeout message presented, since that may re-process your changes again. Instead, place the cursor in your address bar and press Enter to re-navigate back to this page.</p>")) | |
| m.on_init = function() | |
| --[[ | |
| -- Get the Shield Mode | |
| io.input("/var/.mode") | |
| line = io.read("*line") | |
| if line == "Router" then | |
| luci.sys.call("cp /var/log/snort/alert.fast /var/log/snort/alert.log") | |
| luci.sys.call("sed '1!G;h$!d' /var/log/snort/alert.log > /var/log/snort/snort_luci.log") | |
| luci.sys.call("rm /var/log/snort/alert.log") | |
| end | |
| luci.sys.call("grep -i 'priority: 1' /var/log/snort/snort_luci.log > /var/log/snort/priority1.log") | |
| --]] | |
| end | |
| m.reset = false | |
| m.submit = false | |
| s = m:section(NamedSection, "snort") | |
| s.anonymous = true | |
| s.addremove = false | |
| s:tab("tab_basic", translate("Basic Settings")) | |
| s:tab("tab_advanced", translate("Advanced Settings")) | |
| s:tab("tab_engine", translate("Engine")) | |
| s:tab("tab_preprocessors", translate("Preprocessors")) | |
| s:tab("tab_other", translate("Other Settings")) | |
| s:tab("tab_priority", translate("IPS Priority 1 Log")) | |
| s:tab("tab_logs", translate("IPS Logs")) | |
| s:tab("tab_threshold", translate("Threshold Config")) | |
| s:tab("tab_emerging_threats", translate("Emerging Threats")) | |
| s:tab("tab_custom", translate("Custom Rules")) | |
| s:tab("tab_rules", translate("Exclude Rules")) | |
| s:tab("tab_counter", translate("Rule Counter")) | |
| --s:tab("tab_snort1", translate("Snort Rules Selector")) | |
| --------------------- Basic Tab ------------------------ | |
| local status="not running" | |
| require "ubus" | |
| local conn = ubus.connect() | |
| if not conn then | |
| error("Failed to connect to ubusd") | |
| end | |
| for k, v in pairs(conn:call("service", "list", { name="snort" })) do | |
| status="running" | |
| end | |
| button_start = s:taboption("tab_basic",Button, "start", translate("Status: ")) | |
| if status == "running" then | |
| button_start.inputtitle = "ON" | |
| else | |
| button_start.inputtitle = "OFF" | |
| end | |
| button_start.write = function(self, section) | |
| if status == "not running" then | |
| sys.call("service snort start") | |
| button_start.inputtitle = "ON" | |
| button_start.title = "Status: " | |
| else | |
| sys.call("service snort stop") | |
| button_start.inputtitle = "OFF" | |
| button_start.title = "Status: " | |
| end | |
| end | |
| if status == "running" then | |
| button_restart = s:taboption("tab_basic", Button, "restart", translate("Restart: ")) | |
| button_restart.inputtitle = "Restart" | |
| button_restart.write = function(self, section) | |
| sys.call("service snort restart") | |
| end | |
| end | |
| --[[ io.input("/var/.mode") | |
| line = io.read("*line") | |
| if line == "Router" then | |
| --------------------- Snort Instance WAN Tab ----------------------- | |
| config_file1 = s:taboption("tab_wan", TextValue, "text1", "") | |
| config_file1.wrap = "off" | |
| config_file1.rows = 25 | |
| config_file1.rmempty = false | |
| function config_file1.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/snort7.conf" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file1.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/snort7.conf" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/init.d/snort restart") | |
| end | |
| end | |
| ---------------------- Snort Instance LAN Tab ------------------------ | |
| config_file2 = s:taboption("tab_lan", TextValue, "text2", "") | |
| config_file2.wrap = "off" | |
| config_file2.rows = 25 | |
| config_file2.rmempty = false | |
| function config_file2.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/snort8.conf" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file2.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/snort8.conf" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/init.d/snort restart") | |
| end | |
| end | |
| else | |
| ---------------------- Snort Config Tab ------------------------ | |
| config_file2 = s:taboption("tab_config", TextValue, "config1", "") | |
| config_file2.wrap = "off" | |
| config_file2.rows = 25 | |
| config_file2.rmempty = false | |
| function config_file2.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/snort_bridge.conf" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file2.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/snort_bridge.conf" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/init.d/snort restart") | |
| end | |
| end | |
| end | |
| --]] | |
| --------------------- Advanced Tab ----------------------- | |
| config_file1 = s:taboption("tab_advanced", TextValue, "text1", "") | |
| config_file1.wrap = "off" | |
| config_file1.rows = 25 | |
| config_file1.rmempty = false | |
| function config_file1.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/profile/config1_advanced.conf" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file1.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/profile/config1_advanced.conf" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/init.d/snort restart") | |
| -- luci.sys.call("/etc/init.d/suricata restart") | |
| end | |
| end | |
| ---------------------- Engine Tab ------------------------ | |
| config_file2 = s:taboption("tab_engine", TextValue, "text2", "") | |
| config_file2.wrap = "off" | |
| config_file2.rows = 25 | |
| config_file2.rmempty = false | |
| function config_file2.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/profile/config2_engine.conf" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file2.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/profile/config2_engine.conf" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/init.d/snort restart") | |
| -- luci.sys.call("/etc/init.d/suricata restart") | |
| end | |
| end | |
| ------------------- Preprocessors Tab --------------------- | |
| config_file3 = s:taboption("tab_preprocessors", TextValue, "text3", "") | |
| config_file3.wrap = "off" | |
| config_file3.rows = 25 | |
| config_file3.rmempty = false | |
| function config_file3.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/profile/config3_preprocessors.conf" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file3.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/profile/config3_preprocessors.conf" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/init.d/snort restart") | |
| -- luci.sys.call("/etc/init.d/suricata restart") | |
| end | |
| end | |
| --------------------- Other Tab ------------------------ | |
| config_file4 = s:taboption("tab_other", TextValue, "text4", "") | |
| config_file4.wrap = "off" | |
| config_file4.rows = 25 | |
| config_file4.rmempty = false | |
| function config_file4.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/profile/config4_other.conf" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file4.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/profile/config4_other.conf" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/init.d/snort restart") | |
| -- luci.sys.call("/etc/init.d/suricata restart") | |
| end | |
| end | |
| ---------------------- Threshold Config Tab ------------------------ | |
| config_file5 = s:taboption("tab_threshold", TextValue, "threshold", "") | |
| config_file5.wrap = "off" | |
| config_file5.rows = 25 | |
| config_file5.rmempty = false | |
| function config_file5.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/threshold.conf" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file5.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/threshold.conf" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/init.d/snort restart") | |
| end | |
| end | |
| ---------------------- Emerging Threats Tab ------------------------ | |
| config_file6 = s:taboption("tab_emerging_threats", TextValue, "emergingThreats", translate("Uncomment rules from <a href='https://doc.emergingthreats.net/bin/view/Main/EmergingFAQ' target='_blank'>Emerging Threats</a> that you want included as DROPs within your snort.rules")) | |
| config_file6.wrap = "off" | |
| config_file6.rows = 25 | |
| config_file6.rmempty = false | |
| function config_file6.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/rules/emerging-threats.rules" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file6.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/rules/emerging-threats.rules" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/snort/updaterules.sh") | |
| end | |
| end | |
| ---------------------- Custom Rules Tab ------------------------ | |
| config_file7 = s:taboption("tab_custom", TextValue, "customRules", "") | |
| config_file7.wrap = "off" | |
| config_file7.rows = 25 | |
| config_file7.rmempty = false | |
| function config_file7.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/rules/local.rules" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file7.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/rules/local.rules" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/init.d/snort restart") | |
| end | |
| end | |
| --------------------- Exclude Rules Tab ------------------------ | |
| config_file8 = s:taboption("tab_rules", TextValue, "excludeRules", translate("<p>Some rules can cause issues with certain apps or websites</p><p>You can exclude these rules if you identify their <abbr title=\"Snort Intrusion Detection\">sid</abbr> numbers</p><p><a href='https://snort.org/documents#OfficialDocumentation' target='_blank'>Read more</a></p>")) | |
| config_file8.wrap = "off" | |
| config_file8.rows = 25 | |
| config_file8.rmempty = false | |
| function config_file8.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/rules/exclude.rules" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| function config_file8.write(self, section, value) | |
| if value then | |
| local uci = require "luci.model.uci".cursor_state() | |
| file = "/etc/snort/rules/exclude.rules" | |
| fs.writefile(file, value:gsub("\r\n", "\n")) | |
| luci.sys.call("/etc/snort/updaterules.sh") | |
| end | |
| end | |
| --------------------- Logs Tab ------------------------ | |
| snort_logfile = s:taboption("tab_logs", TextValue, "logfile", "") | |
| snort_logfile.wrap = "off" | |
| snort_logfile.rows = 25 | |
| snort_logfile.rmempty = false | |
| function snort_logfile.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| local file = "/var/log/snort/snort_luci.log" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| ---------------------Priority Tab ------------------------ | |
| snort_logfile1 = s:taboption("tab_priority", TextValue, "IPS Priority 1 Log", "") | |
| snort_logfile1.wrap = "off" | |
| snort_logfile1.rows = 25 | |
| snort_logfile1.rmempty = false | |
| function snort_logfile1.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| local file = "/etc/snort/logs/priority1.log" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| --------------------- Rule Counter Tab ------------------------ | |
| counter = s:taboption("tab_counter", TextValue, "Counter", "") | |
| counter.wrap = "off" | |
| counter.rows = 25 | |
| counter.rmempty = false | |
| function counter.cfgvalue() | |
| local uci = require "luci.model.uci".cursor_state() | |
| local file = "/var/log/snort/rule_counter.log" | |
| if file then | |
| return fs.readfile(file) or "" | |
| else | |
| return "" | |
| end | |
| end | |
| --------------------- snort rule selector Tab ------------------------ | |
| -- firefox = s:taboption("tab_snort1", Flag, "content_firefox", translate("Firefox")) | |
| -- firefox.default=firefox.disabled | |
| -- firefox.rmempty = false | |
| --firefox = s:taboption("tab_snort1", Flag, "content_firefox", translate("Firefox")) | |
| -- firefox.default=snort1.enabled | |
| -- firefox.rmempty = false | |
| return m |
Author
Author
I notice compromised-ips is only 12KB versus current
/etc/snort/rules/iplists/L2.blacklist 76KB.
I suppose a straight replace is the best option we've got at the moment,
but would be good to source others to merge in if we can.
…On Wed, 14 Aug 2019 at 05:19, Donald Hoskins ***@***.***> wrote:
We may want to also grab the IP Blacklist of compromised IP addresses from
ET.
https://rules.emergingthreats.net/open/snort-edge/rules/compromised-ips.txt
These should go in /etc/snort/iplists/L2-Blacklist I believe (Not at the
shield at the moment). These are a list of KNOWN bad IP addresses.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<https://gist.github.com/e3e9e95a21d418e9c83a3a3a0731e3cc?email_source=notifications&email_token=ABQ6LYQX553WNCKKCLSTIS3QEMQOLA5CNFSM4IK3PDR2YY3PNVWWK3TUL52HS4DFVNDWS43UINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAFW7DY#gistcomment-2997820>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/ABQ6LYT2XRRGKXJTF6VO6P3QEMQOLANCNFSM4IK3PDRQ>
.
Author
Found one 17KB additional set of blacklisted ips from snort here https://blog.snort.org/2015/09/ip-blacklist-feed-has-moved-locations.html
Will start with those two for now.
Do you know if the /rules/iplists/L2.sid-msg.map is actively used?
If so, could update that from emerging-threats too..
Author
Updated to download IP blacklists, push them to /rules/iplists/L2.blacklist
I'm not sure about the L2 map file. I'd have to see what is in it compared to the ET map file. I know the sid-msg.map file outlines the SID for rules, but since the IP Blacklist is just a series of IPs and has no SID, I'm not sure. When I set it up, I think the L2 map file was already there and I just activated it and made it work in the config, then updated the IP list itself.
Author
Updated to play nice with snort.lua
Now we have a UI to add/remove emerging threats, exclude sids and see the rule counts :)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Good tip, I'll get on it. I'll also try look at an lua switch for DNS over https this weekend.