diff options
author | robiscool <robrob2626@yahoo.com> | 2009-06-09 10:56:03 -0700 |
---|---|---|
committer | robiscool <robrob2626@yahoo.com> | 2009-06-09 10:56:03 -0700 |
commit | 9897f8deb603c33a57014230825fabf509e4b229 (patch) | |
tree | ef0246aa643a55626d7af95b0b572c95a6c41d78 /config/snort/snort.inc | |
parent | 6aefeb8d9be1acd1e0cab8c3fde76f7a175740f1 (diff) | |
download | pfsense-packages-9897f8deb603c33a57014230825fabf509e4b229.tar.gz pfsense-packages-9897f8deb603c33a57014230825fabf509e4b229.tar.bz2 pfsense-packages-9897f8deb603c33a57014230825fabf509e4b229.zip |
Major feature update, added Emergingthreats rules,Alerts Tab logging type full or fast,Send alerts to main OS System logs,Log to a Tcpdump,Log to a mysql database,Log Alerts to a snort unified
Diffstat (limited to 'config/snort/snort.inc')
-rwxr-xr-x | config/snort/snort.inc | 39 |
1 files changed, 34 insertions, 5 deletions
diff --git a/config/snort/snort.inc b/config/snort/snort.inc index a6cbc605..e7576ceb 100755 --- a/config/snort/snort.inc +++ b/config/snort/snort.inc @@ -50,7 +50,7 @@ function sync_package_snort_reinstall() start_service("snort"); } -function sync_package_snort() +function sync_package_snort() { global $config, $g; @@ -141,7 +141,7 @@ function sync_package_snort() /* TODO; get snort to start under nologin shell */ foreach($snortInterfaces as $snortIf) { - $start .= ";sleep 8;snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -D -i {$snortIf} -A fast -q"; + $start .= ";sleep 8;snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -D -i {$snortIf} -q"; } /* if block offenders is checked, start snort2c */ @@ -207,6 +207,7 @@ function snort_deinstall() { } function generate_snort_conf() { + global $config, $g; conf_mount_rw(); /* obtain external interface */ @@ -214,7 +215,32 @@ function generate_snort_conf() { $snort_ext_int = $config['installedpackages']['snort']['config'][0]['iface_array'][0]; $snort_config_pass_thru = $config['installedpackages']['snortadvanced']['config'][0]['configpassthru']; - + +/* define snortalertlogtype */ +$snortalertlogtype = $config['installedpackages']['snortadvanced']['config'][0]['snortalertlogtype']; +if ($snortalertlogtype == fast) + $snortalertlogtype_type = "output alert_fast: alert"; +else + $snortalertlogtype_type = "output alert_full: alert"; + +/* define alertsystemlog */ +$alertsystemlog_info_chk = $config['installedpackages']['snortadvanced']['config'][0]['alertsystemlog']; +if ($alertsystemlog_info_chk == on) + $alertsystemlog_type = "output alert_syslog: log_alert"; + +/* define tcpdumplog */ +$tcpdumplog_info_chk = $config['installedpackages']['snortadvanced']['config'][0]['tcpdumplog']; +if ($tcpdumplog_info_chk == on) + $tcpdumplog_type = "output log_tcpdump: snorttcpd.log"; + +/* define snortmysqllog */ +$snortmysqllog_info_chk = $config['installedpackages']['snortadvanced']['config'][0]['snortmysqllog']; + +/* define snortunifiedlog */ +$snortunifiedlog_info_chk = $config['installedpackages']['snortadvanced']['config'][0]['snortunifiedlog']; +if ($snortunifiedlog_info_chk == on) + $snortunifiedlog_type = "output alert_unified: snort.alert, limit 128\noutput log_unified: snort.log, limit 128"; + /* add auto update scripts to /etc/crontab */ // $text_ww = "*/60\t* \t 1\t *\t *\t root\t /usr/bin/nice -n20 /usr/local/pkg/snort_check_for_rule_updates.php"; // $filenamea = "/etc/crontab"; @@ -667,8 +693,11 @@ preprocessor ssl: ports { 443 465 563 636 989 992 993 994 995 }, trustservers, n # ##################### -output alert_syslog: LOG_AUTH LOG_ALERT LOG_CONS LOG_NDELAY LOG_PERROR LOG_PID -output alert_unified: filename snort.alert, limit 128 +$snortalertlogtype_type +$alertsystemlog_type +$tcpdumplog_type +$snortmysqllog_info_chk +$snortunifiedlog_type ################# # |