From ac6c2a7a83a36ecc1fd979db48a042d5edf156df Mon Sep 17 00:00:00 2001 From: robiscool Date: Fri, 2 Oct 2009 21:43:05 -0700 Subject: snort-dev, mirror snort satble with snort-dev --- config/snort-dev/snort.inc | 73 ++++++++++++++++++++++++++++++++----- config/snort-dev/snort_blocked.php | 33 ++++++++++++++++- config/snort-dev/snort_rules.php | 64 +++++++++++++++++++++++++++++++- config/snort-dev/snort_rulesets.php | 66 +++++++++++++++++++++++++++++++-- 4 files changed, 220 insertions(+), 16 deletions(-) diff --git a/config/snort-dev/snort.inc b/config/snort-dev/snort.inc index ebcab85c..107dfb3e 100644 --- a/config/snort-dev/snort.inc +++ b/config/snort-dev/snort.inc @@ -196,7 +196,6 @@ function create_barnyard2_conf() { global $bconfig, $bg; /* write out barnyard2_conf */ $barnyard2_conf_text = generate_barnyard2_conf(); -// conf_mount_rw(); $bconf = fopen("/usr/local/etc/barnyard2.conf", "w"); if(!$bconf) { log_error("Could not open /usr/local/etc/barnyard2.conf for writing."); @@ -204,7 +203,6 @@ function create_barnyard2_conf() { } fwrite($bconf, $barnyard2_conf_text); fclose($bconf); -// conf_mount_ro(); } /* open barnyard2.conf for writing" */ function generate_barnyard2_conf() { @@ -213,28 +211,56 @@ function generate_barnyard2_conf() { conf_mount_rw(); /* define snortbarnyardlog */ +/* TODO add support for the other 5 output plugins */ + $snortbarnyardlog_database_info_chk = $config['installedpackages']['snortadvanced']['config'][0]['snortbarnyardlog_database']; +$snortbarnyardlog_hostname_info_chk = $config['installedpackages']['snortadvanced']['config'][0]['snortbarnyardlog_hostname']; +$snortbarnyardlog_interface_info_chk = $config['installedpackages']['snortadvanced']['config'][0]['snortbarnyardlog_interface']; $barnyard2_conf_text = << -This page lists hosts that have been blocked by Snort. Hosts are automatically deleted every 60 minutes. + + diff --git a/config/snort-dev/snort_rules.php b/config/snort-dev/snort_rules.php index fa4a5a4a..233841b1 100644 --- a/config/snort-dev/snort_rules.php +++ b/config/snort-dev/snort_rules.php @@ -2,7 +2,7 @@ /* $Id$ */ /* edit_snortrule.php - Copyright (C) 2004, 2005 Scott Ullrich + Copyright (C) 2004, 2005 Scott Ullrich and Rober Zelaya All rights reserved. Redistribution and use in source and binary forms, with or without @@ -30,7 +30,67 @@ require("guiconfig.inc"); require("config.inc"); if(!is_dir("/usr/local/etc/snort/rules")) - header("Location: snort_rules.php", false); + exec('mkdir /usr/local/etc/snort/rules/'); + +/* Check if the rules dir is empy if so warn the user */ +/* TODO give the user the option to delete the installed rules rules */ +$isrulesfolderempty = exec('ls -A /usr/local/etc/snort/rules/*.rules'); +if ($isrulesfolderempty == "") { + +include("head.inc"); +include("fbegin.inc"); + +echo ""; + +echo "\n +\n +\n + \n + \n + \n + \n + \n + \n +
\n"; + + $tab_array = array(); + $tab_array[] = array(gettext("Settings"), false, "/pkg_edit.php?xml=snort.xml&id=0"); + $tab_array[] = array(gettext("Update Rules"), false, "/snort_download_rules.php"); + $tab_array[] = array(gettext("Categories"), false, "/snort_rulesets.php"); + $tab_array[] = array(gettext("Rules"), true, "/snort_rules.php"); + $tab_array[] = array(gettext("Servers"), false, "/pkg_edit.php?xml=snort_define_servers.xml&id=0"); + $tab_array[] = array(gettext("Blocked"), false, "/snort_blocked.php"); + $tab_array[] = array(gettext("Whitelist"), false, "/pkg.php?xml=snort_whitelist.xml"); + $tab_array[] = array(gettext("Threshold"), false, "/pkg.php?xml=snort_threshold.xml"); + $tab_array[] = array(gettext("Alerts"), false, "/snort_alerts.php"); + $tab_array[] = array(gettext("Advanced"), false, "/pkg_edit.php?xml=snort_advanced.xml&id=0"); + display_top_tabs($tab_array); + +echo "
\n +
\n + \n + \n + \n + \n +
\n +# The rules directory is empty.\n +
\n +
\n +
\n +\n +\n +\n +

\n\n"; + +echo "Please click on the Update Rules tab to install your selected rule sets."; +include("fend.inc"); + +echo ""; +echo ""; + +exit(0); + +} function get_middle($source, $beginning, $ending, $init_pos) { $beginning_pos = strpos($source, $beginning, $init_pos); diff --git a/config/snort-dev/snort_rulesets.php b/config/snort-dev/snort_rulesets.php index 4f16eadd..8e5179d6 100644 --- a/config/snort-dev/snort_rulesets.php +++ b/config/snort-dev/snort_rulesets.php @@ -27,13 +27,73 @@ POSSIBILITY OF SUCH DAMAGE. */ -if(!is_dir("/usr/local/etc/snort/rules")) - Header("Location: snort_download_rules.php"); - require("guiconfig.inc"); require_once("service-utils.inc"); require("/usr/local/pkg/snort.inc"); +if(!is_dir("/usr/local/etc/snort/rules")) + exec('mkdir /usr/local/etc/snort/rules/'); + +/* Check if the rules dir is empy if so warn the user */ +/* TODO give the user the option to delete the installed rules rules */ +$isrulesfolderempty = exec('ls -A /usr/local/etc/snort/rules/*.rules'); +if ($isrulesfolderempty == "") { + +include("head.inc"); +include("fbegin.inc"); + +echo ""; + +echo "\n +\n +\n + \n + \n + \n + \n + \n + \n +
\n"; + + $tab_array = array(); + $tab_array[] = array(gettext("Settings"), false, "/pkg_edit.php?xml=snort.xml&id=0"); + $tab_array[] = array(gettext("Update Rules"), false, "/snort_download_rules.php"); + $tab_array[] = array(gettext("Categories"), true, "/snort_rulesets.php"); + $tab_array[] = array(gettext("Rules"), false, "/snort_rules.php"); + $tab_array[] = array(gettext("Servers"), false, "/pkg_edit.php?xml=snort_define_servers.xml&id=0"); + $tab_array[] = array(gettext("Blocked"), false, "/snort_blocked.php"); + $tab_array[] = array(gettext("Whitelist"), false, "/pkg.php?xml=snort_whitelist.xml"); + $tab_array[] = array(gettext("Threshold"), false, "/pkg.php?xml=snort_threshold.xml"); + $tab_array[] = array(gettext("Alerts"), false, "/snort_alerts.php"); + $tab_array[] = array(gettext("Advanced"), false, "/pkg_edit.php?xml=snort_advanced.xml&id=0"); + display_top_tabs($tab_array); + +echo "
\n +
\n + \n + \n + \n + \n +
\n +# The rules directory is empty.\n +
\n +
\n +
\n +\n +\n +\n +

\n\n"; + +echo "Please click on the Update Rules tab to install your selected rule sets."; +include("fend.inc"); + +echo ""; +echo ""; + +exit(0); + +} + if($_POST) { $enabled_items = ""; $isfirst = true; -- cgit v1.2.3