From 191d39b8c2586455462d4634a403cdb3f0a68e31 Mon Sep 17 00:00:00 2001 From: robiscool Date: Sat, 5 Dec 2009 15:48:09 -0800 Subject: snort-dev, rc1 update, main gui updates, performace updates --- config/snort-dev/snort.inc | 59 +++++----- config/snort-dev/snort_barnyard.php | 113 ++++++++++++++++--- config/snort-dev/snort_define_servers.php | 50 ++++++--- config/snort-dev/snort_gui.inc | 2 +- config/snort-dev/snort_interfaces.php | 37 ++++-- config/snort-dev/snort_interfaces_edit.php | 117 +++++++++++++++---- config/snort-dev/snort_preprocessors.php | 175 ++++++++++++++++++++--------- config/snort-dev/snort_rulesets.php | 2 +- 8 files changed, 416 insertions(+), 139 deletions(-) (limited to 'config/snort-dev') diff --git a/config/snort-dev/snort.inc b/config/snort-dev/snort.inc index 08b2aae1..65487703 100644 --- a/config/snort-dev/snort.inc +++ b/config/snort-dev/snort.inc @@ -79,9 +79,6 @@ function snort_postinstall() { global $config; conf_mount_rw(); - - exec("/usr/sbin/pw groupadd snort"); - exec('/usr/sbin/pw useradd snort -c "SNORT USER" -d /nonexistent -g snort -s /sbin/nologin'); if(!file_exists("/var/log/snort/")) mwexec("mkdir -p /var/log/snort/"); @@ -283,7 +280,7 @@ function create_snort_sh() /* define snortbarnyardlog_chk */ if ($snortbarnyardlog_info_chk == on) { - $start_barnyard2 = "\nsleep 4\n/usr/local/bin/barnyard2 -c /usr/local/etc/snort/snort_$id$if_real/barnyard2.conf -d /var/log/snort -f snort.u2_$id$if_real -w /usr/local/etc/snort/snort_$id$if_real/barnyard2.waldo -D -q\n\n"; + $start_barnyard2 = "\nsleep 4\n/usr/local/bin/barnyard2 -u snort -g snort -c /usr/local/etc/snort/snort_$id$if_real/barnyard2.conf -d /var/log/snort -f snort.u2_$id$if_real -w /usr/local/etc/snort/snort_$id$if_real/barnyard2.waldo -D -q\n\n"; } @@ -395,6 +392,7 @@ rc_start_real() { /bin/rm /var/run/snort_$if_real$id$if_real.pid.lck /usr/local/bin/snort -u snort -g snort -G $id -R $id$if_real -c /usr/local/etc/snort/snort_$id$if_real/snort.conf -l /var/log/snort -D -i $if_real -q /sbin/ifconfig $if_real_wan polling promisc + $start_barnyard2 sleep 3 /bin/cp /var/log/system.log /var/log/snort/snort_sys_$id$if_real.log @@ -466,12 +464,18 @@ EOD; /* open barnyard2.conf for writing */ function create_barnyard2_conf() { - global $bconfig, $bg; + global $bconfig, $bg, $id, $if_real; /* write out barnyard2_conf */ + + if(!file_exists("/usr/local/etc/snort/snort_$id$if_real/barnyard2.conf")) + { + exec("/bin//usr/bin/touch /usr/local/etc/snort/snort_$id$if_real/barnyard2.conf"); + } + $barnyard2_conf_text = generate_barnyard2_conf(); - $bconf = fopen("/usr/local/etc/snort/$id$if_real/barnyard2.conf", "w"); + $bconf = fopen("/usr/local/etc/snort/snort_$id$if_real/barnyard2.conf", "w"); if(!$bconf) { - log_error("Could not open /usr/local/etc/snort/$id$if_real/barnyard2.conf for writing."); + log_error("Could not open /usr/local/etc/snort/snort_$id$if_real/barnyard2.conf for writing."); exit; } fwrite($bconf, $barnyard2_conf_text); @@ -658,7 +662,8 @@ snort_rules_up_deinstall_cron(""); } -function generate_snort_conf() { +function generate_snort_conf() +{ global $config, $g, $if_real, $id; conf_mount_rw(); @@ -670,19 +675,22 @@ function generate_snort_conf() { // $snort_config_pass_thru = $config['installedpackages']['snortglobal']['rule'][$id]['configpassthru']; /* create basic files */ - if(!file_exists("/usr/local/etc/snort/snort/snort_$id$if_real")) { - exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/"); - exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/rules"); - - if(!file_exists("/usr/local/etc/snort/snort_$id$if_real/gen-msg.map")) { - exec("/bin/cp /usr/local/etc/snort/classification.config /usr/local/etc/snort/snort_$id$if_real/classification.config"); - exec("/bin/cp /usr/local/etc/snort/gen-msg.map /usr/local/etc/snort/snort_$id$if_real/gen-msg.map"); - exec("/bin/cp /usr/local/etc/snort/reference.config /usr/local/etc/snort/snort_$id$if_real/reference.config"); - exec("/bin/cp /usr/local/etc/snort/sid-msg.map /usr/local/etc/snort/snort_$id$if_real/sid-msg.map"); - exec("/bin/cp /usr/local/etc/snort/unicode.map /usr/local/etc/snort/snort_$id$if_real/unicode.map"); - exec("/bin/cp /usr/local/etc/snort/threshold.conf /usr/local/etc/snort/snort_$id$if_real/threshold.conf"); - exec("/bin/cp /usr/local/etc/snort/snort.conf /usr/local/etc/snort/snort_$id$if_real/snort.conf"); - exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/rules"); + if(!file_exists("/usr/local/etc/snort/snort/snort_$id$if_real")) + { + exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/"); + exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/rules"); + + if(!file_exists("/usr/local/etc/snort/snort_$id$if_real/gen-msg.map")) + { + exec("/bin/cp /usr/local/etc/snort/classification.config /usr/local/etc/snort/snort_$id$if_real/classification.config"); + exec("/bin/cp /usr/local/etc/snort/gen-msg.map /usr/local/etc/snort/snort_$id$if_real/gen-msg.map"); + exec("/bin/cp /usr/local/etc/snort/reference.config /usr/local/etc/snort/snort_$id$if_real/reference.config"); + exec("/bin/cp /usr/local/etc/snort/sid-msg.map /usr/local/etc/snort/snort_$id$if_real/sid-msg.map"); + exec("/bin/cp /usr/local/etc/snort/unicode.map /usr/local/etc/snort/snort_$id$if_real/unicode.map"); + exec("/bin/cp /usr/local/etc/snort/threshold.conf /usr/local/etc/snort/snort_$id$if_real/threshold.conf"); + exec("/bin/cp /usr/local/etc/snort/snort.conf /usr/local/etc/snort/snort_$id$if_real/snort.conf"); + exec("/bin//usr/bin/touch /usr/local/etc/snort/snort_$id$if_real/barnyard2.conf"); + exec("/bin/mkdir -p /usr/local/etc/snort/snort_$id$if_real/rules"); } } @@ -703,11 +711,6 @@ $tcpdumplog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id][ if ($tcpdumplog_info_chk == on) $tcpdumplog_type = "output log_tcpdump: snorttcpd.log"; -/* define snortbarnyardlog_chk */ -$snortbarnyardlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['snortbarnyardlog']; -if ($snortbarnyardlog_info_chk == on) - $snortbarnyardlog_type = "barnyard2 -c /usr/local/etc/barnyard2.conf -d /var/log/snort -f snort.u2 -w /usr/local/etc/snort/barnyard2.waldo -D"; - /* define snortunifiedlog */ $snortunifiedlog_info_chk = $config['installedpackages']['snortglobal']['rule'][$id]['snortunifiedlog']; if ($snortunifiedlog_info_chk == on) @@ -1546,7 +1549,7 @@ $def_ssl_ports_ignore_info_chk = $config['installedpackages']['snortglobal']['ru if ($def_ssl_ports_ignore_info_chk == "") $def_ssl_ports_ignore_type = "443 465 563 636 989 990 992 993 994 995"; else - $def_ssl_ports_ignore_type = "$def_ssl_ports_info_chk"; + $def_ssl_ports_ignore_type = "$def_ssl_ports_ignore_info_chk"; ////////////////////////////////////////////////////////////////// /* build snort configuration file */ @@ -1744,7 +1747,7 @@ preprocessor stream5_icmp: # ############################## -preprocessor ssl: ports { $def_ssl_ports_ignore_type }, trustservers, noinspect_encrypted +preprocessor ssl: ports { {$def_ssl_ports_ignore_type} }, trustservers, noinspect_encrypted ##################### # diff --git a/config/snort-dev/snort_barnyard.php b/config/snort-dev/snort_barnyard.php index cfe4e77d..a28bf0e7 100644 --- a/config/snort-dev/snort_barnyard.php +++ b/config/snort-dev/snort_barnyard.php @@ -57,10 +57,52 @@ if (isset($_GET['dup'])) { if (isset($id) && $a_nat[$id]) { - /* new options */ + /* old options */ + $pconfig['def_ssl_ports_ignore'] = $a_nat[$id]['def_ssl_ports_ignore']; + $pconfig['flow_depth'] = $a_nat[$id]['flow_depth']; + $pconfig['perform_stat'] = $a_nat[$id]['perform_stat']; + $pconfig['http_inspect'] = $a_nat[$id]['http_inspect']; + $pconfig['other_preprocs'] = $a_nat[$id]['other_preprocs']; + $pconfig['ftp_preprocessor'] = $a_nat[$id]['ftp_preprocessor']; + $pconfig['smtp_preprocessor'] = $a_nat[$id]['smtp_preprocessor']; + $pconfig['sf_portscan'] = $a_nat[$id]['sf_portscan']; + $pconfig['dce_rpc_2'] = $a_nat[$id]['dce_rpc_2']; + $pconfig['dns_preprocessor'] = $a_nat[$id]['dns_preprocessor']; + $pconfig['def_dns_servers'] = $a_nat[$id]['def_dns_servers']; + $pconfig['def_dns_ports'] = $a_nat[$id]['def_dns_ports']; + $pconfig['def_smtp_servers'] = $a_nat[$id]['def_smtp_servers']; + $pconfig['def_smtp_ports'] = $a_nat[$id]['def_smtp_ports']; + $pconfig['def_mail_ports'] = $a_nat[$id]['def_mail_ports']; + $pconfig['def_http_servers'] = $a_nat[$id]['def_http_servers']; + $pconfig['def_www_servers'] = $a_nat[$id]['def_www_servers']; + $pconfig['def_http_ports'] = $a_nat[$id]['def_http_ports']; + $pconfig['def_sql_servers'] = $a_nat[$id]['def_sql_servers']; + $pconfig['def_oracle_ports'] = $a_nat[$id]['def_oracle_ports']; + $pconfig['def_mssql_ports'] = $a_nat[$id]['def_mssql_ports']; + $pconfig['def_telnet_servers'] = $a_nat[$id]['def_telnet_servers']; + $pconfig['def_telnet_ports'] = $a_nat[$id]['def_telnet_ports']; + $pconfig['def_snmp_servers'] = $a_nat[$id]['def_snmp_servers']; + $pconfig['def_snmp_ports'] = $a_nat[$id]['def_snmp_ports']; + $pconfig['def_ftp_servers'] = $a_nat[$id]['def_ftp_servers']; + $pconfig['def_ftp_ports'] = $a_nat[$id]['def_ftp_ports']; + $pconfig['def_ssh_servers'] = $a_nat[$id]['def_ssh_servers']; + $pconfig['def_ssh_ports'] = $a_nat[$id]['def_ssh_ports']; + $pconfig['def_pop_servers'] = $a_nat[$id]['def_pop_servers']; + $pconfig['def_pop2_ports'] = $a_nat[$id]['def_pop2_ports']; + $pconfig['def_pop3_ports'] = $a_nat[$id]['def_pop3_ports']; + $pconfig['def_imap_servers'] = $a_nat[$id]['def_imap_servers']; + $pconfig['def_imap_ports'] = $a_nat[$id]['def_imap_ports']; + $pconfig['def_sip_proxy_ip'] = $a_nat[$id]['def_sip_proxy_ip']; + $pconfig['ip def_sip_proxy_ports'] = $a_nat[$id]['ip def_sip_proxy_ports']; + $pconfig['def_auth_ports'] = $a_nat[$id]['def_auth_ports']; + $pconfig['def_finger_ports'] = $a_nat[$id]['def_finger_ports']; + $pconfig['def_irc_ports'] = $a_nat[$id]['def_irc_ports']; + $pconfig['def_nntp_ports'] = $a_nat[$id]['def_nntp_ports']; + $pconfig['def_rlogin_ports'] = $a_nat[$id]['def_rlogin_ports']; + $pconfig['def_rsh_ports'] = $a_nat[$id]['def_rsh_ports']; + $pconfig['def_ssl_ports'] = $a_nat[$id]['def_ssl_ports']; $pconfig['barnyard_enable'] = $a_nat[$id]['barnyard_enable']; $pconfig['barnyard_mysql'] = $a_nat[$id]['barnyard_mysql']; - /* old options */ $pconfig['enable'] = $a_nat[$id]['enable']; $pconfig['interface'] = $a_nat[$id]['interface']; $pconfig['descr'] = $a_nat[$id]['descr']; @@ -70,7 +112,6 @@ if (isset($id) && $a_nat[$id]) { $pconfig['alertsystemlog'] = $a_nat[$id]['alertsystemlog']; $pconfig['tcpdumplog'] = $a_nat[$id]['tcpdumplog']; $pconfig['snortunifiedlog'] = $a_nat[$id]['snortunifiedlog']; - $pconfig['flow_depth'] = $a_nat[$id]['flow_depth']; if (!$pconfig['interface']) $pconfig['interface'] = "wan"; @@ -96,16 +137,62 @@ if ($_POST) { /* if no errors write to conf */ if (!$input_errors) { $natent = array(); - /* repost the options already in conf */ - $natent['enable'] = $pconfig['enable']; - $natent['interface'] = $pconfig['interface']; - $natent['descr'] = $pconfig['descr']; - $natent['performance'] = $pconfig['performance']; - $natent['blockoffenders7'] = $pconfig['blockoffenders7']; - $natent['snortalertlogtype'] = $pconfig['snortalertlogtype']; - $natent['alertsystemlog'] = $pconfig['alertsystemlog']; - $natent['tcpdumplog'] = $pconfig['tcpdumplog']; - $natent['flow_depth'] = $pconfig['flow_depth']; + /* repost the options already in conf */ + + if ($pconfig['interface'] != "") { $natent['interface'] = $pconfig['interface']; } + if ($pconfig['enable'] != "") { $natent['enable'] = $pconfig['enable']; } + if ($pconfig['descr'] != "") { $natent['descr'] = $pconfig['descr']; } + if ($pconfig['performance'] != "") { $natent['performance'] = $pconfig['performance']; } + if ($pconfig['blockoffenders7'] != "") { $natent['blockoffenders7'] = $pconfig['blockoffenders7']; } + if ($pconfig['snortalertlogtype'] != "") { $natent['snortalertlogtype'] = $pconfig['snortalertlogtype']; } + if ($pconfig['alertsystemlog'] != "") { $natent['alertsystemlog'] = $pconfig['alertsystemlog']; } + if ($pconfig['tcpdumplog'] != "") { $natent['tcpdumplog'] = $pconfig['tcpdumplog']; } + if ($pconfig['snortunifiedlog'] != "") { $natent['snortunifiedlog'] = $pconfig['snortunifiedlog']; } + if ($pconfig['def_ssl_ports_ignore'] != "") { $natent['def_ssl_ports_ignore'] = $pconfig['def_ssl_ports_ignore']; } + if ($pconfig['flow_depth'] != "") { $natent['flow_depth'] = $pconfig['flow_depth']; } + if ($pconfig['perform_stat'] != "") { $natent['perform_stat'] = $pconfig['perform_stat']; } + if ($pconfig['http_inspect'] != "") { $natent['http_inspect'] = $pconfig['http_inspect']; } + if ($pconfig['other_preprocs'] != "") { $natent['other_preprocs'] = $pconfig['other_preprocs']; } + if ($pconfig['ftp_preprocessor'] != "") { $natent['ftp_preprocessor'] = $pconfig['ftp_preprocessor']; } + if ($pconfig['smtp_preprocessor'] != "") { $natent['smtp_preprocessor'] = $pconfig['smtp_preprocessor']; } + if ($pconfig['sf_portscan'] != "") { $natent['sf_portscan'] = $pconfig['sf_portscan']; } + if ($pconfig['dce_rpc_2'] != "") { $natent['dce_rpc_2'] = $pconfig['dce_rpc_2']; } + if ($pconfig['dns_preprocessor'] != "") { $natent['dns_preprocessor'] = $pconfig['dns_preprocessor']; } + if ($pconfig['def_dns_servers'] != "") { $natent['def_dns_servers'] = $pconfig['def_dns_servers']; } + if ($pconfig['def_dns_ports'] != "") { $natent['def_dns_ports'] = $pconfig['def_dns_ports']; } + if ($pconfig['def_smtp_servers'] != "") { $natent['def_smtp_servers'] = $pconfig['def_smtp_servers']; } + if ($pconfig['def_smtp_ports'] != "") { $natent['def_smtp_ports'] = $pconfig['def_smtp_ports']; } + if ($pconfig['def_mail_ports'] != "") { $natent['def_mail_ports'] = $pconfig['def_mail_ports']; } + if ($pconfig['def_http_servers'] != "") { $natent['def_http_servers'] = $pconfig['def_http_servers']; } + if ($pconfig['def_www_servers'] != "") { $natent['def_www_servers'] = $pconfig['def_www_servers']; } + if ($pconfig['def_http_ports'] != "") { $natent['def_http_ports'] = $pconfig['def_http_ports']; } + if ($pconfig['def_sql_servers'] != "") { $natent['def_sql_servers'] = $pconfig['def_sql_servers']; } + if ($pconfig['def_oracle_ports'] != "") { $natent['def_oracle_ports'] = $pconfig['def_oracle_ports']; } + if ($pconfig['def_mssql_ports'] != "") { $natent['def_mssql_ports'] = $pconfig['def_mssql_ports']; } + if ($pconfig['def_telnet_servers'] != "") { $natent['def_telnet_servers'] = $pconfig['def_telnet_servers']; } + if ($pconfig['def_telnet_ports'] != "") { $natent['def_telnet_ports'] = $pconfig['def_telnet_ports']; } + if ($pconfig['def_snmp_servers'] != "") { $natent['def_snmp_servers'] = $pconfig['def_snmp_servers']; } + if ($pconfig['def_snmp_ports'] != "") { $natent['def_snmp_ports'] = $pconfig['def_snmp_ports']; } + if ($pconfig['def_ftp_servers'] != "") { $natent['def_ftp_servers'] = $pconfig['def_ftp_servers']; } + if ($pconfig['def_ftp_ports'] != "") { $natent['def_ftp_ports'] = $pconfig['def_ftp_ports']; } + if ($pconfig['def_ssh_servers'] != "") { $natent['def_ssh_servers'] = $pconfig['def_ssh_servers']; } + if ($pconfig['def_ssh_ports'] != "") { $natent['def_ssh_ports'] = $pconfig['def_ssh_ports']; } + if ($pconfig['def_pop_servers'] != "") { $natent['def_pop_servers'] = $pconfig['def_pop_servers']; } + if ($pconfig['def_pop2_ports'] != "") { $natent['def_pop2_ports'] = $pconfig['def_pop2_ports']; } + if ($pconfig['def_pop3_ports'] != "") { $natent['def_pop3_ports'] = $pconfig['def_pop3_ports']; } + if ($pconfig['def_imap_servers'] != "") { $natent['def_imap_servers'] = $pconfig['def_imap_servers']; } + if ($pconfig['def_imap_ports'] != "") { $natent['def_imap_ports'] = $pconfig['def_imap_ports']; } + if ($pconfig['def_sip_proxy_ip'] != "") { $natent['def_sip_proxy_ip'] = $pconfig['def_sip_proxy_ip']; } + if ($pconfig['ip def_sip_proxy_ports'] != "") { $natent['ip def_sip_proxy_ports'] = $pconfig['ip def_sip_proxy_ports']; } + if ($pconfig['def_auth_ports'] != "") { $natent['def_auth_ports'] = $pconfig['def_auth_ports']; } + if ($pconfig['def_finger_ports'] != "") { $natent['def_finger_ports'] = $pconfig['def_finger_ports']; } + if ($pconfig['def_irc_ports'] != "") { $natent['def_irc_ports'] = $pconfig['def_irc_ports']; } + if ($pconfig['def_nntp_ports'] != "") { $natent['def_nntp_ports'] = $pconfig['def_nntp_ports']; } + if ($pconfig['def_rlogin_ports'] != "") { $natent['def_rlogin_ports'] = $pconfig['def_rlogin_ports']; } + if ($pconfig['def_rsh_ports'] != "") { $natent['def_rsh_ports'] = $pconfig['def_rsh_ports']; } + if ($pconfig['def_ssl_ports'] != "") { $natent['def_ssl_ports'] = $pconfig['def_ssl_ports']; } + + /* post new options */ $natent['barnyard_enable'] = $_POST['barnyard_enable'] ? on : off; $natent['barnyard_mysql'] = $_POST['barnyard_mysql'] ? $_POST['barnyard_mysql'] : $pconfig['barnyard_mysql']; diff --git a/config/snort-dev/snort_define_servers.php b/config/snort-dev/snort_define_servers.php index 812d379b..aca2f036 100644 --- a/config/snort-dev/snort_define_servers.php +++ b/config/snort-dev/snort_define_servers.php @@ -57,7 +57,17 @@ if (isset($_GET['dup'])) { if (isset($id) && $a_nat[$id]) { - /* new options */ + /* old options */ + $pconfig['def_ssl_ports_ignore'] = $a_nat[$id]['def_ssl_ports_ignore']; + $pconfig['flow_depth'] = $a_nat[$id]['flow_depth']; + $pconfig['perform_stat'] = $a_nat[$id]['perform_stat']; + $pconfig['http_inspect'] = $a_nat[$id]['http_inspect']; + $pconfig['other_preprocs'] = $a_nat[$id]['other_preprocs']; + $pconfig['ftp_preprocessor'] = $a_nat[$id]['ftp_preprocessor']; + $pconfig['smtp_preprocessor'] = $a_nat[$id]['smtp_preprocessor']; + $pconfig['sf_portscan'] = $a_nat[$id]['sf_portscan']; + $pconfig['dce_rpc_2'] = $a_nat[$id]['dce_rpc_2']; + $pconfig['dns_preprocessor'] = $a_nat[$id]['dns_preprocessor']; $pconfig['def_dns_servers'] = $a_nat[$id]['def_dns_servers']; $pconfig['def_dns_ports'] = $a_nat[$id]['def_dns_ports']; $pconfig['def_smtp_servers'] = $a_nat[$id]['def_smtp_servers']; @@ -91,7 +101,6 @@ if (isset($id) && $a_nat[$id]) { $pconfig['def_rlogin_ports'] = $a_nat[$id]['def_rlogin_ports']; $pconfig['def_rsh_ports'] = $a_nat[$id]['def_rsh_ports']; $pconfig['def_ssl_ports'] = $a_nat[$id]['def_ssl_ports']; - /* old options */ $pconfig['barnyard_enable'] = $a_nat[$id]['barnyard_enable']; $pconfig['barnyard_mysql'] = $a_nat[$id]['barnyard_mysql']; $pconfig['enable'] = $a_nat[$id]['enable']; @@ -103,7 +112,6 @@ if (isset($id) && $a_nat[$id]) { $pconfig['alertsystemlog'] = $a_nat[$id]['alertsystemlog']; $pconfig['tcpdumplog'] = $a_nat[$id]['tcpdumplog']; $pconfig['snortunifiedlog'] = $a_nat[$id]['snortunifiedlog']; - $pconfig['flow_depth'] = $a_nat[$id]['flow_depth']; if (isset($_GET['dup'])) unset($id); @@ -119,19 +127,29 @@ if ($_POST) { /* if no errors write to conf */ if (!$input_errors) { $natent = array(); - /* repost the options already in conf */ - $natent['enable'] = $pconfig['enable']; - $natent['interface'] = $pconfig['interface']; - $natent['descr'] = $pconfig['descr']; - $natent['performance'] = $pconfig['performance']; - $natent['blockoffenders7'] = $pconfig['blockoffenders7']; - $natent['snortalertlogtype'] = $pconfig['snortalertlogtype']; - $natent['alertsystemlog'] = $pconfig['alertsystemlog']; - $natent['tcpdumplog'] = $pconfig['tcpdumplog']; - $natent['snortunifiedlog'] = $pconfig['snortunifiedlog']; - $natent['flow_depth'] = $pconfig['flow_depth']; - $natent['barnyard_enable'] = $pconfig['barnyard_enable']; - $natent['barnyard_mysql'] = $pconfig['barnyard_mysql']; + /* repost the options already in conf */ + if ($pconfig['interface'] != "") { $natent['interface'] = $pconfig['interface']; } + if ($pconfig['enable'] != "") { $natent['enable'] = $pconfig['enable']; } + if ($pconfig['descr'] != "") { $natent['descr'] = $pconfig['descr']; } + if ($pconfig['performance'] != "") { $natent['performance'] = $pconfig['performance']; } + if ($pconfig['blockoffenders7'] != "") { $natent['blockoffenders7'] = $pconfig['blockoffenders7']; } + if ($pconfig['snortalertlogtype'] != "") { $natent['snortalertlogtype'] = $pconfig['snortalertlogtype']; } + if ($pconfig['alertsystemlog'] != "") { $natent['alertsystemlog'] = $pconfig['alertsystemlog']; } + if ($pconfig['tcpdumplog'] != "") { $natent['tcpdumplog'] = $pconfig['tcpdumplog']; } + if ($pconfig['snortunifiedlog'] != "") { $natent['snortunifiedlog'] = $pconfig['snortunifiedlog']; } + if ($pconfig['def_ssl_ports_ignore'] != "") { $natent['def_ssl_ports_ignore'] = $pconfig['def_ssl_ports_ignore']; } + if ($pconfig['flow_depth'] != "") { $natent['flow_depth'] = $pconfig['flow_depth']; } + if ($pconfig['perform_stat'] != "") { $natent['perform_stat'] = $pconfig['perform_stat']; } + if ($pconfig['http_inspect'] != "") { $natent['http_inspect'] = $pconfig['http_inspect']; } + if ($pconfig['other_preprocs'] != "") { $natent['other_preprocs'] = $pconfig['other_preprocs']; } + if ($pconfig['ftp_preprocessor'] != "") { $natent['ftp_preprocessor'] = $pconfig['ftp_preprocessor']; } + if ($pconfig['smtp_preprocessor'] != "") { $natent['smtp_preprocessor'] = $pconfig['smtp_preprocessor']; } + if ($pconfig['sf_portscan'] != "") { $natent['sf_portscan'] = $pconfig['sf_portscan']; } + if ($pconfig['dce_rpc_2'] != "") { $natent['dce_rpc_2'] = $pconfig['dce_rpc_2']; } + if ($pconfig['dns_preprocessor'] != "") { $natent['dns_preprocessor'] = $pconfig['dns_preprocessor']; } + if ($pconfig['barnyard_enable'] != "") { $natent['barnyard_enable'] = $pconfig['barnyard_enable']; } + if ($pconfig['barnyard_mysql'] != "") { $natent['barnyard_mysql'] = $pconfig['barnyard_mysql']; } + /* post new options */ if ($_POST['def_dns_servers'] != "") { $natent['def_dns_servers'] = $_POST['def_dns_servers']; }else{ $natent['def_dns_servers'] = ""; } diff --git a/config/snort-dev/snort_gui.inc b/config/snort-dev/snort_gui.inc index d8743b43..90fc8505 100644 --- a/config/snort-dev/snort_gui.inc +++ b/config/snort-dev/snort_gui.inc @@ -36,7 +36,7 @@ function print_info_box_np2($msg) { echo " \n"; echo "
\n"; echo " \n"; echo " "; diff --git a/config/snort-dev/snort_interfaces.php b/config/snort-dev/snort_interfaces.php index 974e2673..1c97f944 100644 --- a/config/snort-dev/snort_interfaces.php +++ b/config/snort-dev/snort_interfaces.php @@ -162,7 +162,7 @@ if ($_GET['act'] == "toggle" && $_GET['id'] != "") { } } -$pgtitle = "Services: Snort 2.8.4.1_5 pkg v. 1.8 beta"; +$pgtitle = "Services: Snort 2.8.4.1_6 pkg v. 1.8 RC1"; include("head.inc"); ?> @@ -192,6 +192,17 @@ padding: 15px 10px 50% 50px; padding-top: 4px; padding-bottom: 4px; } +.listbg3 { + border-right: 1px solid #777777; + border-bottom: 1px solid #777777; + font-size: 11px; + background-color: #777777; + color: #000; + padding-right: 16px; + padding-left: 6px; + padding-top: 4px; + padding-bottom: 4px; +} @@ -307,7 +318,17 @@ padding: 15px 10px 50% 50px; ?> - - @@ -351,13 +372,15 @@ padding: 15px 10px 50% 50px;
\n"; - echo "    \n"; + echo "    \n"; echo " {$msg}\n"; echo " + + +  
Note:
- This is the Snort Interfaces Menu where you can see an over view of all your interface settings. + This is the Snort Menu where you can see an over view of all your interface settings.
- Please edit the Global Settings tab befor adding an interface. + Please edit the Global Settings tab befor adding an interface.

- Click on the Plus Icon to add a interface. + Click on the icon to add a interface.                           Click on the icon to start snort and barnyard. +
+ Click on the icon to edit a interface and settings.      Click on the icon to stop snort and barnyard.
- Click on the Edit Icon to edit interface settings. + Click on the icon to delete a interface and settings.
diff --git a/config/snort-dev/snort_interfaces_edit.php b/config/snort-dev/snort_interfaces_edit.php index cdf2f3e1..881df8a2 100644 --- a/config/snort-dev/snort_interfaces_edit.php +++ b/config/snort-dev/snort_interfaces_edit.php @@ -50,6 +50,52 @@ if (isset($_GET['dup'])) { if (isset($id) && $a_nat[$id]) { + /* old options */ + $pconfig['def_ssl_ports_ignore'] = $a_nat[$id]['def_ssl_ports_ignore']; + $pconfig['flow_depth'] = $a_nat[$id]['flow_depth']; + $pconfig['perform_stat'] = $a_nat[$id]['perform_stat']; + $pconfig['http_inspect'] = $a_nat[$id]['http_inspect']; + $pconfig['other_preprocs'] = $a_nat[$id]['other_preprocs']; + $pconfig['ftp_preprocessor'] = $a_nat[$id]['ftp_preprocessor']; + $pconfig['smtp_preprocessor'] = $a_nat[$id]['smtp_preprocessor']; + $pconfig['sf_portscan'] = $a_nat[$id]['sf_portscan']; + $pconfig['dce_rpc_2'] = $a_nat[$id]['dce_rpc_2']; + $pconfig['dns_preprocessor'] = $a_nat[$id]['dns_preprocessor']; + $pconfig['def_dns_servers'] = $a_nat[$id]['def_dns_servers']; + $pconfig['def_dns_ports'] = $a_nat[$id]['def_dns_ports']; + $pconfig['def_smtp_servers'] = $a_nat[$id]['def_smtp_servers']; + $pconfig['def_smtp_ports'] = $a_nat[$id]['def_smtp_ports']; + $pconfig['def_mail_ports'] = $a_nat[$id]['def_mail_ports']; + $pconfig['def_http_servers'] = $a_nat[$id]['def_http_servers']; + $pconfig['def_www_servers'] = $a_nat[$id]['def_www_servers']; + $pconfig['def_http_ports'] = $a_nat[$id]['def_http_ports']; + $pconfig['def_sql_servers'] = $a_nat[$id]['def_sql_servers']; + $pconfig['def_oracle_ports'] = $a_nat[$id]['def_oracle_ports']; + $pconfig['def_mssql_ports'] = $a_nat[$id]['def_mssql_ports']; + $pconfig['def_telnet_servers'] = $a_nat[$id]['def_telnet_servers']; + $pconfig['def_telnet_ports'] = $a_nat[$id]['def_telnet_ports']; + $pconfig['def_snmp_servers'] = $a_nat[$id]['def_snmp_servers']; + $pconfig['def_snmp_ports'] = $a_nat[$id]['def_snmp_ports']; + $pconfig['def_ftp_servers'] = $a_nat[$id]['def_ftp_servers']; + $pconfig['def_ftp_ports'] = $a_nat[$id]['def_ftp_ports']; + $pconfig['def_ssh_servers'] = $a_nat[$id]['def_ssh_servers']; + $pconfig['def_ssh_ports'] = $a_nat[$id]['def_ssh_ports']; + $pconfig['def_pop_servers'] = $a_nat[$id]['def_pop_servers']; + $pconfig['def_pop2_ports'] = $a_nat[$id]['def_pop2_ports']; + $pconfig['def_pop3_ports'] = $a_nat[$id]['def_pop3_ports']; + $pconfig['def_imap_servers'] = $a_nat[$id]['def_imap_servers']; + $pconfig['def_imap_ports'] = $a_nat[$id]['def_imap_ports']; + $pconfig['def_sip_proxy_ip'] = $a_nat[$id]['def_sip_proxy_ip']; + $pconfig['ip def_sip_proxy_ports'] = $a_nat[$id]['ip def_sip_proxy_ports']; + $pconfig['def_auth_ports'] = $a_nat[$id]['def_auth_ports']; + $pconfig['def_finger_ports'] = $a_nat[$id]['def_finger_ports']; + $pconfig['def_irc_ports'] = $a_nat[$id]['def_irc_ports']; + $pconfig['def_nntp_ports'] = $a_nat[$id]['def_nntp_ports']; + $pconfig['def_rlogin_ports'] = $a_nat[$id]['def_rlogin_ports']; + $pconfig['def_rsh_ports'] = $a_nat[$id]['def_rsh_ports']; + $pconfig['def_ssl_ports'] = $a_nat[$id]['def_ssl_ports']; + $pconfig['barnyard_enable'] = $a_nat[$id]['barnyard_enable']; + $pconfig['barnyard_mysql'] = $a_nat[$id]['barnyard_mysql']; $pconfig['enable'] = $a_nat[$id]['enable']; $pconfig['interface'] = $a_nat[$id]['interface']; $pconfig['descr'] = $a_nat[$id]['descr']; @@ -59,9 +105,6 @@ if (isset($id) && $a_nat[$id]) { $pconfig['alertsystemlog'] = $a_nat[$id]['alertsystemlog']; $pconfig['tcpdumplog'] = $a_nat[$id]['tcpdumplog']; $pconfig['snortunifiedlog'] = $a_nat[$id]['snortunifiedlog']; - $pconfig['flow_depth'] = $a_nat[$id]['flow_depth']; - $pconfig['barnyard_enable'] = $a_nat[$id]['barnyard_enable']; - $pconfig['barnyard_mysql'] = $a_nat[$id]['barnyard_mysql']; if (!$pconfig['interface']) $pconfig['interface'] = "wan"; @@ -150,7 +193,7 @@ if ($_POST["Submit"]) { continue; } -/* if no errors write to conf */ + /* if no errors write to conf */ if (!$input_errors) { $natent = array(); @@ -167,10 +210,55 @@ if ($_POST["Submit"]) { if ($_POST['tcpdumplog'] == "on") { $natent['tcpdumplog'] = on; }else{ $natent['tcpdumplog'] = off; } if ($_POST['enable'] == "") { $natent['tcpdumplog'] = $pconfig['tcpdumplog']; } if ($_POST['snortunifiedlog'] == "on") { $natent['snortunifiedlog'] = on; }else{ $natent['snortunifiedlog'] = off; } if ($_POST['enable'] == "") { $natent['snortunifiedlog'] = $pconfig['snortunifiedlog']; } /* if optiion = 0 then the old descr way will not work */ - if ($_POST['flow_depth'] != "") { $natent['flow_depth'] = $_POST['flow_depth']; }else{ $natent['flow_depth'] = $pconfig['flow_depth']; } - /* rewrite the options that are not in post */ - $natent['barnyard_enable'] = $pconfig['barnyard_enable']; - $natent['barnyard_mysql'] = $pconfig['barnyard_mysql']; + + /* rewrite the options that are not in post */ + /* make shure values are set befor repost or conf.xml will be broken */ + if ($pconfig['def_ssl_ports_ignore'] != "") { $natent['def_ssl_ports_ignore'] = $pconfig['def_ssl_ports_ignore']; } + if ($pconfig['flow_depth'] != "") { $natent['flow_depth'] = $pconfig['flow_depth']; } + if ($pconfig['perform_stat'] != "") { $natent['perform_stat'] = $pconfig['perform_stat']; } + if ($pconfig['http_inspect'] != "") { $natent['http_inspect'] = $pconfig['http_inspect']; } + if ($pconfig['other_preprocs'] != "") { $natent['other_preprocs'] = $pconfig['other_preprocs']; } + if ($pconfig['ftp_preprocessor'] != "") { $natent['ftp_preprocessor'] = $pconfig['ftp_preprocessor']; } + if ($pconfig['smtp_preprocessor'] != "") { $natent['smtp_preprocessor'] = $pconfig['smtp_preprocessor']; } + if ($pconfig['sf_portscan'] != "") { $natent['sf_portscan'] = $pconfig['sf_portscan']; } + if ($pconfig['dce_rpc_2'] != "") { $natent['dce_rpc_2'] = $pconfig['dce_rpc_2']; } + if ($pconfig['dns_preprocessor'] != "") { $natent['dns_preprocessor'] = $pconfig['dns_preprocessor']; } + if ($pconfig['def_dns_servers'] != "") { $natent['def_dns_servers'] = $pconfig['def_dns_servers']; } + if ($pconfig['def_dns_ports'] != "") { $natent['def_dns_ports'] = $pconfig['def_dns_ports']; } + if ($pconfig['def_smtp_servers'] != "") { $natent['def_smtp_servers'] = $pconfig['def_smtp_servers']; } + if ($pconfig['def_smtp_ports'] != "") { $natent['def_smtp_ports'] = $pconfig['def_smtp_ports']; } + if ($pconfig['def_mail_ports'] != "") { $natent['def_mail_ports'] = $pconfig['def_mail_ports']; } + if ($pconfig['def_http_servers'] != "") { $natent['def_http_servers'] = $pconfig['def_http_servers']; } + if ($pconfig['def_www_servers'] != "") { $natent['def_www_servers'] = $pconfig['def_www_servers']; } + if ($pconfig['def_http_ports'] != "") { $natent['def_http_ports'] = $pconfig['def_http_ports']; } + if ($pconfig['def_sql_servers'] != "") { $natent['def_sql_servers'] = $pconfig['def_sql_servers']; } + if ($pconfig['def_oracle_ports'] != "") { $natent['def_oracle_ports'] = $pconfig['def_oracle_ports']; } + if ($pconfig['def_mssql_ports'] != "") { $natent['def_mssql_ports'] = $pconfig['def_mssql_ports']; } + if ($pconfig['def_telnet_servers'] != "") { $natent['def_telnet_servers'] = $pconfig['def_telnet_servers']; } + if ($pconfig['def_telnet_ports'] != "") { $natent['def_telnet_ports'] = $pconfig['def_telnet_ports']; } + if ($pconfig['def_snmp_servers'] != "") { $natent['def_snmp_servers'] = $pconfig['def_snmp_servers']; } + if ($pconfig['def_snmp_ports'] != "") { $natent['def_snmp_ports'] = $pconfig['def_snmp_ports']; } + if ($pconfig['def_ftp_servers'] != "") { $natent['def_ftp_servers'] = $pconfig['def_ftp_servers']; } + if ($pconfig['def_ftp_ports'] != "") { $natent['def_ftp_ports'] = $pconfig['def_ftp_ports']; } + if ($pconfig['def_ssh_servers'] != "") { $natent['def_ssh_servers'] = $pconfig['def_ssh_servers']; } + if ($pconfig['def_ssh_ports'] != "") { $natent['def_ssh_ports'] = $pconfig['def_ssh_ports']; } + if ($pconfig['def_pop_servers'] != "") { $natent['def_pop_servers'] = $pconfig['def_pop_servers']; } + if ($pconfig['def_pop2_ports'] != "") { $natent['def_pop2_ports'] = $pconfig['def_pop2_ports']; } + if ($pconfig['def_pop3_ports'] != "") { $natent['def_pop3_ports'] = $pconfig['def_pop3_ports']; } + if ($pconfig['def_imap_servers'] != "") { $natent['def_imap_servers'] = $pconfig['def_imap_servers']; } + if ($pconfig['def_imap_ports'] != "") { $natent['def_imap_ports'] = $pconfig['def_imap_ports']; } + if ($pconfig['def_sip_proxy_ip'] != "") { $natent['def_sip_proxy_ip'] = $pconfig['def_sip_proxy_ip']; } + if ($pconfig['ip def_sip_proxy_ports'] != "") { $natent['ip def_sip_proxy_ports'] = $pconfig['ip def_sip_proxy_ports']; } + if ($pconfig['def_auth_ports'] != "") { $natent['def_auth_ports'] = $pconfig['def_auth_ports']; } + if ($pconfig['def_finger_ports'] != "") { $natent['def_finger_ports'] = $pconfig['def_finger_ports']; } + if ($pconfig['def_irc_ports'] != "") { $natent['def_irc_ports'] = $pconfig['def_irc_ports']; } + if ($pconfig['def_nntp_ports'] != "") { $natent['def_nntp_ports'] = $pconfig['def_nntp_ports']; } + if ($pconfig['def_rlogin_ports'] != "") { $natent['def_rlogin_ports'] = $pconfig['def_rlogin_ports']; } + if ($pconfig['def_rsh_ports'] != "") { $natent['def_rsh_ports'] = $pconfig['def_rsh_ports']; } + if ($pconfig['def_ssl_ports'] != "") { $natent['def_ssl_ports'] = $pconfig['def_ssl_ports']; } + if ($pconfig['barnyard_enable'] != "") { $natent['barnyard_enable'] = $pconfig['barnyard_enable']; } + if ($pconfig['barnyard_mysql'] != "") { $natent['barnyard_mysql'] = $pconfig['barnyard_mysql']; } + if (isset($id) && $a_nat[$id]) $a_nat[$id] = $natent; @@ -246,7 +334,6 @@ echo " document.iform.descr.disabled = endis;\n"; } ?> - document.iform.flow_depth.disabled = endis; document.iform.performance.disabled = endis; document.iform.blockoffenders7.disabled = endis; document.iform.snortalertlogtype.disabled = endis; @@ -432,18 +519,6 @@ if($id != "") onClick="enable_change(false)">
Snort will log Alerts to a file in the UNIFIED2 format. This is a requirement for barnyard2. - - HTTP server flow depth - - - - - -
-1 to 1460 (-1 disables HTTP inspect, 0 enables all HTTP inspect)
- Amount of HTTP server response payload to inspect. Snort's performance may increase by ajusting this value.
- Setting this value too low may cause false negatives. Value above 0 is in bytes.
- Default value is 0 -   diff --git a/config/snort-dev/snort_preprocessors.php b/config/snort-dev/snort_preprocessors.php index 88f90b2e..39ed86d4 100644 --- a/config/snort-dev/snort_preprocessors.php +++ b/config/snort-dev/snort_preprocessors.php @@ -58,8 +58,16 @@ if (isset($_GET['dup'])) { if (isset($id) && $a_nat[$id]) { /* new options */ - $pconfig['perform_stat'] = $a_nat[$id]['perform_stat']; $pconfig['def_ssl_ports_ignore'] = $a_nat[$id]['def_ssl_ports_ignore']; + $pconfig['flow_depth'] = $a_nat[$id]['flow_depth']; + $pconfig['perform_stat'] = $a_nat[$id]['perform_stat']; + $pconfig['http_inspect'] = $a_nat[$id]['http_inspect']; + $pconfig['other_preprocs'] = $a_nat[$id]['other_preprocs']; + $pconfig['ftp_preprocessor'] = $a_nat[$id]['ftp_preprocessor']; + $pconfig['smtp_preprocessor'] = $a_nat[$id]['smtp_preprocessor']; + $pconfig['sf_portscan'] = $a_nat[$id]['sf_portscan']; + $pconfig['dce_rpc_2'] = $a_nat[$id]['dce_rpc_2']; + $pconfig['dns_preprocessor'] = $a_nat[$id]['dns_preprocessor']; /* old options */ $pconfig['def_dns_servers'] = $a_nat[$id]['def_dns_servers']; @@ -123,55 +131,63 @@ if ($_POST) { if (!$input_errors) { $natent = array(); /* repost the options already in conf */ - $natent['enable'] = $pconfig['enable']; - $natent['interface'] = $pconfig['interface']; - $natent['descr'] = $pconfig['descr']; - $natent['performance'] = $pconfig['performance']; - $natent['blockoffenders7'] = $pconfig['blockoffenders7']; - $natent['snortalertlogtype'] = $pconfig['snortalertlogtype']; - $natent['alertsystemlog'] = $pconfig['alertsystemlog']; - $natent['tcpdumplog'] = $pconfig['tcpdumplog']; - $natent['snortunifiedlog'] = $pconfig['snortunifiedlog']; - $natent['flow_depth'] = $pconfig['flow_depth']; - $natent['barnyard_enable'] = $pconfig['barnyard_enable']; - $natent['barnyard_mysql'] = $pconfig['barnyard_mysql']; - $natent['def_dns_servers'] = $pconfig['def_dns_servers']; - $natent['def_dns_ports'] = $pconfig['def_dns_ports']; - $natent['def_smtp_servers'] = $pconfig['def_smtp_servers']; - $natent['def_smtp_ports'] = $pconfig['def_smtp_ports']; - $natent['def_mail_ports'] = $pconfig['def_mail_ports']; - $natent['def_http_servers'] = $pconfig['def_http_servers']; - $natent['def_www_servers'] = $pconfig['def_www_servers']; - $natent['def_http_ports'] = $pconfig['def_http_ports']; - $natent['def_sql_servers'] = $pconfig['def_sql_servers']; - $natent['def_oracle_ports'] = $pconfig['def_oracle_ports']; - $natent['def_mssql_ports'] = $pconfig['def_mssql_ports']; - $natent['def_telnet_servers'] = $pconfig['def_telnet_servers']; - $natent['def_telnet_ports'] = $pconfig['def_telnet_ports']; - $natent['def_snmp_servers'] = $pconfig['def_snmp_servers']; - $natent['def_snmp_ports'] = $pconfig['def_snmp_ports']; - $natent['def_ftp_servers'] = $pconfig['def_ftp_servers']; - $natent['def_ftp_ports'] = $pconfig['def_ftp_ports']; - $natent['def_ssh_servers'] = $pconfig['def_ssh_servers']; - $natent['def_ssh_ports'] = $pconfig['def_ssh_ports']; - $natent['def_pop_servers'] = $pconfig['def_pop_servers']; - $natent['def_pop2_ports'] = $pconfig['def_pop2_ports']; - $natent['def_pop3_ports'] = $pconfig['def_pop3_ports']; - $natent['def_imap_servers'] = $pconfig['def_imap_servers']; - $natent['def_imap_ports'] = $pconfig['def_imap_ports']; - $natent['def_sip_proxy_ip'] = $pconfig['def_sip_proxy_ip']; - $natent['def_sip_proxy_ports'] = $pconfig['def_sip_proxy_ports']; - $natent['def_auth_ports'] = $pconfig['def_auth_ports']; - $natent['def_finger_ports'] = $pconfig['def_finger_ports']; - $natent['def_irc_ports'] = $pconfig['def_irc_ports']; - $natent['def_nntp_ports'] = $pconfig['def_nntp_ports']; - $natent['def_rlogin_ports'] = $pconfig['def_rlogin_ports']; - $natent['def_rsh_ports'] = $pconfig['def_rsh_ports']; - $natent['def_ssl_ports'] = $pconfig['def_ssl_ports']; + if ($pconfig['interface'] != "") { $natent['interface'] = $pconfig['interface']; } + if ($pconfig['enable'] != "") { $natent['enable'] = $pconfig['enable']; } + if ($pconfig['descr'] != "") { $natent['descr'] = $pconfig['descr']; } + if ($pconfig['performance'] != "") { $natent['performance'] = $pconfig['performance']; } + if ($pconfig['blockoffenders7'] != "") { $natent['blockoffenders7'] = $pconfig['blockoffenders7']; } + if ($pconfig['snortalertlogtype'] != "") { $natent['snortalertlogtype'] = $pconfig['snortalertlogtype']; } + if ($pconfig['alertsystemlog'] != "") { $natent['alertsystemlog'] = $pconfig['alertsystemlog']; } + if ($pconfig['tcpdumplog'] != "") { $natent['tcpdumplog'] = $pconfig['tcpdumplog']; } + if ($pconfig['snortunifiedlog'] != "") { $natent['snortunifiedlog'] = $pconfig['snortunifiedlog']; } + if ($pconfig['barnyard_enable'] != "") { $natent['barnyard_enable'] = $pconfig['barnyard_enable']; } + if ($pconfig['barnyard_mysql'] != "") { $natent['barnyard_mysql'] = $pconfig['barnyard_mysql']; } + if ($pconfig['def_dns_servers'] != "") { $natent['def_dns_servers'] = $pconfig['def_dns_servers']; } + if ($pconfig['def_dns_ports'] != "") { $natent['def_dns_ports'] = $pconfig['def_dns_ports']; } + if ($pconfig['def_smtp_servers'] != "") { $natent['def_smtp_servers'] = $pconfig['def_smtp_servers']; } + if ($pconfig['def_smtp_ports'] != "") { $natent['def_smtp_ports'] = $pconfig['def_smtp_ports']; } + if ($pconfig['def_mail_ports'] != "") { $natent['def_mail_ports'] = $pconfig['def_mail_ports']; } + if ($pconfig['def_http_servers'] != "") { $natent['def_http_servers'] = $pconfig['def_http_servers']; } + if ($pconfig['def_www_servers'] != "") { $natent['def_www_servers'] = $pconfig['def_www_servers']; } + if ($pconfig['def_http_ports'] != "") { $natent['def_http_ports'] = $pconfig['def_http_ports']; } + if ($pconfig['def_sql_servers'] != "") { $natent['def_sql_servers'] = $pconfig['def_sql_servers']; } + if ($pconfig['def_oracle_ports'] != "") { $natent['def_oracle_ports'] = $pconfig['def_oracle_ports']; } + if ($pconfig['def_mssql_ports'] != "") { $natent['def_mssql_ports'] = $pconfig['def_mssql_ports']; } + if ($pconfig['def_telnet_servers'] != "") { $natent['def_telnet_servers'] = $pconfig['def_telnet_servers']; } + if ($pconfig['def_telnet_ports'] != "") { $natent['def_telnet_ports'] = $pconfig['def_telnet_ports']; } + if ($pconfig['def_snmp_servers'] != "") { $natent['def_snmp_servers'] = $pconfig['def_snmp_servers']; } + if ($pconfig['def_snmp_ports'] != "") { $natent['def_snmp_ports'] = $pconfig['def_snmp_ports']; } + if ($pconfig['def_ftp_servers'] != "") { $natent['def_ftp_servers'] = $pconfig['def_ftp_servers']; } + if ($pconfig['def_ftp_ports'] != "") { $natent['def_ftp_ports'] = $pconfig['def_ftp_ports']; } + if ($pconfig['def_ssh_servers'] != "") { $natent['def_ssh_servers'] = $pconfig['def_ssh_servers']; } + if ($pconfig['def_ssh_ports'] != "") { $natent['def_ssh_ports'] = $pconfig['def_ssh_ports']; } + if ($pconfig['def_pop_servers'] != "") { $natent['def_pop_servers'] = $pconfig['def_pop_servers']; } + if ($pconfig['def_pop2_ports'] != "") { $natent['def_pop2_ports'] = $pconfig['def_pop2_ports']; } + if ($pconfig['def_pop3_ports'] != "") { $natent['def_pop3_ports'] = $pconfig['def_pop3_ports']; } + if ($pconfig['def_imap_servers'] != "") { $natent['def_imap_servers'] = $pconfig['def_imap_servers']; } + if ($pconfig['def_imap_ports'] != "") { $natent['def_imap_ports'] = $pconfig['def_imap_ports']; } + if ($pconfig['def_sip_proxy_ip'] != "") { $natent['def_sip_proxy_ip'] = $pconfig['def_sip_proxy_ip']; } + if ($pconfig['ip def_sip_proxy_ports'] != "") { $natent['ip def_sip_proxy_ports'] = $pconfig['ip def_sip_proxy_ports']; } + if ($pconfig['def_auth_ports'] != "") { $natent['def_auth_ports'] = $pconfig['def_auth_ports']; } + if ($pconfig['def_finger_ports'] != "") { $natent['def_finger_ports'] = $pconfig['def_finger_ports']; } + if ($pconfig['def_irc_ports'] != "") { $natent['def_irc_ports'] = $pconfig['def_irc_ports']; } + if ($pconfig['def_nntp_ports'] != "") { $natent['def_nntp_ports'] = $pconfig['def_nntp_ports']; } + if ($pconfig['def_rlogin_ports'] != "") { $natent['def_rlogin_ports'] = $pconfig['def_rlogin_ports']; } + if ($pconfig['def_rsh_ports'] != "") { $natent['def_rsh_ports'] = $pconfig['def_rsh_ports']; } + if ($pconfig['def_ssl_ports'] != "") { $natent['def_ssl_ports'] = $pconfig['def_ssl_ports']; } /* post new options */ $natent['perform_stat'] = $_POST['perform_stat']; if ($_POST['def_ssl_ports_ignore'] != "") { $natent['def_ssl_ports_ignore'] = $_POST['def_ssl_ports_ignore']; }else{ $natent['def_ssl_ports_ignore'] = ""; } + if ($_POST['flow_depth'] != "") { $natent['flow_depth'] = $_POST['flow_depth']; }else{ $natent['flow_depth'] = ""; } + $natent['perform_stat'] = $_POST['perform_stat'] ? on : off; + $natent['http_inspect'] = $_POST['http_inspect'] ? on : off; + $natent['other_preprocs'] = $_POST['other_preprocs'] ? on : off; + $natent['ftp_preprocessor'] = $_POST['ftp_preprocessor'] ? on : off; + $natent['smtp_preprocessor'] = $_POST['smtp_preprocessor'] ? on : off; + $natent['sf_portscan'] = $_POST['sf_portscan'] ? on : off; + $natent['dce_rpc_2'] = $_POST['dce_rpc_2'] ? on : off; + $natent['dns_preprocessor'] = $_POST['dns_preprocessor'] ? on : off; if (isset($id) && $a_nat[$id]) $a_nat[$id] = $natent; @@ -268,22 +284,77 @@ if($id != "") ?>   - Note:
- Please save your settings befor you click start.
- Please make sure there are no spaces in your definitions. + Note:
+ RULES MAY DEPENDENT ON Preprocessors!
+ Please save your settings befor you click start.
- perform_stat + Enable
Performance Statistics onClick="enable_change(false)">
- Emerging Threats is an open source community that produces fastest moving and diverse Snort Rules. + Performance Statistics for this interface. + + Enable
HTTP Inspect + + onClick="enable_change(false)">
+ Normalize/Decode and detect HTTP traffic and protocol anomalies. + + + HTTP server flow depth + + + + + +
-1 to 1460 (-1 disables HTTP inspect, 0 enables all HTTP inspect)
+ Amount of HTTP server response payload to inspect. Snort's performance may increase by ajusting this value.
+ Setting this value too low may cause false negatives. Value above 0 is in bytes.
+ Default value is 0 + + + Enable
RPC Decode and Back Orifice detector + + onClick="enable_change(false)">
+ Normalize/Decode RPC traffic and detects Back Orifice traffic on the network. + + + Enable
FTP & Telnet Normalizer + + onClick="enable_change(false)">
+ Normalize/Decode FTP & Telnet traffic and protocol anomalies. + + + Enable
SMTP Normalizer + + onClick="enable_change(false)">
+ Normalize/Decode SMTP protocol for enforcement and buffer overflows. + + + Enable
Portscan Detection + + onClick="enable_change(false)">
+ Detects various types of portscans and portsweeps. + + + Enable
DCE/RPC2 Detection + + onClick="enable_change(false)">
+ The dcerpc preprocessor detects and decodes SMB and DCE/RPC traffic. + + + Enable
DNS Detection + + onClick="enable_change(false)">
+ The dns preprocessor (currently) decodes DNS Response traffic and detects a few vulnerabilities. + Define SSL_IGNORE -
Example: "443 465 563 636 989 990 992 993 994 995". +
Encrypted traffic should be ignored by Snort for both performance reasons and to reduce false positives.
+ Default: "443 465 563 636 989 990 992 993 994 995". Please use spaces and not commas.   diff --git a/config/snort-dev/snort_rulesets.php b/config/snort-dev/snort_rulesets.php index 14d9e01c..e98244d0 100644 --- a/config/snort-dev/snort_rulesets.php +++ b/config/snort-dev/snort_rulesets.php @@ -29,7 +29,7 @@ */ require("guiconfig.inc"); -require("filter.inc"); +require_once("filter.inc"); require_once("service-utils.inc"); if (!is_array($config['installedpackages']['snortglobal']['rule'])) { -- cgit v1.2.3