From 844fbe052e814a4662dedcf3a09fbfcdb814801a Mon Sep 17 00:00:00 2001 From: robiscool Date: Wed, 31 Mar 2010 19:02:32 -0700 Subject: snort-dev to snort, snort to snort-old, Release --- config/snort/snort_interfaces_global.php | 380 +++++++++++++++++++++++++++++++ 1 file changed, 380 insertions(+) create mode 100644 config/snort/snort_interfaces_global.php (limited to 'config/snort/snort_interfaces_global.php') diff --git a/config/snort/snort_interfaces_global.php b/config/snort/snort_interfaces_global.php new file mode 100644 index 00000000..ff3620a3 --- /dev/null +++ b/config/snort/snort_interfaces_global.php @@ -0,0 +1,380 @@ +. + All rights reserved. + + Copyright (C) 2008-2009 Robert Zelaya + Modified for the Pfsense snort package. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +$pgtitle = "Services: Snort: Global Settings"; +require_once("guiconfig.inc"); +require_once("/usr/local/pkg/snort/snort.inc"); + +/* make things short */ +$pconfig['snortdownload'] = $config['installedpackages']['snortglobal']['snortdownload']; +$pconfig['oinkmastercode'] = $config['installedpackages']['snortglobal']['oinkmastercode']; +$pconfig['emergingthreats'] = $config['installedpackages']['snortglobal']['emergingthreats']; +$pconfig['rm_blocked'] = $config['installedpackages']['snortglobal']['rm_blocked']; +$pconfig['autorulesupdate7'] = $config['installedpackages']['snortglobal']['autorulesupdate7']; +$pconfig['whitelistvpns'] = $config['installedpackages']['snortglobal']['whitelistvpns']; +$pconfig['clickablalerteurls'] = $config['installedpackages']['snortglobal']['clickablalerteurls']; +$pconfig['associatealertip'] = $config['installedpackages']['snortglobal']['associatealertip']; +$pconfig['snortalertlogtype'] = $config['installedpackages']['snortglobal']['snortalertlogtype']; + + +if ($_POST) { + + unset($input_errors); + $pconfig = $_POST; + + /* input validation */ + if ($_POST['enable']) + { + +/* TODO:a dd check user input code. */ + + } + + if (!$input_errors) { + + if ($_POST["Submit"]) { + + $config['installedpackages']['snortglobal']['snortdownload'] = $_POST['snortdownload']; + $config['installedpackages']['snortglobal']['oinkmastercode'] = $_POST['oinkmastercode']; + $config['installedpackages']['snortglobal']['emergingthreats'] = $_POST['emergingthreats'] ? on : off; + $config['installedpackages']['snortglobal']['rm_blocked'] = $_POST['rm_blocked']; + $config['installedpackages']['snortglobal']['autorulesupdate7'] = $_POST['autorulesupdate7']; + $config['installedpackages']['snortglobal']['whitelistvpns'] = $_POST['whitelistvpns'] ? on : off; + $config['installedpackages']['snortglobal']['clickablalerteurls'] = $_POST['clickablalerteurls'] ? on : off; + $config['installedpackages']['snortglobal']['associatealertip'] = $_POST['associatealertip'] ? on : off; + $config['installedpackages']['snortglobal']['snortalertlogtype'] = $_POST['snortalertlogtype']; + + write_config(); + sleep(2); + + $retval = 0; + + /* set the snort block hosts time IMPORTANT */ + $snort_rm_blocked_info_ck = $config['installedpackages']['snortglobal']['rm_blocked']; + if ($snort_rm_blocked_info_ck == "never_b") + $snort_rm_blocked_false = ""; + else + $snort_rm_blocked_false = "true"; + + if ($snort_rm_blocked_info_ck != "") + { + snort_rm_blocked_install_cron(""); + snort_rm_blocked_install_cron($snort_rm_blocked_false); + } + + /* set the snort rules update time */ + $snort_rules_up_info_ck = $config['installedpackages']['snortglobal']['autorulesupdate7']; + if ($snort_rules_up_info_ck == "never_up") + $snort_rules_up_false = ""; + else + $snort_rules_up_false = "true"; + + if ($snort_rules_up_info_ck != "") + { + snort_rules_up_install_cron(""); + snort_rules_up_install_cron($snort_rules_up_false); + } + + + + $savemsg = get_std_save_message($retval); + + } + + sync_snort_package_all(); + sync_snort_package(); + +} + + + if ($_POST["Reset"]) { + +//////>>>>>>>>> + + function snort_deinstall_settings() +{ + + global $config, $g, $id, $if_real; + conf_mount_rw(); + + + exec("/usr/usr/bin/killall snort"); + sleep(2); + exec("/usr/usr/bin/killall -9 snort"); + sleep(2); + exec("/usr/usr/bin/killall barnyard2"); + sleep(2); + exec("/usr/usr/bin/killall -9 barnyard2"); + sleep(2); + + /* Remove snort cron entries Ugly code needs smoothness*/ +function snort_rm_blocked_deinstall_cron($should_install) +{ + global $config, $g; + conf_mount_rw(); + + $is_installed = false; + + if(!$config['cron']['item']) + return; + + $x=0; + foreach($config['cron']['item'] as $item) + { + if (strstr($item['command'], "snort2c")) + { + $is_installed = true; + break; + } + + $x++; + + } + if($is_installed == true) + { + if($x > 0) + { + unset($config['cron']['item'][$x]); + write_config(); + conf_mount_rw(); + } + + configure_cron(); + + } + conf_mount_ro(); + +} + + function snort_rules_up_deinstall_cron($should_install) +{ + global $config, $g; + conf_mount_rw(); + + $is_installed = false; + + if(!$config['cron']['item']) + return; + + $x=0; + foreach($config['cron']['item'] as $item) { + if (strstr($item['command'], "snort_check_for_rule_updates.php")) { + $is_installed = true; + break; + } + $x++; + } + if($is_installed == true) { + if($x > 0) { + unset($config['cron']['item'][$x]); + write_config(); + conf_mount_rw(); + } + configure_cron(); + } +} + +snort_rm_blocked_deinstall_cron(""); +snort_rules_up_deinstall_cron(""); + + + /* Unset snort registers in conf.xml IMPORTANT snort will not start with out this */ + /* Keep this as a last step */ + unset($config['installedpackages']['snortglobal']); + write_config(); + conf_mount_rw(); + + /* remove all snort iface dir */ + exec('rm -r /usr/local/etc/snort/snort_*'); + exec('rm /var/log/snort/*'); + + conf_mount_ro(); + +} + + snort_deinstall_settings(); + + header( 'Expires: Sat, 26 Jul 1997 05:00:00 GMT' ); + header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s' ) . ' GMT' ); + header( 'Cache-Control: no-store, no-cache, must-revalidate' ); + header( 'Cache-Control: post-check=0, pre-check=0', false ); + header( 'Pragma: no-cache' ); + sleep(2); + header("Location: /snort/snort_interfaces_global.php"); + + exit; + +//////>>>>>>>>> + } +} + +include("head.inc"); +?> + +

+ + + + +
+ + + + + +
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Install Snort.org rules + + + + + + + + + + + + + + +
> + Do NOT install
> + Premium rules HIGHLY RECOMMENDED
> + Basic Rules
  
+ + + + + + + +
Oinkmaster code
Code
+ Obtain a snort.org Oinkmaster code and paste here.
+
Install Emergingthreats rules + onClick="enable_change(false)">
+ Emerging Threats is an open source community that produces fastest moving and diverse Snort Rules.
Remove blocked hosts every +
+ Please select the amount of time you would like hosts to be blocked for.
+ Hint: in most cases, 1 hour is a good choice.
Update rules automatically +
+ Please select the update times for rules.
+ Hint: in most cases, every 12 hours is a good choice.
Whitelist VPNs automatically + onClick="enable_change(false)">
+ Checking this option will install whitelists for all VPNs.
Alerts file description type +
+ Please choose the type of Alert logging you will like see in your alert file.
+ Hint: Best pratice is to chose full logging. WARNING: On change, alert file will be cleared.
 WARNING:
+ This will reset all global and interface settings. + 		+ +
 Note:
 + Changing any settings on this page will affect all interfaces. Please, double check if your oink code is correct and the type of snort.org account you hold.
+
+
+ + + + -- cgit v1.2.3