In this demo,
we'll begin using Snort file detection to capture files
that pass through our Snort server.
We'll start out by configuring Snort to enable file detection,
processing, and capture.
Globomantics is most worried about the ability for hackers to send
malicious executables for Windows or Linux platforms and wants us to
detect and log information about executable files that are transferred
between internal and external networks.
They also want you to capture all transferred files for further
analysis to determine if they're potentially malicious.
Once we have the rules in place,
we need to test our rules to ensure that these files are detected.
Let's head over to our Snort VM and configure file processing.
As mentioned in the last clip, file processing is configured within snort.lua.
There are a few settings we need to configure.
The first is changing the file_path for file_magic.lua in this
includes statement to reflect its actual path.
My file is in the /usr/local/etc/snort directory.
If you're not sure where file_magic.lua is located on your system,
you can use the locate command to find it.
If you haven't used this before, make sure you run updatedb first.
Once we have this path set, we can continue to configure file processing,
which is within the second area, configure inspection.
The default configuration is this single line here.
We need to add quite a bit of configuration to enable our own rules and
configure this capability to accomplish our goals.
This line setting file_rule to file_magic is fine as is,
but we need to configure a file_policy to contain our actual rules.
A file_policy rule starts with the word when,
followed by an = sign, and then the match.
For this rule,
we will match by file_type ID and set it equal to 21, which
corresponds to Microsoft .exe files in file_magic.lua.
We then close the bracket and add a comma to end this statement.
Next, we need to tell Snort what to do when a file_type
matches this ID. We enter the command use and set it equal
to another series of statements.
Verdict is our action that we want Snort to take. Based on our
security goals, we should use log and place it in quotes. Using
another comma to separate our actions, we can then enter two Boolean
values that will satisfy the rest of our goals. To capture files, we
can add the statement, enable_file_capture and set that equal to true.
To capture the file signature, we use another command,
enable_file_signature and set that equal to true as well.
Then we just close out our brackets and add another comma to end this rule.
To identify Linux rules,
we follow the exact same format but change the file ID to
46, which corresponds to ELF. I will copy and paste to save
some time with this example.
Now that that is complete, we have our rules for this demo.
There is one more configuration we need for this to work.
We have to set our file_log properties.
To do that,
we add another line called file_log and set it equal to another set of brackets.
Within these brackets,
we have two more Boolean values to configure. Log_pkt_time,
which we will set equal to true, and log_sys_time,
which we will set equal to false.
Now that those are entered,
we're ready to capture files. Let's save this file and exit out.
Then we'll start up Snort and see what our output looks like.
As long as Snort starts up correctly, you probably didn't make any mistakes.
If you get an error, go back and make sure you enter the information correctly.
Lua, like any other programming language, is not going to guess what you mean.
A missing comma is enough to make this fail.
Now that we have Snort running, we're ready to test these file rules,
but we'll do that in the next demo.