Alright, our Snort server is up and running,
and we captured our first packets traveling between
the internal and external networks.
Although we can use this to monitor activity,
it's not a very useful implementation of Snort and
ignores many of its valuable capabilities.
If we want Snort to start generating alerts to warn us of
possible attacks to the Globomantics network,
we need to make some changes to the configuration and use rules files.
Our changes will start in the Snort configuration file.
Every installation of Snort includes a configuration file called snort.lua.
This file is written in the Lua programming language and is used to
enable and configure over 200 modules in Snort.
The file includes headings and comments to let you know what
different sections and variables are used for. Let's look at an
example excerpt from the included template.
This example is the first configuration section. In this section,
we can set the HOME_NET and EXTERNAL_NET variables, which are used
by the community and registered rules.
In this example from my configuration file,
I already changed the HOME_NET to correspond to my internal LAN
that contains Globomantic's VMs. In this course,
I'm leaving the EXTERNAL_NET set to any.
We'll explore more the configuration file in the next demo.
For now, let's move onto the rules files.
The Snort rules files can come from multiple sources,
the first being the local rules that you write.
If you followed the lab install guide,
you wrote two local rules to test Snort's functionality.
As I mentioned earlier, writing custom rules is beyond the scope of this course.
However, there are multiple sources of pre‑configured rules you can download.
You can obtain community rules from Snort's website for
free without registering for an account.
You can also create a free account on snort.org,
which will give you an oinkcode and access to registered rules.
I will use both registered and community rules in the demos,
but if you prefer not to create an account,
you can still mostly follow along with only the community rules.
Finally,
Snort offers a paid subscription service for individuals and
businesses to obtain subscriber rules.
An example rules file contains a series of lines,
typically starting with the word alert.
These examples are from the builtin rules file
included with the registered rules.
The basic rule structure of these builtin rules includes a
message followed by a signature id and global id of the
corresponding builtin rule.
You can find out the name of the actual builtin rule these alerts are
tied to by using the signature id and global id and matching them up
with the list in Snort's user manual.
Another example is one of those two that you may have
created if you followed the install guide.
This rule is formatted in a similar way,
starting with alert, but then followed by a protocol, and
a source and destination IP address,
along with the direction of the traffic flow. Just as above, this rule
starts with the word alert, followed by the protocol ICMP, and a source
and destination IP address, in this case,
any any to any any. This rule is set to match any
ICMP traffic flowing through Snort,
which is why it serves as a good test that your Snort
server is functioning correctly.
If we call this rules file when we start up Snort, we can send a
ping anywhere between the external and internal networks, and
Snort will begin generating alerts for every ICMP packet sent
between the two devices.
Now that we know the basics of Snort's configuration rules files,
we're ready for the next demo where we'll take a closer look at the
ones that are included with our installation of Snort and then move
into another demo where we'll obtain and enable some of those
community and registered rules.