After seeing Snort's performance with the community and registered rules,
Globomantics is pleased with our work, but before we can rest,
they have two more requests we need to satisfy.
They were happy with the ability to detect Facebook usage,
but want to continue configuring and testing the AppId module.
Specifically, they want you to satisfy two goals they are concerned with.
Globomantics would like you to identify any attempted SSH or
telnet connections from external networks.
Globomantics would also like you to obtain
application usage statistics from AppId.
Let's head over to our Snort server and get started.
The first thing we need to do is check AppId's configuration,
which we can do by accessing the snort.lua configuration file.
If you follow it along in the installation guide,
this configuration should look familiar for AppId.
If not, this is a good opportunity to set up your AppId in a similar way.
The app_detector directory is where we placed the open AppId
directory containing the necessary configuration files to
enable AppId to detect the applications.
We also have the log stats set to true to enable us
to log the application statistics, satisfying one of the goals of this scenario.
We have one more goal to meet,
which is to detect inbound SSH and telnet attempts.
We can leverage AppId to accomplish this in one rule.
Let's head over to our local.rules file and add that in.
I pre‑populated this rule from the earlier example configuration
to spare you from watching me type it out.
The beginning of this rule is set to alert on any TCP
traffic inbound to our internal network.
We can add this AppId section to specify our desired apps to detect.
I added the apps SSH and telnet to this rule to
satisfy our goal for this scenario.
As I mentioned before, this rule could be improved,
but will work fine for our scenario without over‑complicating the lesson.
We also could have separated this out into two different
rules that alerted based on the port number,
22 for SSH and 23 for telnet,
but the point of this exercise was to leverage AppId.
So we're going to do it this way.
Let's go ahead and save the file and then we can test our Snort
configuration and see if these satisfied Globomantics requirements.
We're going to need to add a log directory for this exercise to start
logging packets and enable AppId to log usage statistics.
Once we have Snort up and running,
we can test our SSH and telnet configuration with some connection attempts.
For that,
I'm going to use the Kali Linux VM and try to connect to Metasploitable
through SSH. And once it attempts to connect, we can go ahead and check our
Snort server and see if it generated any alerts.
And there we can see it; it detected the AppId as OpenSSH, and we have
our message of unauthorized inbound connection attempt, heading towards
port 22 on our Metasploitable machine.
Now that we have verified that that rule is working,
let's go ahead and stop Snort and look at our usage statistics to make sure
that that is working as we anticipated as well. To do that, we'll just use a
simple cat command, and we have our usage statistics.
We can see the timestamp, AppIds, and the total transmitted
and received bytes for each application.
So for a quick recap,
we configured AppId to track application usage and alert us of inbound
connection attempts based on Globomantics requirements.
We tested these configurations by attempting an SSH
connection from the external network,
and we checked the application usage logs to ensure
that Snort was logging usage.