Installing and Using SNORT on Ubuntu
By Mike L Walton
I spoke about IDS (Intrusion Detection Systems) and IPS (Intrusion Prevention Systems) a few days ago in a question posted by a user. So I thought I would dive a little deeper into the subject with a specific application that I have personally used – Snort. Snort is a very powerful IDS that in later versions can act like an IPS. Snort is free to download and use in the personal environment as well as in the business environment. In fact Snort is used by many enterprises as a very effective option for their business because not only is it free, but it is one of the most powerful IDS’s out there if you know what you are doing when you configure it. Snort can be created as a program that you run when you want on a personal computer or it can be setup to run when your OS starts and protect all computers on your network from attacks.
If you want to use Snort to protect your entire network it will need to be placed in line with your Internet connection. So as an example lets say that you have a business Internet account with your local cable company and you want to protect it with a computer running Snort. The computer running Snort needs to be placed between the cable modem and the router, this way Snort is able to monitor every piece of traffic that comes into your network and is in the best place to discover possible attacks.
Installation:
We are going to be installing Snort on a computer running Ubuntu 9.04 which at the time of this article is the newest version of Ubuntu. Ubuntu is also a free OS that is available to download, making this IDS a totally free appliance for you, except the cost of the computer. There are two ways to install Snort onto a Ubuntu Distribution and the easiest is to do it through a command line. If your computer is up to date you can simply type:
sudo apt-get install snort
This will then download and install the newest version of snort on your computer through command line. As soon as it is done you will be ready to use snort. But if you run into an error or cannot install Snort through command line you can always go to the Snort website and download the newest version, but make sure that you are downloading the tar.gz file and follow their installation guide to completely setup Snort.
Once installed you can run snort as just a sniffer and have all packets captured and logged but that will create an enormous log file that you would then have to view. Snort works so well because of its use of rules to know which traffic to log and which traffic to ignore. Rules are going to be beyond the scope of this article but I plan on writing an article in the near future on creating rules for Snort.
How Snort runs depends on the flags that you specify when you launch Snort from command line.
Flag Function
-v View packet headers at the console.
-d View application data with IP headers.
-D Run Snort as a daemon.
-e Show data-link layer headers.
-l Run in packet logger mode.
-h Log information relative to the home network.
-b Log information to a single binary file in the logging directory.
-r Read packets contained in a log file.
N Disable packet logging.
-c Specifies which file will be used to provide a rule-set for intrusion detection.
-i Specifies which port you would like Snort to look at when running.
As you can see from above we have a few different options when it comes to flags used with Snort. Lets start with just viewing IP packet headers by using the command sudo snort -v. Be sure to use the sudo command before snort so that it runs in administrative mode, this is needed to open the appropriate port. Now since we did not specify a port for snort to look at it is going to use the eth0 port by default, well I am not using the eth0 port right now as I write this article I am using the wlan0 port which is my wireless card. We will need to us the -i flag to tell Snort to use my wireless card to check for traffic, sudo snort -v -i wlan0. Now Snort will run and display on the screen every packet header that comes across my wlan0 or wireless card, as you can see this is very useful if you want to monitor all traffic across your network but very impractical if you want to protect your network. To end the application once it has started you can simply hit CTRL+C to end the program and bring you back to a command prompt.
We have quickly discussed installing Snort and then running some basic Snort commands to get some output from the program onto our screen. Stay tuned for the next article on configuring Snort rules and running Snort as true IDS with alerting.
Mike Walton has been in the technology field for over 8 years and has 6+ years in hospitality technolgy. Mike has experience with Microsoft Windows Server 2000, 2003, Windows 98, XP, and Vista, Networking, Cisco Equipment, PCI DSS, and many more. Mike Walton is also the founder of MikeNet PC Free Articles and Videos. http://www.mikenetpc.com
Original Article: http://www.mikenetpc.com/2009/08/24/installing-and-using-snort-on-ubuntu/
other 2 are more expensive because of the licensing issues because they are owned by Microsoft and Apple. So, by being an open source system, Linux can be obtained without having to pay for anything. Many users turn to Linux because of this reason.
Current versions of Windows Server also support PHP. Most Windows hosting packages today are based on either Microsoft Windows Server 2003 or 2008 operating systems. Although Linux is dominant in the hosting arena, Windows is becoming more common and now stands firm as a solid number-two option. For the rest of us, however, most of whom can barely spell HTML, never mind use it, building a website is something either best left to the aforementioned techno-geeks, or to Windows and Microsoft. If you’re looking for an inexpensive way to host your personal site, blog or small business web site, than look no further.
Linux web hosting in the beginning, the system was primarily but sparingly used by diehard fans and experienced users due to its complexity. Here are the other advantages of choosing Linux web hosting: The internet itself is based on interconnected networking computers, something that comes naturally for Linux.
Canonical, the business arm of Ubuntu, has one of the most promising business models in the Linux world, and also the most misunderstood. First of all, Ubuntu is in a market termed by economists as a perfectly competitive market. This means that it cannot charge any price beyond that which is determined by the market. The only way to make profit, as has rightly been identified by Canonical is to create an ecosystem of products and services around Ubuntu, which would complement the functions of the OS.
The recent partnerships between Canonical and big shot OEMs like Dell and IBM only goes to underscore the fact that the Ubuntu business model has a lot of potential. Companies like Dell and IBM will not partner a distro that they do not believe to have a future. Their partnering with Canonical to offer Ubuntu only underscores one fact- there is light at the end of the tunnel for Ubuntu’s profitability.
Setting your system with english locales, so that your desktop, menus and programs’ file menus won’t show english characters in blurry chinese ttf fonts. You will still have the ability to input chinese in almost everything(browsers, konquerer, instant messengers, konsole, xchat and more).
If you remember the debacle of Vista, with swarms of users scrambling for old copies of XP, you must be dreading the release of Windows 7. But there is another option, one which has already attracted millions of devotees: Ubuntu – “Linux for Human Beings“. Besides the fact it is free, with around 
“Ubuntu”, pronounced “oo-boon-too“, is African for “humanity to others“, and this is the underlying principle behind this distro (Linux distribution) that has started becoming a serious player in the computing world. It promises to always be free, with free updates, and the option to upgrade to a new version every six months (for free, of course). All the open source software costs nothing, and the best part is that any programs you’ve installed get updated/upgraded for free along with your system updates.
less of a worry. All those video clips you downloaded that only seem to have sound will play fine in Ubuntu (once you install the ubuntu-restricted-extras package, which takes care of all proprietary codecs). Instead of limited customisablility, you can tailor your Ubuntu system to just how you want it. And you won’t be constantly plagued by Microsoft and other software companies continually trying to wring money out of you.
Part of securing your network must include looking at your wireless access points. Wireless access can be dangerous to your network. Most people don’t even know how easy it is to exploit wireless access points. Let me illustrate my point. I went out one afternoon and took my trusty laptop with me. The task this afternoon was to scan for “open” wireless access points. An “open” wireless access point is one that has absolutely no encryption, or security, on the signal. This allows anyone to listen in on your data stream. If you still don’t get it, it’s a very bad thing! So, I drove for about 2 miles through a small business district and apartment complex. What was the result? Oh, about 45 open wireless networks. That means that I could log onto those networks, scan it, and exploit machines connected to that network. I didn’t do that, but you get my drift. The lesson here is to encrypt your wireless data stream.
