NEW - Suricata 1.4.6 IDS pkg. v0.2-BETA Released
-
Bug Fix Update
Just FYI. A new Pull Request was posted today containing fixes for the bugs reported thus far with the Suricata package. The version number will remain the same for now, but I will post an update when the pull request is merged and then interested parties can do a quick reinstall of the Suricata package GUI components to pick up the fixes.
Here is a link to the Pull Request with the details: https://github.com/pfsense/pfsense-packages/pull/622
Bill
-
What are the possibilities of adding in some log file rotation routines? alerts.log and http.log have grown to the point that it's not practical to view them in the Logs Browser.
1041187808 Mar 13 21:52 alerts.log ( a very unhappy checksum rule filled this up rather quickly )
47180176 Mar 14 07:31 http.logEven just a daily rotation with date in the file name (ex: alerts_20140314.log) would be nice.
-
What are the possibilities of adding in some log file rotation routines? alerts.log and http.log have grown to the point that it's not practical to view them in the Logs Browser.
1041187808 Mar 13 21:52 alerts.log ( a very unhappy checksum rule filled this up rather quickly )
47180176 Mar 14 07:31 http.logEven just a daily rotation with date in the file name (ex: alerts_20140314.log) would be nice.
I can do that. I also noticed that Suricata can be quite chatty. I will make the rotation a configurable cron job so the user can select from several rotation options.
Bill
-
ET has finally killed the RBN rulesets.
"Emerging Threats would like to remind and/or inform everyone that this ruleset does not contain the Russian Business Network (RBN) rules. These rules are obsolete and will not be distributed in future releases."
Another feature for Snort/Suricata that would help is to have two Alert screens.
One for the noisy alerts like Scans/CINS/DROP/MYSQL/SQL etc.
One for all other alerts which would make it easier to see from the Alert screen without all of the other alerts on the same log. -
Time to update the blueprint with the removed rules then. Open to suggestions for lists to replace those.
-
For ET changes, these three seem to still be online -
pfBlocker ET Blocker
http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt
http://rules.emergingthreats.net/blockrules/compromised-ips.txt
http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txtFor Snort/Suricta, I would always recommend that people start with as many rules as their box can handle (Memory and CPU) and start in non-blocking mode, remove all the false positives over several weeks of review. And then putting it into Blocking mode. With Bills new tweeks removing Rules from the Alert Page makes it easier. If we had the endablesid.conf and disablesid.conf files we could populate those files with our settings and it would be even easier to manage.
–-----------------------------------------
Here is a list for pfBlocker.
I like to keep the lists separate so I can see what is triggering a block. This helps to weed out False Positives.
pfblockerlists
pfBlocker iBlockList
http://list.iblocklist.com/?list=bt_hijacked&fileformat=p2p
http://list.iblocklist.com/?list=ficutxiwawokxlcyoeye&fileformat=p2p
http://list.iblocklist.com/?list=ghlzqtqxnzctvvajwwag&fileformat=p2p
http://list.iblocklist.com/?list=tbnuqfclfkemqivekikv&fileformat=p2p
http://list.iblocklist.com/?list=bt_spyware&fileformat=p2p
http://list.iblocklist.com/?list=bt_templist&fileformat=p2ppfBlocker ET Blocker
http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt
http://rules.emergingthreats.net/blockrules/compromised-ips.txt
http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txtSpamhaus
http://www.spamhaus.org/drop/drop.txt
http://www.spamhaus.org/drop/edrop.txtpfBlocker Other
http://www.ciarmy.com/list/ci-badguys.txt
http://danger.rulez.sk/projects/bruteforceblocker/blist.php
http://www.us.openbl.org/lists/base_30days.txt
http://malc0de.com/bl/IP_Blacklist.txtpfBlocker Zeus/SpyEye/Palevo
https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist
https://spyeyetracker.abuse.ch/blocklist.php?download=ipblocklist
https://palevotracker.abuse.ch/blocklists.php?download=ipblocklistpfBlocker dShield
http://feeds.dshield.org/top10-2.txtpfBlocker Arbor Networks - Atlas
https://atlas.arbor.net/summary/attacks.csv
https://atlas.arbor.net/summary/botnets.csv
https://atlas.arbor.net/summary/fastflux.csv
https://atlas.arbor.net/summary/phishing.csv
https://atlas.arbor.net/summary/scans.csv
http://atlas-public.ec2.arbor.net/public/ssh_attackerspfBlocker Malware Domain List
http://www.malwaredomainlist.com/hostslist/ip.txtpfBlocker No Think!
http://www.nothink.org/blacklist/blacklist_malware_http.txt
http://www.nothink.org/blacklist/blacklist_ssh_week.txt
http://www.nothink.org/blacklist/blacklist_malware_dns.txtpfBlocker SRI
http://cgi.mtc.sri.com/download/attackers/01-17-2014/Get_Top-51_30-Day_Filterset.html
http://cgi.mtc.sri.com/download/cc_servers/01-17-2014/Get_Top-1_30-Day_Filterset.htmlpfBlocker Infiltrated
http://www.infiltrated.net/blacklistedpfBlocker AlienVault
https://reputation.alienvault.com/reputation.snortDRG
http://www.dragonresearchgroup.org/insight/sshpwauth.txt
http://www.dragonresearchgroup.org/insight/vncprobe.txt
http://www.dragonresearchgroup.org/insight/http-report.txtpfBlocker Feodo
https://feodotracker.abuse.ch/blocklist/?download=ipblocklist
https://feodotracker.abuse.ch/blocklist/?download=badipspfBlocker Blocklist.de
http://lists.blocklist.de/lists/all.txt
http://www.senderbase.org/static/spam/#tab=2pfBlocker StopForumSpam
Local List (.CSV script to convert)pfBlocker Autoshun
Local List (.CSV script to convert) -
http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt
I think that's the one that was causing problems for a number of people, so I switched from that to the "new" RBN list (now obsolete).
A couple of interesting lists there, will test them out. If you are ok with it, I'll add them in due time to the blueprint and credit you.
-
I had that link with the other ET links and never noticed that it wasn't updating properly.
If you use the pffetch script that I wrote previously, you can add that to the script and add a link in pfBlocker to the local file.
fetch http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt
It will download as "RussianBusinessNetworkIPs.txt"The more effort we all make the better off we all are. Open Source all the way!
** SORRY Bill for taking over this Thread… ***
-
I took another look at the RBN text document in VI, and noticed that each line has a "^M" carriage return. This is probably what was causing issues with pfBlocker not reading the file properly. The RBN list is out of date, but there are still alot of hits on my Router from Russia!!
You can filter the ^M with -
fetch http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt
returncode=$?
echo $returncodeif [ "$returncode" -eq "0" ]; then
cat RussianBusinessNetworkIPs.txt | tr -d '\r' > RBN.txt
fiand use the RBN.txt in pfBlocker local file.
-
The funny thing is that I personally never had a problem with that list. It downloaded and added the IPs in the table (checked it myself, and the IPs were there), as well as updated for over a year with no issues at all. Some other people though always had problems with it.
That list belongs to the ET guys, so I'm assuming that it too will be made obsolete. I know that you should never assume but…
yea, sorry Bill for taking over the thread :P
-
Not sure if this is the place to post, but I figure it's a good starting point if nothing else, is there an easy way to get Suricata to throw the logs to Kibana like Suricata shows on their site?
http://idsips.files.wordpress.com/2014/03/kibana300.pngPer this walkthrough:
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/_Logstash_Kibana_and_Suricata_JSON_outputIt wants Suricata to have libjansson support enabled… the only thing they're missing is how to get Suricata and the install of Kibana, etc to talk to each other, but this all may be way too much to ask this early on in the game, not sure if anyone has any tips on it. Thank you for helping if possible!
-
Not sure if this is the place to post, but I figure it's a good starting point if nothing else, is there an easy way to get Suricata to throw the logs to Kibana like Suricata shows on their site?
http://idsips.files.wordpress.com/2014/03/kibana300.pngPer this walkthrough:
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/_Logstash_Kibana_and_Suricata_JSON_outputIt wants Suricata to have libjansson support enabled… the only thing they're missing is how to get Suricata and the install of Kibana, etc to talk to each other, but this all may be way too much to ask this early on in the game, not sure if anyone has any tips on it. Thank you for helping if possible!
I am not familiar with Kibana but will check it out. So long as an external log stash package can accept data over a network connection then pushing Suricata logs should be possible. It gets much more dicey to try and add another package to pfSense itself. Besides, it's not a good idea to run a bunch of applications on your firewall because that increases the security vulnerability exposure substantially.
Bill
-
any options to have suricata 2.0 and have options to block ip?
can i have only to drop packet, not to block ip (snort or. suricata)?
-
any options to have suricata 2.0 and have options to block ip?
can i have only to drop packet, not to block ip (snort or. suricata)?
Suricata 2.0 was not in the FreeBSD ports repository last time I checked (about a week ago). So we will need to wait for FreeBSD ports to update Suricata to 2.0 before it can come to pfSense.
I am working on the blocking code for Suricata now.
Bill
-
Thanks a billion Bill!! Youre SO much the man of this project right now!
-
Thanks a billion Bill!! Youre SO much the man of this project right now!
Thank you. One caveat for Suricata blocking. Initially it will have to operate the same way as Snort does using libpcap. Thus it won't be true inline-mode IPS. Ermal has to make some changes in the ipfw code within pfSense in order to accommodate true inline IPS mode. However, due to the problem of context switching between kernel mode and user-land, IPS mode when it comes won't be nearly as fast as the pseudo-IPS mode Snort uses (and that Suricata will use initially). So true inline IPS is probably not going to be very useful for heavily loaded firewalls. That's just the nature of the beast unless you go to highly customized code, and if you do that then you can't easily follow the upstream updates.
The kernel changes to support true IPS may or may not make it into 2.2. That is not up to me. It is up to the pfSense team. However, I can include the pseudo-IPS mode without those kernel changes. That means pseudo-IPS can work with 2.1.x releases. The pseudo-IPS mode is what I am working on now.
Bill
