defa405c2c
HTTPS to protect the oinkcode from being exposed (suggested by David Hill). Also add a note that registered users without a paid subscription are only allowed to download the official Snort ruleset once every 15 minutes (suggested by Adam Jeanguenat). This restriction is not obvious on the snort.org site, so I think this note would be helpful to users. OK Markus Lude (maintainer), sthen@
59 lines
2.6 KiB
Plaintext
59 lines
2.6 KiB
Plaintext
$OpenBSD: README,v 1.3 2013/03/04 04:23:18 lteo Exp $
|
|
|
|
+-----------------------------------------------------------------------
|
|
| Running ${FULLPKGNAME} on OpenBSD
|
|
+-----------------------------------------------------------------------
|
|
|
|
An up-to-date set of rules is needed for Snort to be useful as an IDS.
|
|
By default, these rules are expected to be present in the
|
|
${SYSCONFDIR}/snort/rules directory as defined by RULE_PATH in
|
|
${SYSCONFDIR}/snort/snort.conf.
|
|
|
|
The two most common sources of Snort rules are the official Snort rules
|
|
and the Emerging Threats rules. To download the official Snort rules,
|
|
you will first need to sign up for an "oinkcode" at
|
|
https://www.snort.org/signup since they are distributed under a
|
|
commercial license. Emerging Threats rules can be downloaded without
|
|
signing up.
|
|
|
|
The easiest way to download these rules is to use a rule manager such as
|
|
the oinkmaster package. You can set up oinkmaster's config file to
|
|
download one or more Snort rulesets and extract them automatically.
|
|
Please refer to the documentation in the oinkmaster package for more
|
|
details.
|
|
|
|
If you prefer to obtain the rules manually without using a rule manager,
|
|
you can use the following example commands to download and extract them
|
|
to the correct directory:
|
|
|
|
* Official Snort rules (replace <oinkcode> with yours):
|
|
|
|
ftp -o snortrules-snapshot-${V}.tar.gz \
|
|
https://www.snort.org/reg-rules/snortrules-snapshot-${V}.tar.gz/<oinkcode>
|
|
tar -C /etc/snort -xzf snortrules-snapshot-${V}.tar.gz rules preproc_rules
|
|
|
|
Note that registered users without a paid subscription are only
|
|
allowed to download the official Snort ruleset once every 15 minutes.
|
|
|
|
* Emerging Threats rules:
|
|
|
|
ftp http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz
|
|
tar -C /etc/snort -xzf emerging.rules.tar.gz
|
|
|
|
If you use Emerging Threats rules, you will need to uncomment its
|
|
include line in ${SYSCONFDIR}/snort/snort.conf and edit
|
|
${SYSCONFDIR}/snort/rules/emerging.conf for Snort to load them.
|
|
|
|
It is important that you review the rules carefully to ensure that you
|
|
use the rules that apply to your environment. You should also modify
|
|
${SYSCONFDIR}/snort/snort.conf to define the relevant variables such as
|
|
HOME_NET to match your network.
|
|
|
|
It is recommended that Snort be run as an unprivileged chrooted user.
|
|
A _snort user/group and a log directory have been created for this
|
|
purpose. You should start Snort with the ${RCDIR}/snort script to take
|
|
advantage of this.
|
|
|
|
For more details on setting up Snort, please refer to its user manual at
|
|
${TRUEPREFIX}/share/doc/snort/snort_manual.pdf
|