Sebelumnya mungkin kita sudah tidak asing lagi dengan Firewall dan IDS (Intrusion Detection System) semuanya ituadalah sebuah system yang berfungsi untuk mengamankan network dan server.
IDS itu sendiri pun dibagi dalam 2 jenis yaitu Network Instrusion Detection System (NIDS) dan Host Intrusion Detection System (HIDS). Fungsi dari IDS ini sendiri adalah untuk mendeteksi suatu kejanggalan dari suatu system atau network yang terjadi sesuai dengan jenis tipe yang ada berdasarkan rules.
Disini penulis hanya akan membicarakan membangun menggunakan aplikasi opensource. Sedangkan cara kerja lebih kurang seperti gambar dibawah ini :
| | Input Traffic
| |
| |
V V
————- Attack Traffic OUTPUT DENY
HIPS/NIPS ———–> ^
————- | |
| | |
| V |
| ————- Block IP |
V———-> Firewall ———
L ————-
E |
G T |
A R |
L A |
F
F |
I |
C V
—————
Application
—————
Instalasi;
- Masuk ke direktori snort
- unila-inherent-gtw# cd /usr/ports/security/snort
- unila-inherent-gtw# ll
total 22
-rw-r–r– 1 root wheel 5080 Aug 15 03:01 Makefile
-rw-r–r– 1 root wheel 197 Aug 15 03:01 distinfo
drwxr-xr-x 2 root wheel 512 Jun 15 10:01 files
-rw-r–r– 1 root wheel 1202 Apr 20 2003 pkg-descr
-rw-r–r– 1 root wheel 6768 Apr 19 09:23 pkg-plist
drwxr-xr-x 3 root wheel 512 Sep 27 15:36 work
unila-inherent-gtw#- unila-inherent-gtw# make && make install
- setelah instalasi selesai download rules dari website resmi http://snort.org
- Yang musti diinget rules nya harus bersesuian dengan snort yang udah diinstall
- unila-inherent-gtw# pkg_info | grep snort
snort-2.7.0.1 Lightweight network intrusion detection system
unila-inherent-gtw#
- Karena gue pake snort versi 2.7 jadi download rules yang versi 2.7, pengalaman gue kalo download rules nya tidak sesuai dengan snort yang diinstall maka snort tidak akan berfungsi.
- Setelah donwload rules, ekstrak file tersebut di direktori snort
- unila-inherent-gtw# cd /usr/local/etc/snort/
unila-inherent-gtw# ll
total 2710
-r–r–r– 1 root wheel 3455 Sep 27 15:36 classification.config
-r–r–r– 1 root wheel 3455 Sep 27 15:36 classification.config-sample
-r–r–r– 1 root wheel 12196 Sep 27 15:36 gen-msg.map
-r–r–r– 1 root wheel 12196 Sep 27 15:36 gen-msg.map-sample
-r–r–r– 1 root wheel 2060 Sep 27 15:36 generators
-r–r–r– 1 root wheel 2060 Sep 27 15:36 generators-sample
-r–r–r– 1 root wheel 548 Sep 27 15:36 reference.config
-r–r–r– 1 root wheel 548 Sep 27 15:36 reference.config-sample
drwxr-xr-x 5 root wheel 1536 Sep 27 16:49 rules
-r–r–r– 1 root wheel 5 Sep 27 15:36 sid
-r–r–r– 1 root wheel 1237107 Sep 27 15:36 sid-msg.map
-r–r–r– 1 root wheel 1237107 Sep 27 15:36 sid-msg.map-sample
-r–r–r– 1 root wheel 5 Sep 27 15:36 sid-sample
-r–r–r– 1 root wheel 39083 Sep 27 16:14 snort.conf
-r–r–r– 1 root wheel 39042 Sep 27 15:36 snort.conf-sample
-r–r–r– 1 root wheel 2319 Sep 27 15:36 threshold.conf
-r–r–r– 1 root wheel 2319 Sep 27 15:36 threshold.conf-sample
-r–r–r– 1 root wheel 53841 Sep 27 15:36 unicode.map
-r–r–r– 1 root wheel 53841 Sep 27 15:36 unicode.map-sample
unila-inherent-gtw# - Langsung kopiin ke folder rules
- Setelah selesai tambahkan command snort_enable=”YES” di file startup /etc/rc.conf
- Jalankan snort dengan menggunakan perintah /usr/local/etc/rc.d/snort start
- unila-inherent-gtw# tail -f /var/log/messages
Sep 28 08:46:52 unila-inherent-gtw snort[2325]: Warning: flowbits key ‘ms_sql_seen_dns’ is checked but not ever set. Sep 28 08:46:52 unila-inherent-gtw snort[2325]: Warning: flowbits key ‘dce.bind.ca-alert’ is checked but not ever set. Sep 28 08:46:52 unila-inherent-gtw snort[2325]: Warning: flowbits key ‘flv.xfer’ is checked but not ever set.
Sep 28 08:46:52 unila-inherent-gtw snort[2325]: 51 out of 512 flowbits in use.
Sep 28 08:46:52 unila-inherent-gtw snort[2325]: *** *** interface device lookup found: em0 ***
Sep 28 08:46:52 unila-inherent-gtw snort[2325]: Initializing daemon mode
Sep 28 08:46:52 unila-inherent-gtw snort[2326]: PID path stat checked out ok, PID path set to /var/run/
Sep 28 08:46:52 unila-inherent-gtw snort[2326]: Writing PID “2326” to file “/var/run//snort_em0.pid”
Sep 28 08:46:52 unila-inherent-gtw snort[2326]: Daemon initialized, signaled parent pid: 2325
Sep 28 08:46:52 unila-inherent-gtw snort[2325]: Daemon parent exiting
Sep 28 08:47:07 unila-inherent-gtw snort[2326]: Preprocessor/Decoder Rule Count: 0
Sep 28 08:47:07 unila-inherent-gtw snort[2326]: Snort initialization completed successfully (pid=2326)
Sep 28 08:47:07 unila-inherent-gtw snort[2326]: Not Using PCAP_FRAMES - unila-inherent-gtw# ps ax | grep snort
2326 ?? Ss 0:33.51 /usr/local/bin/snort -Dq -c /usr/local/etc/snort/snort.conf
2329 p3 L+ 0:00.00 grep snort
unila-inherent-gtw#apakah snort sudah berjalan dengan baik - Kemudian cek apakah ada yang melakukan penyerangan dengan mengecek log alert snort
- unila-inherent-gtw# tail -f /var/log/snort/alert
- ho..ho..ho…. ternyata banyak juga yang iseng
- [**] [1:483:6] ICMP PING CyberKit 2.2 Windows [**]
[Classification: Misc activity] [Priority: 3]
09/28-08:52:57.862390 192.168.140.35 -> 192.168.43.188
ICMP TTL:28 TOS:0x0 ID:39662 IpLen:20 DgmLen:92
Type:8 Code:0 ID:512 Seq:45340 ECHO
[Xref => http://www.whitehats.com/info/IDS154][**] [1:483:6] ICMP PING CyberKit 2.2 Windows [**]
[Classification: Misc activity] [Priority: 3]
09/28-08:52:57.862498 192.168.140.35 -> 192.168.43.189
ICMP TTL:105 TOS:0x0 ID:39663 IpLen:20 DgmLen:92
Type:8 Code:0 ID:512 Seq:45596 ECHO
[Xref => http://www.whitehats.com/info/IDS154][**] [1:483:6] ICMP PING CyberKit 2.2 Windows [**]
[Classification: Misc activity] [Priority: 3]
09/28-08:52:57.862515 192.168.140.35 -> 192.168.43.189
ICMP TTL:104 TOS:0x0 ID:39663 IpLen:20 DgmLen:92
Type:8 Code:0 ID:512 Seq:45596 ECHO
[Xref => http://www.whitehats.com/info/IDS154][**] [1:483:6] ICMP PING CyberKit 2.2 Windows [**]
[Classification: Misc activity] [Priority: 3]
09/28-08:52:57.862622 192.168.140.35 -> 192.168.43.188
ICMP TTL:27 TOS:0x0 ID:39662 IpLen:20 DgmLen:92
Type:8 Code:0 ID:512 Seq:45340 ECHO
[Xref => http://www.whitehats.com/info/IDS154][**] [1:483:6] ICMP PING CyberKit 2.2 Windows [**]
[Classification: Misc activity] [Priority: 3] ^C - Yups udah ketauan orang yang iseng, tinggal blok pake PF aja…..