SNORT with OpenAppID with u2openappid

[ZF]

Installed on Centos 7

yum install wget net-tools mysql-devel php php-devel php-gd php-ldap php-mysql php-pear gcc flex bison zlib zlib-devel libpcap libpcap-devel pcre pcre-devel libdnet libdnet-devel tcpdump
wget www.snort.org/downloads/snort/daq-2.0.6.tar.gz
wget www.snort.org/downloads/snort/snort-2.9.8.2.tar.gz

yum install daq...
yum install httpd
chkconfig --levels 235 httpd on
service httpd restart
yum -y install mariadb-server mariadb
systemctl start mariadb.service
systemctl enable mariadb.service
mysql_secure_installation
set mysql root account password (s7)

yum install snort
Use smbclient to download snortrules using Windows (need to login with oinkcode)
mkdir /usr/loca/lib/snort_dynamicrules
tar -xvzf /usr/local/src/snortrules-snapshot-*.tar.gz -C /etc/snort
mv /etc/snort/etc/* /etc/snort

cp /etc/snort/so_rules/precompiled/Centos-5-4/x86-64/2.9.7.0/* /usr/local/lib/snort_dynamicrules
ln -s /usr/lib64/snort-2.9.7.0_dynamicpreprocessor /usr/local/lib/snort_dynamicpreprocessor
ln -s /usr/lib64/snort-2.9.7.0_dynamicengine /usr/local/lib/snort_dynamicengine

edit /etc/snort/snort.conf and make the following changes:
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PRE PROC_RULE_PATH /etc/snort/preproc_rules
Comment out all settings for Reputation Preprocessor
Uncomment $PREPROC_RULE_PATH

Test snort with the following:
snort -T -c /etc/snort/snort.conf
snort -i <ethernetcard> -c /etc/snort/snort.conf -A console

Use another machine to scan snort-ids, it should trigger.
Or add a line to /etc/snort/rules/local.rules to trigger on ping

Ensure that yum has copied snort startup script "snortd" to /etc/init.d and its configuration file snort.sysconfig to /etc/sysconfig/snort
Edit /etc/init.d/snortd and change the line
chkconfig: 2345 40 60
chkconfig: 2345 99 99
This will ensure that snort starts AFTER network and mysql.
chkconfig --add snortd

To change the interface snort is listening to, change
/etc/sysconfig/snort
INTERFACE=<NIC>

To set up remote logging, you can either install syslog-ng or use syslog
To use syslog, edit snort.conf to use syslog
To use syslog-ng, install syslog-ng following other guide
Then add the following lines to syslog-ng.conf

source s_file {file("/var/log/snort/alert");};
destination d_network {udp("192.168.229.128" port(514)); };
log { source(s_file); destination(d_network); };
check if log is going out by typing:
watch -n1 syslog-ng-ctl stat

[ZF]

Compiling and installing u2openappid to parse and identify application based on snort log
On Ubuntu 14.04

Source code:
github.com/jasonish/snort/tree/master/tools/u2openappid

sudo apt-get install libpcap-dev libpcre3 libpcre3-dev libdumbnet-dev flex bison libnuma-dev libluajit-5.1-dev libluajit-5.1-common
sudo ./configure --enable-open-appid
sudo make
sudo make install

[ZF]

Installing on Kali-2.0

wget www.snort.org/downloads/snort/daq-2.0.6.tar.gz
wget www.snort.org/downloads/snort/snort-2.9.8.2.tar.gz

apt-get install libdnet libdnet-dev libdumbnet-dev libluajit-5.1-2 libluajit-5.1-common libluajit-5.1-dev luajit openssl libssl-dev
tar xvfz daq-2.0.6.tar.gz
cd daq-2.0.6
./configure && make && sudo make install

tar xvfz snort-2.9.8.2.tar.gz
cd snort-2.9.8.2
./configure --prefix=/usr/local/snort --enable-sourcefire --enable-open-appid
make
make install

wget www.snort.org/rules/community
tar -xvzf community.tar.gz -C /etc/snort

wget www.snort.org/downloads/openappid/3652
tar -xvzf snort-openappid.tar.gz -C /etc/snort

mkdir /etc/snort
cp -rf /opt/snort-2.9.8.2/etc/* /etc/snort
edit snort.conf with the following changes:

var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
---
# var WHITE_LIST_PATH /etc/snort/rules
# var BLACK_LIST_PATH /etc/snort/rules
---
config logdir: /var/log/snort
---
dynamicpreprocessor directory /usr/local/snort/lib/snort_dynamicpreprocessor/
dynamicengine /usr/local/snort/lib/snort_dynamicengine/libsf_engine.so
# dynamicdetection directory /usr/local/snort/lib/snort_dynamicrules
# preprocessor reputation: \
# memcap 500, \
# priority whitelist, \
# nested_ip inner, \
# whitelist $WHITE_LIST_PATH/white_list.rules, \
# blacklist $BLACK_LIST_PATH/black_list.rules

preprocessor appid: app_stats_filename appstats-u2.log, \
app_stats_period 60, \
app_detector_dir /etc/snort

snort -T -c /etc/snort/snort.conf

Test openappid with pcaps
/usr/local/snort/bin/snort -c /etc/snort/snort.conf --pcap-dir=<pcap dir> -k none
/usr/local/snort/bin/u2openappid /var/log/snort/appstats-unified.log.*