SnortIDS & ACID

# http://www.the-tech-tutorial.com/?p=1578
# https://help.ubuntu.com/community/SnortIDS

### LAMP Server ###
sudo tasksel install lamp-server

### SNORT ###
# Whole Network: 192.168.15.0/24
# NIC to listen: eth0

sudo apt-get install snort-mysql

mysql -u root -p
create database snort;
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES ON snort.* TO 'snort'@'localhost' IDENTIFIED BY 'password';
FLUSH PRIVILEGES;
quit

cd /usr/share/doc/snort-mysql
zcat create_mysql.gz | mysql -u snort -p snort
#zcat create_mysql.gz | mysql -u snort -D snort -papplicationpassword
#/etc/snort/snort.conf
output database: log, mysql, user=snort password=applicationpassword dbname=snort host=localhost

sudo dpkg-reconfigure snort-mysql
#/etc/snort/snort.debian.conf
DEBIAN_SNORT_STARTUP="boot"
DEBIAN_SNORT_HOME_NET="192.168.15.0/24 192.168.16.0/24"
DEBIAN_SNORT_OPTIONS=""
DEBIAN_SNORT_INTERFACE="eth0 eth1"
DEBIAN_SNORT_SEND_STATS="false"
DEBIAN_SNORT_STATS_RCPT="root"
DEBIAN_SNORT_STATS_THRESHOLD="1"

sudo rm /etc/snort/db-pending-config

sudo /etc/init.d/snort start

snort -i eth0 -v

### ACID ###
apt-get install acidbase

/etc/acidbase/apache.conf
allow from 127.0.0.0/255.0.0.0 192.168.15.0/255.255.255.0

sudo /etc/init.d/apache2 restart

http://192.168.15.1/acidbase/base_db_setup.php
Create BASE AG

http://192.168.15.1/acidbase/base_main.php

http://192.168.15.1/acidbase/

sudo nmap -p1-65535 -sV -sS -O 192.168.15.1


### Managing Rules ###
#http://www.aboutdebian.com/snort.htm

/etc/snort/snort.conf
include statements  -> /etc/snort/rules