PulledPork 설치 및 설정

Install and Configure PulledPork

Snort needs to have an updated set of rulesets in order to be able to detect and respond to emerging threats as effectively as possible. Pulledpork is a Perl script that is able to keep your Snort rulesets updated at all times with a minimal amount of effort.

1. Install prerequisites:

apt-get install libcrypt-ssleay-perl liblwp-useragent-determined-perl -y

2. Next, go to http://pulledpork.googlecode.com and download the latest version of PulledPork. As of the writing of this guide, the latest version was 0.6.1. Obviously, adjust your filenames to reflect the version of PulledPork you download. The easiest way to download is through wget from your machine's command line. Copy the complete download URL from the PulledPork website and then do the following:

cd /usr/local/src/snort
wget https://pulledpork.googlecode.com/files/pulledpork-0.6.1.tar.gz

If you get a warning WARNING: cannot verify pulledpork.googlecode.com's certificate, and your file doesn't download, simply use the following command instead:

cd /usr/local/src/snort
wget --no-check-certificate https://pulledpork.googlecode.com/files/pulledpork-0.6.1.tar.gz

3. Untar the downloaded file:

cd /usr/local/snort
tar -xvzf /usr/local/src/snort/pulledpork-0.6.1.tar.gz

4. This will create a pulledpork-0.6.1.tar.gz directory and extract all the PulledPork files in it. We are going to rename that directory into simply pulled pork to keep it simple:

mv pulledpork-06* pulledpork

5. Next, edit the /usr/local/snort/pulledpork/etc/pulledpork.conf file:

vi /usr/local/snort/pulledpork/etc/pulledpork.conf

6. Change the lines that appear below and make them look exactly like they appear below with the exception of the <oinkcode> on the rule_url line which should be replaced with the oinkcode you generated earlier in the guide.

rule_url=http://www.snort.org/reg-rules/%7Csnortrules-snapshot.tar.gz%7C<oinkcode>
# get the rule docs!
#rule_url=https://www.snort.org/reg-rules/%7Copensource.gz%7C
#rule_url=https://rules.emergingthreats.net/%7Cemerging.rules.tar.gz%7Copen
# THE FOLLOWING URL is for etpro downloads, note the tarball name change!
# and the et oinkcode requirement!
#rule_url=https://rules.emergingthreats.net/%7Cetpro.rules.tar.gz%7C
rule_path=/usr/local/snort/etc/rules/snort.rules
local_rules=/usr/local/snort/etc/rules/local.rules
# Where should I put the sid-msg.map file?
sid_msg=/usr/local/snort/etc/sid-msg.map
# Path to the snort binary, we need this to generate the stub files
snort_path=/usr/local/snort/bin/snort
# We need to know where your snort.conf file lives so that we can
# generate the stub files
config_path=/usr/local/snort/etc/snort.conf
# This is the file that contains all of the shared object rules that pulledpork
# has processed, note that this has changed as of 0.4.0 just like the rules_path!
sostub_path=/usr/local/snort/etc/rules/so_rules.rules
distro=Ubuntu-10.04 

7. Next, edit /usr/local/snort/etc/snort.conf:

vi /usr/local/snort/etc/snort.conf

8. Locate the var RULE_PATH line and change it to appear like below:

var RULE_PATH /usr/local/snort/etc/rules

9. Next, remove all snort include rules files from /usr/local/snort/etc/snort.conf by typing the following commands:

sed -i '/^include $RULE_PATH/d' /usr/local/snort/etc/snort.conf
sed -i '/^include $RULE_PATH/d' /usr/local/snort/etc/snort.conf
sed -i '/^include $RULE_PATH/d' /usr/local/snort/etc/snort.conf

9. Now, add the following include files to /usr/local/snort/etc/snort.conf by typing the following commands:

echo "include \$RULE_PATH/snort.rules" >> /usr/local/snort/etc/snort.conf
echo "include \$RULE_PATH/local.rules" >> /usr/local/snort/etc/snort.conf
echo "include \$RULE_PATH/so_rules.rules" >> /usr/local/snort/etc/snort.conf

10. Create a rules directory:

mkdir /usr/local/snort/etc/rules

11. Create a local rules file:

touch /usr/local/snort/etc/rules/local.rules

12. Test PulledPork runs successfully by typing the command below:

/usr/local/snort/pulledpork/pulledpork.pl -c /usr/local/snort/pulledpork/etc/pulledpork.conf

Upon success, you should get an output similar to below:

Rule Stats....
       New:-------0
       Deleted:---0
       Enabled Rules:----3154
       Dropped Rules:----0
       Disabled Rules:---11235
       Total Rules:------14389
       Done
Please review /var/log/sid_changes.log for additional details
Fly Piggy Fly!

Now, let's schedule PulledPork to automatically update on a daily basis.

13. Edit crontab:

crontab -e

14. Insert a new line like below into crontab (All in one line):

00 01 0 * * * root /usr/local/snort/pulledpork/pulledpork.pl -c /usr/local/snort/pulledpork/etc/pulledpork.conf

The line above will run the script every day of the week at 1 A.M.

15. Save Crontab (ESC) (SHIFT ZZ)