Bro – Network IDS (Intrusion Detection System) ເປັນຕົວທີ່ໃຊ້ຊ່ວຍໃນການວິເຄາະການໂຈມຕີຕ່າງໆ ໂດຍ Bro ນັ້ນມີ feature ຫລວງຫລາຍ
• Detect brute-force attacks against network services like SSH and FTP
• Perform HTTP traffic monitoring and analysis
• Detect changes in installed software
• Perform SSL/TLS certificate validation
• Detect SQL injection attacks
• Perform file integrity monitoring of all files
• Send activity, summary and crash reports and alerts via email
• Perform geolocation of IP addresses to city-level
• Operate in standalone or distributed mode
ທີນີ້ເຮົາມາເບິ່ງກັນວ່າ Bro ນັ້ນຕິດຕັ້ງ ແລະ ທົດສອບແນວໃດ
1. ຕິດຕັ້ງ Dependency Package
sudo apt-get update sudo apt-get install bison cmake flex g++ gdb make libmagic-dev libpcap-dev libgeoip-dev libssl-dev python-dev swig2.0 zlib1g-dev
2. Download GeoIP Database
cd /opt wget https://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz wget https://geolite.maxmind.com/download/geoip/database/GeoLiteCityv6-beta/GeoLiteCityv6.dat.gz gunzip GeoLiteCity* mv GeoLiteCity* /usr/share/GeoIP/
3. Download Bro source and compile, install
git clone --recursive git://git.bro.org/bro cd bro ./configure make make install
ຕົວ bro ຈະຖືກເກັບໄວ້ທີ່ /usr/local/bro
Image does not exist: https://www.techsuii.com/wp-content/uploads/2017/08/Screen-Shot-2560-08-13-at-13.35.38.png
bro ນັ້ນມີ configure ສຳຄັນຢູ່ 3 ຕົວຄື
• node.cfg ຕົວນີ້ຈະເປັນ set ການ monitor ຂອງ bro
• networks.cfg ຕົວນີ້ຈະເປັນການ set ວ່າ network ໃດເປັນ local
• broctl.cfg ຕົວນີ້ຈະເປັນການ set global configuration ຂອງ bro ສຳລັບ mail, logging ແລະອື່ນໆ
4. ເພື່ອທຳການ add bro ເຂົ້າໄປໃນ $PATH ເພື່ອໃຫ້ສາມາດໃຊ້ງານ bro ໄດ້ຈາກທຸກທີ່ ໃຫ້ເຂົ້າໄປແກ້ໄຂ /etc/profile.d/3rd-party.sh ແລ້ວເພີ່ມ bro path ເຂົ້າໄປໃນ list
export PATH=$PATH:/usr/local/bro/bin
ຈາກນັ້ນໃຊ້ຄຳສັ່ງ
source /etc/profile.d/3rd-party.sh
5. ແກ້ໄຂ /usr/local/bro/etc/node.cfg ເພື່ອ configure ວ່າຈະ monitor ທີ່ interface ໃດ
[bro] type=standalone host=localhost interface=<span style="color: #ff0000;">eth0</span>
6. ເຂົ້າໄປກຳນົດວ່າ IP ໃດເປັນວົງ Private ຫລື Public IP
/usr/local/bro/etc/networks.cfg
7. ເຂົ້າໄປກຳນົດການ alert ແລະ ການສົ່ງ log ທີ່ /usr/local/bro/etc/broctl.cfg
ຫລື ແທ້ໆແລ້ວເຮົາກໍສາມາດຄວບຄຸມ configuration ຂອງ bro ຜ່ານ sudo /usr/local/bro/bin/broctl ຊຶ່ງເປັນຄຳສັ່ງສຳລັບ manage ໂດຍສະເພາະໄດ້ເຊັ່ນກັນ
8. ສົ່ງ log ຈາກ bro ໄປຍັງ syslog ໂດຍເຂົ້າໄປແກ້ໄຂ /usr/local/bro/share/bro/site/local.bro
event bro_init()
{
Log::disable_stream(HTTP::LOG);
Log::disable_stream(Syslog::LOG);
Log::disable_stream(Conn::LOG);
Log::disable_stream(DNS::LOG);
Log::disable_stream(Weird::LOG);
}
ສ້າງ syslog configuration ໃນ /etc/rsyslog.d/60-bro.conf
$ModLoad imfile # $InputFileName /usr/local/bro/logs/current/ssl.log $InputFileTag bro_ssl: $InputFileStateFile stat-bro_ssl $InputFileSeverity info $InputFileFacility local7 $InputRunFileMonitor $InputFileName /usr/local/bro/logs/current/smtp.log $InputFileTag bro_smtp: $InputFileStateFile stat-bro_smtp $InputFileSeverity info $InputFileFacility local7 $InputRunFileMonitor $InputFileName /usr/local/bro/logs/current/smtp_entities.log $InputFileTag bro_smtp_entities: $InputFileStateFile stat-bro_smtp_entities $InputFileSeverity info $InputFileFacility local7 $InputRunFileMonitor $InputFileName /usr/local/bro/logs/current/notice.log $InputFileTag bro_notice: $InputFileStateFile stat-bro_notice $InputFileSeverity info $InputFileFacility local7 $InputRunFileMonitor $InputFileName /usr/local/bro/logs/current/ssh.log $InputFileTag bro_ssh: $InputFileStateFile stat-bro_ssh $InputFileSeverity info $InputFileFacility local7 $InputRunFileMonitor $InputFileName /usr/local/bro/logs/current/ftp.log $InputFileTag bro_ftp: $InputFileStateFile stat-bro_ftp $InputFileSeverity info $InputFileFacility local7 $InputRunFileMonitor # check for new lines every second $InputFilePollingInterval 1 local7.* @10.211.55.22
Restart rsyslog
/etc/init.d/rsyslog restart
9. ໃຊ້ຄຳສັ່ງ ເພື່ອ start bro ແລະ ການກວດສອບໄຟລ໌ທີ່ຈຳເປັນຂອງ bro ວ່າໂອເຄແລ້ວ ຫລື ບໍ່
/usr/local/bro/bin/broctl deploy
Image does not exist: https://www.techsuii.com/wp-content/uploads/2017/08/Screen-Shot-2560-08-13-at-14.05.13.png
ກວດສອບ status ຂອງ bro ໄດ້ໂດຍໃຊ້ຄຳສັ່ງ
/usr/local/bro/bin/broctl status
10. ເນື່ອງດ້ວຍ bro ບໍ່ມີ systemd , daemon file ໃນການສັ່ງງານໃຫ້ມັນ start ຕອນ boot ເຄື່ອງ ດັ່ງນັ້ນສິ່ງທີ່ເຮົາເຮັດຄືການໃຊ້ cron ເຂົ້າມາຊ່ວຍ ໂດຍແກ້ໄຂ cronjob ໂດຍໃຊ້ຄຳສັ່ງ
crontab -e
ຈາກນັ້ນກຳນົດເປັນ
*/5 * * * * root /usr/local/bro/bin/broctl cron
Pytbull [ Testing IDS]
pytbull ເປັນຕົວທີ່ຖືກສ້າງຂຶ້ນມາເພື່ອກວດສອບການເຮັດວຽກຂອງ IDS ໂດຍສະເພາະ ໂດຍຈຳເປັນທີ່ Bro Server ຕ້ອງລົງ service ຕ່າງໆ ເພິ່ມເຕິມ
Nessus [ Testing IDS]
ເຄື່ອງມື Vulnerability Assessment ກໍຖືວ່າເປັນເຄື່ອງທີ່ໃຊ້ໃນການທົດສອບການໂຈມຕີທີ່ IDS ຢ່າງ bro ຄອຍຖ້າເຝົ້າລະວັງຢູ່ໄດ້ເຊັ່ນກັນ
Nmap [ Testing IDS]
ທົດສອບ IDS ເບົາໆດ້ວຍ Network scanning port ກໍສາມາດເຮັດໄດ້ເຊັ່ນກັນ
Image does not exist: https://www.techsuii.com/wp-content/uploads/2017/08/Screen-Shot-2560-08-13-at-14.21.16.png
ຂໍ້ມູນຈາກ: techsuii
