Build an IDS with Snort, Shadow, and ACID

Every organization understands the importance of using a firewall to protect its assets. But what happens if someone finds a hole in the wall? What if the infiltrator is actually someone from within your organization who wants to access information that he shouldn’t? To cover those contingencies, you need an intrusion detection system (IDS) to complement your firewall. Fortunately, with a minimum amount of time and money you can set up an IDS with open source tools such as Snort, Shadow, and ACID.

An IDS comprises sensors to do the actual monitoring and a central console to store and analyse the data collected on each sensor. A sensor can be a basic PC with an extra network card (to do the actual monitoring), whilst the central console should have a bit more processing power and a larger disk.

If Linux isn’t already on the PCs you plan to use then you’ll have to install it. You’ll need only a minimal install because these boxes will be used only for the IDS. I recommend installing Bastille to make the IDS more secure. Another key thing to do is to put the monitoring network card on the sensor without an IP address; this makes it effectively invisible.

You can now start installing the software to do the actual intrusion detection. You can use Snort to monitor patterns of behaviour (or signatures) and Shadow to monitor packet headers. You’ll need ACID to analyse the data collected by Snort (Shadow has its own analyser).

Let’s begin with the sensor. The first piece of software to install is the client and develop RPMs for MySQL drivers, which are necessary because Snort store its output in a database on the central console. Once these drivers are in place, download the tar file for Snort, decompress it, and install it with the commands:

./configure --with-mysql
make
make install

The installation and setup instructions for Snort are clear and concise. Snort uses a set of rules to identify signatures (or patterns of behaviour) to identify illegal activity. You can download a default set of customisable rules from Snort’s site, along with some excellent documentation. If you have a Windows client, you can manage the signatures using Activeworx’s IDS Policy Manager.

Shadow

With Snort on the workstation, the next step is to install Shadow. The software comprises a
set of Perl scripts that use tcpdump to collect data from packet headers on the network in order to identify any unusual activity. Shadow’s Web site contains documentation that covers package dependencies (including Perl and tcpdump; the latter is supplied with Shadow), installation, and setup. To configure Shadow you need to modify three files — sensor_init.sh, std.ph, and std.filter — to reflect your local setup, such as the location of tcpdump. You also need to set up crontab to run sensor_driver.pl (the main script of the sensor) once an hour. The package supplies a suitable cron file — /usr/local/SHADOW/sensor/sensor_crontab — that also will synchronize the sensor time with a reliable Network Time Protocol source.

Finally, you must make sure that Shadow runs at system startup time by copying /usr/local/SHADOW/sensor_init.sh to your /etc/rc.d directory. Once Shadow is running, your sensor PC is ready to be connected to the network.

Shadow comes with its own analyser, which requires tcpdump, OpenSSH, and Apache. The Shadow documentation will lead you through the configuration process, tell you how to set up the Shadow CGI scripts, and explain how to set up crontab for automatic operation.

The console

With the sensor set up you can turn to the central console, where the actual analysis of the data will be done.

Snort has no analysis software itself — it simply generates data on the sensor and then stores it in a MySQL database on the central console. You can use ACID (Analysis Console for Intrusion Databases) to analyse the data. ACID’s Web site gives full details on software installation and the creation of the MySQL database for storing the Snort alerts.

At this point your IDS should be up and running with Snort, Shadow, and ACID. On the sensor Snort will be monitoring the traffic patterns and raising alerts to the database. Shadow will be reading packet headers and creating log files. On the central console you will be able to view the Web
pages created by Shadow, and to use ACID to analyse the alerts created by Snort.

Now the real work begins. You must learn how to understand the traffic on your own network so that you can filter the false alarms from the real ones. To start learning, have a look at the Reference and Security Links sections of the Shadow Web site. Then congratulate yourself for giving your organization a real chance to catch an intruder before he can do any damage.