HERE ARE THE SPECIFIC REQUIREMENTS FOR YOUR INTRUSION DETECTION RULES: You are t

Question

HERE ARE THE SPECIFIC REQUIREMENTS FOR YOUR INTRUSION DETECTION RULES:

You are to create several intrusion detection rules. Create these in a text file called '<firstname.lastname>.rules' located under /etc/snort/rules. Develop rules that implement the following policies:

       1. alert on any incoming pings to the server from .128. Your message should indicate: ".128 pinging the server."

       2. alert on any ftp traffic with the SYN flag set, from .128 to the server. Message should read: ".128 attempt to FTP to server."

       3. alert on any telnet traffic with the SYN flag set, from .128 to the server. Message should read: ".128 attempt to telnet to server."

       4. alert on any ssh traffic containing the keyword "SSH-2", from .128 to the server. Message should read: ".128 attempt to SSH to server."

       5. alert on any http traffic from .128 with the SYN flag set, from .128 to the server. Message should read: .128 attempt to the web server."

       6. alert on any http traffic with the SYN flag set from the CLASS A private network (10.0.0.0/8) to the server. Message should read "Possible DDOS."

       7.   alert on any DNS traffic from 172.16.136.130 to the local DNS server (172.16.136.1) that contains the keyword "ubuntu." Message should read "DNS Query Ubuntu."

       8. alert on any packets from .128 to the server containing the text "supersecret.txt" (note this is the first time I didn't mention a service!)

       9. alert on any ftp traffic from the .128 to the server that contains the keyword "pfarnsworth". Message should read "Pfarnsworth over ftp".

       10. alert on any ssh traffic from .128 to the server with the FIN and ACK flags set. Message should read "F/A for SSH teardown."

    -----------

How I would do the assignment

1. Modify your snort.conf so that you've defined your SERVER, BADGUY (.128), and CLASS_A networks. Mine looked like this:

ipvar HOME_NET 172.16.136.0/16

ipvar SERVER 172.16.136.129

ipvar CLASS_A 10.0.0.0/8

ipvar BADGUY 172.16.136.128

All I really need is an idea how to write the rules 1-10 There is more to the assignment but if I can get help on what the rules are it would help me a ton.

Explanation / Answer

1. alert on any incoming pings to the server from .128. Your message should indicate: ".128 pinging the server."


   alert on any incoming pings to the server 128 "flow:from_server,pinging:128"   

       2. alert on any ftp traffic with the SYN flag set, from .128 to the server. Message should read: ".128 attempt to FTP to server."
  
   alert on any ftp traffic with SYN flag set,(msg:FTP GET flow:from_sever )

       3. alert on any telnet traffic with the SYN flag set, from .128 to the server. Message should read: ".128 attempt to telnet to server."

   alert on any telnet raffic with the SYN flag(msg:telnet GET flow:from_server)   

       4. alert on any ssh traffic containing the keyword "SSH-2", from .128 to the server. Message should read: ".128 attempt to SSH to server."

   alert on any ssh traffic containing the keyword (msg:ssh-2)

       5. alert on any http traffic from .128 with the SYN flag set, from .128 to the server. Message should read: .128 attempt to the web server."

   alert on any http traffic from 128 with SYNflag set (msg:SYN flag set)

       6. alert on any http traffic with the SYN flag set from the CLASS A private network (10.0.0.0/8) to the server. Message should read "Possible DDOS."

       alert on any trffic with the SYN flag set from the CLASS A private network(10.0.0.0/8) to the server (msg:DDOS)

       7.   alert on any DNS traffic from 172.16.136.130 to the local DNS server (172.16.136.1) that contains the keyword "ubuntu." Message should read "DNS Query Ubuntu."

        alert on any DNS traffic from 172.16.136.130 to the local DNS server (172.16.136.1) that contains the keyword "ubuntu."(msg:"DNS zone" flow to ubuntu)

       8. alert on any packets from .128 to the server containing the text "supersecret.txt" (note this is the first time I didn't mention a service!)

       alert on any packets from .128 to the server containing the text "supersecret.txt" (msg:"packet" supetext.txt)

       9. alert on any ftp traffic from the .128 to the server that contains the keyword "pfarnsworth". Message should read "Pfarnsworth over ftp".

       alert on any ftp traffic from the .128 to the server that contains the keyword "pfarnsworth". (msg:"pfarnsworth" flow to_ftp)

       10. alert on any ssh traffic from .128 to the server with the FIN and ACK flags set. Message should read "F/A for SSH teardown."
       alert on any ssh traffic from .128 to the server with the FIN and ACK flags set. (msg:"ssh tear down" flown to_FIN ACK flags)

Related Questions

Navigate

• Browse (All)
• Browse H
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.