Edit guardian configuration file, vi /usr/local/etc/snort/guardian.conf
Interface ens33
LogFile /var/log/snort/guardian.log
AlertFile /var/log/snort/alert_json.txt //location of the alert file
IgnoreFile /usr/local/etc/snort/guardian.ignore //whitelist
targetFile /usr/local/etc/snort/guardian.target //blacklist
TimeLimit 120 //blocking time, in seconds
Start guardian
/usr/bin/perl /usr/local/bin/guardian.pl -c /usr/local/etc/snort/guardian.conf
# or navigate to the directory containing guardian.pl
root@y:~/snort_src/guardian-1.7# perl ./guardian.pl -c /usr/local/etc/snort/guardian.conf
OS shows Linux
My IP address and interface are: 192.168.79.131 ens33
Loaded 0 addresses from /usr/local/etc/snort/guardian.ignore
Loaded 0 addresses from /usr/local/etc/snort/guardian.target
Becoming a daemon..
root@y:~/snort_src/guardian-1.7#
If you can see logs, it indicates that the snort.conf configuration is correct, and you can proceed with the following tests. Otherwise, please check the snort.conf configuration, as well as the snort directory and file permissions.
Linkage Test
If the previous test passed, remove or comment out the two rules you added in /usr/local/etc/rules/local.rules.
vi /usr/local/etc/rules/local.rules
Log in to another Windows test host (Note: Scanning from the same machine may cause the snort host to be inaccessible), open a browser, and download x-scan from http://tools.hetianlab.com/tools/X-Scan-v3.3-cn.rar and extract it. Double-click the file to open x-scan.
Set Scan Parameters
Click the âScan Parametersâ button, set the specified IP range to your snort hostâs IP address, and in the âGlobal Settingsâ âScan Moduleâ, select âSelect Allâ. In âPlugin Settingsâ, select all options for âSNMP-related settingsâ, âNETBIOS-related settingsâ, and âVulnerability detection script settingsâ. Click the start button to start the scan.
Observe if there are alert logs in the alert
# cd /var/log/snort
# tail -f alert
Once alert logs are found, start the linkage between guardian and iptables.
Execute iptables -L on the snort host to see if any rules have been added. If there are rules, the experiment is successful.
Problem Solving for an Unsuccessful Experiment
The experiment failed, and no rules were added. It seems like the guardian downloaded was not the originally recommended one for the lab (original link is invalid, found another one online), so the configuration might not work well.
1. I couldnât find scripts for several files⊠so I found a script online (link: https://blog.51cto.com/chenguang/7823276), but Iâm not familiar with scripting languages and unsure if the spaces align correctly in some parts
The following modified guardian file locations are in the places copied earlier, /usr/local/bin
#!/bin/bash
cd /usr/local/bin
# The start function is responsible for starting the guardian program. It first updates the PATH environment variable to include the local binary path, then starts the guardian program using the specified configuration file.
start()
{
# Add /usr/local/bin to the PATH environment variable
export PATH=$PATH:/usr/local/bin
# Start the guardian.pl script using /etc/guardian.conf
/usr/local/bin/guardian.pl -c /usr/local/etc/snort/guardian.conf
}
# The stop function is responsible for stopping the guardian program. It first checks if guardian is running, and if so, kills the process; otherwise, it outputs "guardian is not running ....".
stop()
{
# Search for a process named 'guardian.pl *-c'
ps aux |grep 'guardian.pl *-c' 2>&1 > /dev/null
# Judgement statement; if the process exists, terminate it
if [ $? -eq 0 ];
then
kill `ps aux |grep 'guardian.pl *-c' `
# If the process doesn't exist, output "guardian is not running ...."
else
echo "guardian is not running ...."
fi
}
# The status function checks if the guardian process is running; if it is, outputs "guardian is running ....", otherwise outputs "guardian is not running ....".
status()
{
ps aux |grep 'guardian.pl *-c' 2>&1 > /dev/null
if [ $? -eq 0 ];
then
echo "guardian is running ...."
else
echo "guardian is not running ...."
fi
}
# Executes different functions based on the parameter ($1) passed
case "$1" in
# If the parameter is start, call the start function
start)
start
;;
# If the parameter is stop, call the stop function
stop)
stop
;;
# If the parameter is restart, call the stop function first, then call the start function
restart)
stop
start
;;
# If the parameter is status, call the status function
status)
status;;
*)
# If the parameter is not one of the above, output the usage instructions
echo $"Usage: $0 {start|stop|restart|status}"
esac
