I am set up with three virtual machines running Ubuntu - a Server, Client, and Gateway. I am tasked with setting up Snort on the Gateway to monitor "attacks" from the Client to the Server. Snort is supposed to send the log files to a rsyslog server that I have set up on the Server. I am having trouble getting these logs to send.
In the snort.conf file, I set up:
output alert_syslog: LOG_AUTH LOG_ALERT
I flushed my iptables and opened everything for testing purposes (nmap reveals 514 is indeed open). I edited the rsyslog.conf file on the Gateway and added:
*.* @192.168.50.5
On the rsyslog.conf file on the Server, I added:
*.* /var/log/snort.log
And uncommented the following in both:
$ModLoad imudp.so
$UDPServerRun 514
When I run (eth2 = Client):
snort -A console -i eth2 -c /etc/snort/snort.conf
And ping the Server from the Client (I have a Snort rule to capture ICMP), a log file gets created on the Gateway in /var/log/snort/snort.log.xxxxxxxxxx. Nothing shows up on the Server though. Watching packets on Wireshark, I get two Syslog messages when I start Snort and two more when I exit (^C). The AUTHPRIV.INFO just says "session open for user root" and "session closed for user root":
For the record, I was attempting to follow this tutorial here:
Anyone have any idea what's going on?
Thanks for any advice.