3

I am set up with three virtual machines running Ubuntu - a Server, Client, and Gateway. I am tasked with setting up Snort on the Gateway to monitor "attacks" from the Client to the Server. Snort is supposed to send the log files to a rsyslog server that I have set up on the Server. I am having trouble getting these logs to send.

In the snort.conf file, I set up:

output alert_syslog: LOG_AUTH LOG_ALERT

I flushed my iptables and opened everything for testing purposes (nmap reveals 514 is indeed open). I edited the rsyslog.conf file on the Gateway and added:

*.* @192.168.50.5

On the rsyslog.conf file on the Server, I added:

*.* /var/log/snort.log

And uncommented the following in both:

$ModLoad imudp.so
$UDPServerRun 514

When I run (eth2 = Client):

snort -A console -i eth2 -c /etc/snort/snort.conf

And ping the Server from the Client (I have a Snort rule to capture ICMP), a log file gets created on the Gateway in /var/log/snort/snort.log.xxxxxxxxxx. Nothing shows up on the Server though. Watching packets on Wireshark, I get two Syslog messages when I start Snort and two more when I exit (^C). The AUTHPRIV.INFO just says "session open for user root" and "session closed for user root":

enter image description here

For the record, I was attempting to follow this tutorial here:

http://books.google.com/books?id=TPXusCxyKXAC&pg=PA115&lpg=PA115&dq=log+local0+snort.conf&source=bl&ots=PeMZAPE7DF&sig=Q4R5rkbvDZjfwoCOGL7Gy-1gHho&hl=en&sa=X&ei=gYw_VL3iBcHjoAS0j4KQBw&ved=0CFUQ6AEwCQ#v=onepage&q&f=false

Anyone have any idea what's going on?

Thanks for any advice.

6
  • 1
    Try restarting the syslog service.
    – ZaSter
    Oct 16, 2014 at 21:07
  • I did... multiple times. And I tried restarting the VM's. And re-installing rsyslog.
    – rphello101
    Oct 17, 2014 at 2:49
  • what versions are you using? of ubuntu, snort, syslog?
    – Ry Jones
    Oct 17, 2014 at 3:06
  • Snort - 2.9.6.2, Ubuntu - 14.04, Rsyslog - 8.4.2
    – rphello101
    Oct 17, 2014 at 16:38
  • If you specify . /var/log/everything.log, will it record messages to the local syslog instance?
    – Konrads
    Oct 22, 2014 at 13:17

2 Answers 2

1
+50

I'd say that if the syslog messages about sessions opening and closing are getting through, then rsyslog is presumably doing its thing at both ends (but confirm it by sending to syslog on the gateway using logger). Also, the fact that the log file gets created on the gateway suggests that the log messages are being mishandled on the gateway, rather than later in the chain process.

I'd be looking to confirm that snort is in fact sending UDP to syslog. Do you have the expected packets on port 514, presumably on the loopback interface of the gateway?

It looks like you could just circumvent the local syslog, and go directly to the server host:

output alert_syslog: host=192.168.50.5:514, LOG_AUTH LOG_ALERT

If that doesn't appeal, what happens if you explicitly send the snort output to localhost:514? Or to a different IP on that host.

Are there firewall issues that might block the packets to port 514 on the gateway?

You did restart snort to pick up the new configuration? It is reading the configuration file you think it is? (Try specifying that explicitly with -c, and/or confirming that's part of the command-line you see with ps).

(At some point, you'll want to limit what gets filed as snort messages, but that's not what you're currently stuck on).

1
  • Finally got it figured out. Turns out that the '-A console' part of the command that I was using to run snort was causing some problems with not logging. Besides that, declaring host=ip:514 worked. And I also limited the Snort messages (kept getting massive 4-5 gb log files).
    – rphello101
    Oct 23, 2014 at 18:29
1

Note that on Ubuntu Snort logs with LOG_AUTH facility by default so you need to tail -f /var/log/auth.log rather than /var/log/syslog. Just a note from someone who got stuck on this for a while :)

1
  • I got stuck into this for almost 5 hours and your comment saved me from psychological breakdown. Thanks!
    – Skeptic
    May 25 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.