This is a quick guide to help you setup SnortSMS. It will be assumed you have at least to servers available to fuction as the SnortSMS Collector and SnortSMS Sensor.

System Requirements

SnortSMS Collector

• Unix Operating System (FreeBSD, Linux, Solaris, etc...)
• curl (CLI)- Non-interactive tool to get files from FTP, GOPHER, HTTP(S)
• Apache - The extremely popular Apache http server
• php4 - PHP Scripting Language (Apache Module and CLI)
    php4-pcre - The pcre shared extension for php
    php4-pcntl - The pcntl shared extension for php
    php4-mysql - The mysql shared extension for php
    pear-DB - PEAR Database Abstraction Layer for php

Be sure include the CLI build option for PHP as SnortSMS requires some scripts to execute from the command line shell. Since SnortSMS uses cURL in CLI mode via shell system calls and forking, so you do not need cURL libs compiled into PHP directly. Mysql, pcre, and pcntl should be compiled into PHP or available as a PHP module extention.

SnortSMS IDS Sensor

• Unix Operating System (FreeBSD, Linux, Solaris, etc...)
• Snort - Lightweight network intrusion detection system
• Webmin - Web-based interface for system administration for Unix
• Barnyard - (Optional)

The sensor Agent software is a custom Webmin module, so you will need to install Webmin on the sensor as a prerequisite. This shouldn't be an issue since Webmin is also a great Administration tool for the sensor as well.

Barnyard is an optional tool which allows Snort alerts to be propagated to a central database in the background. Although Snort can write to the database directly, we recommend Barnyard as it is more reliable and frees Snort of latency and fail-over issues.

SnortSMS Collector Setup

Prerequisites

We assume you have an available server established with Apache, PHP (with above requirements), and MySQL client libraries (and MySQL server - if you plan to run the databases locally).

Installing the SnortSMS Collector Website

1. Extract the SnortSMS archive files to a preferred web-root location. ( For example: /usr/local/www/snortsms )
2. Insure that the subdirectory "conf/" and the file "conf/conf.php" are read/writeable by the webserver (www).

   	# chown :www conf/ conf/conf.php
   	# chmod 775 conf/
   	# chmod 664 conf/conf.php

3. Your default PHP configuration might need some tweaking. Here's a few adjustment settings for your 'php.ini' file:

   	max_execution_time = 120
   	max_input_time = 120
   	memory_limit = 100M 
   	post_max_size = 20M
   	upload_max_filesize = 20M
   	include_path = ".:/usr/local/share/pear"

4. SnortSMS needs a temporary place to write files. Take note of this location for your Global Configuration Settings. We suggest you create a subdirectory within your system's temp directory:

   	# mkdir /var/tmp/snortsms
   	# chmod 1777 /var/tmp/snortsms

5. Verify your Apache webserver settings are correct and pointing to this new web-root location. ( For example: /usr/local/www/snortsms )

Creating the SnortSMS Database

1. Create a new database, preferably called 'SNORTSMS'. Use the supplied MySQL dump to restore the database tables.

   	# mysql -u root -p < {snortsms_source}/schema/SNORTSMS.mysql

2. Create a new database user 'snortsms' (or use an existing user) and grant permissions to the SNORTSMS database. Take note of the username and password for your Global Configuration Settings.

Creating the Snort Alert Database (optional)

If you would like a central database where all Snort sensors can send the Alert events to, you can create a Snort database on the SnortSMS collector or an alternate server.

1. Create a new database, preferably called 'SNORT'. The Snort distribution source files include an automated script which can build out the proper table structure.
   Use the supplied MySQL script to create the database tables:

   	# mysql -u root -p < {snort-x.x.x}/schemas/create_mysql

2. Create a new database user 'snortsms' (or use an existing user) and grant permissions to the SNORTSMS database. Take note of the username and password for your Global Configuration Settings.

Modify the Snort Event Database

Note: If you plan to use the SnortSMS Alert Browser to view incoming alerts, you will need to modify Snort's default database.

3. Modify the 'events' table in your SNORT central database by adding the 'viewed' field. Execute the following from your mysql console:
   

   	mysql> use {your snort db name};
   	mysql> alter table event add column viewed tinyint (1);

   Or execute the script we've supplied with SnortSMS:
   

   	# mysql -d {SnortDB} -u root -p < {snortsms_source}/schema/SNORT_DB_mod.mysql
   	

SnortSMS IDS Sensor Setup

Prerequisites

We assume you have an available server established with a basic installation of Snort and Webmin (also Barnyard and MySQL Client libraries if you desire to propagate Snort Events to a central database).

Installing the SnortSMS Agent

The SnortSMS Agent is designed to reside on the remote Snort sensor and is packaged as a third-party Webmin Module. The Agent included with the SnortSMS Collector distribution under the 'Agent' directory path. This Agent allows the SnortSMS Collector server to communicate and remotely control the sensor.

1. With a web browser, browse and login to your sensor's Webmin interface.
2. Important: Be sure to select "Disable session authentication" in Webmin -> Webmin Configuration -> Authentication section. Otherwise SnortSMS Collector (cURL) will not be able to authenticate into your Webmin interface.
3. On the "Webmin" tab, click on the "Webmin Configuration" icon.
4. Click on the "Webmin Modules" icon.
5. In the "Install Module" box, enter the source of the "snortsms-agent-x.x.x.wbm.gz" module.
6. Click the "Install Module" button to install the agent.
7. Once installed, browse to the "Others" tab, and click on the "SnortSMS Agent" icon to verify the install. The agent itself has no configuration requirments from within Webmin (all options are governed by the collector).
8. Create a new Webmin user, preferably 'snortsms'. Allow only access to the "SnortSMS Agent" module for this user. Take note of the username and password you have chosen.

Configuring SnortSMS

Prerequisites

At this juncture, you should have a SnortSMS Collector and at least one SnortSMS sensor established and functional. We will now walk you through a few steps required to get SnortSMS configured and start managing your Snort sensor(s).

Configure SnortSMS global settings

1. Browse to the SnortSMS web location. If all is well you should see the SnortSMS interface.
2. For your 1st time logging in, Userid -> 'admin' Password -> 'admin'.
3. On the top menu, under "Settings", click the "Global Settings".
4. Enter the database settings from the previous database section.
5. Verify the remainder of the settings insuring all paths are correct for your system.
6. On the top menu, under "Settings", click the "Test Configuration". Be sure to resolve any errors reported here before continuing.

   Create a Snort Daemon Profile
   You MUST create at least one Snort Daemon Profile. This is used to tell SnortSMS how to launch the snort process on the remote sensor.

7. Browse to Libraries -> Snort Daemon Profiles.
8. Click 'New Snort Profile' link.
9. Give it a name, set the interface snort will sniff, and path to where the snort.conf file will reside on the sensor (be sure this path exists).
10. Be sure you enter the correct path to the Snort executable on your sensors.
11. Also be sure the PID file and path are valid.
12. Provide the correct values foreach of the Snort command line switches (arguments).
13. Now save the profile.

    Populating the libraries
    Before you can assign configurations to your sensors, you must first populate the SnortSMS configuration libraries. The easiest way to fill up the libraries is to import the various Snort snapshot tarball files. The Snort source code tarball contains much of the default varaibles and config directives. There are also many VRT and Community rules now available in seperate files.
    
    So start by importing the Snort source tarball (i.e. Snort-x.x.x.tar.gz). Don't worry, SnortSMS will only find what it needs. Next, import any of the Rule distribution tarballs (i.e. Community-Rules-x.x.tar.gz). You can either download it to your local desktop or import it from the web.

14. Click on the "Import" link under the "Libraries" menu.
15. Enter the URL or tarball file, then press "Import".

    This will parse the tarball file, detecting any and all rules and directives, thus populating the SnortSMS libraries accordingly. Once this is done, you should be able to browse the libraries and verify the imported resources.

    Create a Rule Profile
    Now that your resource libraries are full, we suggest you 1st create at least one rule profile. You cannot assign rules directly to sensors, only rule profiles can be assigned to each sensor.

16. Browse to Libraries -> Rules -> Rule Profiles.
17. Click on the "New Profile" link, enter a profile name and save the new profile.
18. Now, click the "Pick" link on your profile to browse through the rule libraries and assign rules you want to this profile.

    Adding Sensors
    Now you are ready to adding sensor profiles into the system.

19. Click on the Sensors -> Administration Console link.
20. Click "Add Sensor".
21. Enter the Sensor name and save. Note: Do not include special characters.
22. Click on the individual tabs to configure the rest of the sensor properties. Remember to 'Update' each tab settings before moving on to the next tab.
23. TIP: If you have multiple sensors to add which are similar, configure at least one sensor, then use the 'Clone Sensor' link on the Administration Console.
24. It might be a good idea to check communications between SnortSMS and the sensors. Click on the "Status" tab in Sensor Administration, and clicj on 'Refresh Status'. If everything is working correctly, you should get a green connection indication and Sensor statistics.
25. Verify communication to the sensor's Snort daemon by clicking on the 'info' link.
26. If communications are working, you may now start pushing out the configurations to the sensors.

    Testing
    At this point, SnortSMS should be properly configured. We also assume you have at least one functional Snort-base sensor defined. From the Administration Console, click anywhere on your sensor line. You should be able to get statistical data from the 'Status' tab. There is also a "Test Configuration" under the Settings menu. This is very helpful in determining common issues.

Troubleshooting

Issue:	I get an error while trying to save the Global Settings.
Resolution:	Be sure the "conf.php" file has read/write permissions by the webserver. This includes the parent "conf" directory.
Issue:	I cannot connect to the remote agent.
Resolution:	A ton of reasons for this one: - Be sure to "Disable session authentication" in Webmin. - Are you using the correct protocol (http/https)? - Username exits within Webmin and the user has access granted to the SnortSMS Agent module. - Does cURL work from the command line?
Issue:	I get a database connection error.
Resolution:	Verify your database server and table installation. Insure you have the correct username and password configured in SnortSMS Global Settings and in your database permissions section.
Issue:	I get an error "Missing DB.php".
Resolution:	- Be sure the PEAR-DB abstraction layer is properly installed. - Check that your PHP "include" path is correct and includes the path to the PEAR files.
Issue:	Importing Snort snapshot file failed.
Resolution:	- Verify your path setting for temporary files in 'SnortSMS Global Settings'. - Verify your temp path is read/writable by your web server userid (chmod 1777 /tmp/path). - Verify correct paths for 'curl' & 'tar' on your web server in 'SnortSMS Global Settings' and that cURL is working properly. - Verify your max upload, max memory, and max execution parameters in 'php.ini' config file.
Issue:	Barnyard Fails to start via SnortSMS.
Resolution:	- In Barnyard Daemon Profiles section, verifiy path to barnyard executable on sensor. - In Barnyard Daemon Profiles section, verifiy path to PID file on sensor. - Take a look at the Barnyard command trace file. Should be located on the sensor in the snort config directory under the filename 'SMS_barnyard.?.conf.CMD'.