Suricata IDS/IPS integration with Mikrotik (now with OSSEC)

RouterOS General
41

Ok, it sounds good, I will do it same to you.
And what do you think about ntop? any trouble in have in same server both services? I have Snorby on port 3000 but I could change ntop another port.

How could I enable notifications from Suricata/Snorby in email? I enabled Snorby emails in /opt/snorby/config/initializers/mail_config.rb

 ActionMailer::Base.delivery_method = :smtp
 ActionMailer::Base.smtp_settings = {
   :address              => "mail.mydomain.com",
   :port                 => Port_Sent_Email,
   :domain               => "mydomain.com",
   :user_name            => "myusername",
   :password             => "mypassword",
   :authentication       => "plain",
   :enable_starttls_auto => true
 }

But I don’t see any logs neither any sent to my email.

Thanks.

42

I didn’t have any problems running ntop on the same server. Yes, just change the port. With regards to email from suricata, I can’t help you there as I haven’t implemented that feature.

43

Hello to all

I release 2 project at GitHub:

https://github.com/elmaxid/ips-mikrotik-suricata: Module to connect Suricata / Barnyard2 to MikroTik for IPS on an eventual alert

** Features

I will write an article on wiki to implement this combo to make an IPS with Suricata and RouterOS.

Regards

M.

44

Hi, yesterday I had a false positive with this:
fast.log.2:04/25/2017-14:05:58.149205 [] [1:2002994:7] ET SCAN Rapid IMAP Connections - Possible Brute Force Attack [] [Classification: Misc activity] [Priority: 3] {TCP}

alert tcp $EXTERNAL_NET any → $HOME_NET 143 (msg:“ET SCAN Rapid IMAP Connections - Possible Brute Force Attack”; flow:to_server; flags: S,12; threshold: type both, track by_src, count 30, seconds 60; reference:url,doc.emergingthreats.net/2002994; classtype:misc-activity; sid:2002994; rev:7;)

I’m seeing that rule which if it detects 30 count in 60 sec it will drop the traffic, its okay and mikotik dropped all traffic, but my question is. Are there way to upload that limit or add my public IP as whitelist?

Maybe adding in threshold.config this to avoid ban IP?
suppress gen_id 1, sig_id 2002994, track by_src, ip my_ip_public

Any idea to upload limit? I won’t like remove that rule from that IP really but if there isn’t another solution I will have to do it.

Thanks.

45

In oinkmaster.conf you can modify rules are they are loaded. In this case, you can change the count and seconds parameter on this rule using the following directive:

modifysid 2002994 "count 30, seconds 60;" "count 60; seconds 120;"

Look for the modifysid directive in your oinkmaster.conf. For more info check out https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster

46

Thanks you very much as always. I added it to my file.

A question, I had in threshold.config another rules (suppress gen_id 1, sig_id 2020565 for example). I added it to oinkmaster.conf too. Suricata checks both files?

47

Oinkmaster checks for new rules from the public sources and loads them. That is where the modifysid directive will take place.

Suricata uses the rules to determine how it matches patterns against the network traffic and suppresses those rules you’ve put in threshold.config.

48

Nice, thanks!

49

Hi, I’m trying to enable notifications via email to my account but I was reading and reading and I haven’t luck. I use postfix and I’m trying to send it to a server with TLS (I created file sasl in postfix with details login)
How could I enable it?

Thanks.

50

Are you referring to maximan’s implementation?

51

No no, I’m using your main implementation. I have Mikrotik enabled with logs and I receive some emails when router drops something but I would like to get emails too, is it possible?

Thanks.

52

There is not an email function within Suricata or my implementation. Would you like an email every time a block is sent to the Mikrotik?

53

I added that option, in rule I marked “Log” and i receive emails when Mikrotik blocks but I would like an email from Suricata if blocks anything. The email from Mikrotik isn’t very useful because the info isn’t complete (Not cause, not rule ID, etc)
Here a example (body is empty):

firewall,info [DROP_BLOCK] input: in:A_Router_Mail/Nas_XXXX_eth2 out:(none), src-mac f8:8e:85:e2:49:18, proto TCP (SYN), 91.197.234.22:43276->192.168.3.2:3380, len 44

thanks.

54

Check the update to suricata_block.php that I just made. :slight_smile:

55

Thanks! Its an email very useful :smiley: :smiley:
I have to change some values on my mail server because I’m using TLS 587 but I will let you know when its done and working fine.

Thanks again for your job.

56

I have a little problem, when the event notification turns on? If I use from shell mail -s “test” xxxx@hotmail.com I get it, but not with script suricata_block.php. Should I enable anything more?

I can’t see any log from that script. How could I debug it? Thanks again.

57

Check these settings in php.ini:

http://php.net/manual/en/mail.configuration.php

58

I got a test successfully but I don’t receive emails from script suricata-block. How could I debug it more? I have alerts on Snorby which I think that I should have an email from script.

Here my test.php which I receive alerts:

<?php
$to = "mydomain@mydomain.com";
$subject = "My subject";
$txt = "Hello world!";
$headers = "From: mydomain@mydomain.com" . "\r\n" .
"CC: mydomain@mydomain.com";

mail($to,$subject,$txt,$headers);
?>

Thanks.

59

You did update suricata_block.php with the new one? That is the same code as in suricata_block.

60

Solved! I use Debian and I had to declare variable before with this:

$email_alert = true;

Now I receive emails from alerts. Thanks!