Snort.Conf Samples

The goal of this project is to make a set of sample snort.conf files. These will represent different size and goal installs of snort. We do not intend to provide snort.conf files that you can use without modification or understanding, but guides to help you benefit from the experience of the community as a whole.

The discussion to create these configuration files will occur on the bleeding-sigs list.

The files for this project will be stored here:

http://doc.emergingthreats.net/bin/view/Main/SnortConfSamples

Smoothwall and Honeywall files are at:

http://doc.emergingthreats.net/bin/view/Main/HoneywallSamples

Russian Business Network files are at:

http://doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

We welcome submissions and tips to improve these files, as well as ideas for new types of configs to add.

This project is maintained by JamesMcQuaid

-- MattJonkman - 20 Mar 2007

Updates:

Updated versions of many of these files are available at: http://doc.emergingthreats.net/bin/view/Main/SnortConfSamples

* Diagram portraying home network defended by multiple layers of Snort Inline:

Honeywall Roo 1.0:

• snort_inline_roo-1.0.hw-139.conf: Snort.conf for Roo 1.0

• A_Novices_Guide_to_Using_Multiple_Layers_of_Snort_to_Defend_the_Home_Network_roo-1.0.hw-139.pdf: Bleeding topology for the home (Roo 1.0)

• A_Novices_Guide_to_Using_Multiple_Layers_of_Snort_to_Defend_the_Home_Network_roo-1.0.hw-139.txt: Bleeding topology for the home (Roo 1.0)

Honeywall Roo 1.1:

• snort_inline.conf: Honeywall snort-inline configuration: Bleeding Snort config for Honeywall Roo 1.1

Honeywall Roo 1.2:

• A_Novices_Guide_to_Using_Multiple_Layers_of_Snort_to_Defend_the_Home_Network.doc: Bleeding topology for the home: Honeywall Roo 1.1 and 1.2

• A_Novices_Guide_to_Using_Multiple_Layers_of_Snort_to_Defend_the_Home_Network.pdf: Bleeding topology for the home: Honeywall Roo 1.1 and 1.2

• crontab: crontab file for Honeywall which schedules reboot.pl and clean.pl

• clean.pl.txt: Clean out Honeywall's logging directories on a schedule

• reboot.pl.txt: Reboot Honeywall on a schedule

Smoothwall Express 2.0:

• snort.in: snort.in for Smoothwall Express 2.0 Fixes 1-9

• snort.conf: snort.conf for Smoothwall Express 2.0 Fixes 1-9

• SmoothwallSnortHowTo.txt: This file explains how to set up snort on Smoothwall Express 2.0 Fixes 1-9

• blackhole.conf: 80,000 blacklisted domains for Smoothwall 2.0; leave last line blank. Includes the RBN's Malaysian domains. Updated 12-9-2007.

• config: IP blocks for Smoothwall 2.0: includes the RBN, Chinese hackers, trojan servers, viral spam boxes, bogons and hijacked ranges. A base upon which to build a customized home firewall.

• dedupe.pl.txt: Rename to dedupe.pl. Sorts and removes duplicate entries in Smoothwall's blackhole.conf; populates newblackhole.conf file (which you then rename to blackhole.conf).

• dnsmasq.conf: DNSMasq config for Smoothwall 2.0's blackhole

• tldblackhole.conf: Top Level Domains for Smoothwall 2.0; add to top of blackhole.conf; edit to suit your preferences

• BadMP3SitesBlackhole.txt: Evil MP3 sites targeting the kids with malware. Use in Smoothwall 2.0's blackhole.conf file.

• http://sourceforge.net/projects/smoothiemods/ Smoothwall Homebrew Mods at sourceforge

Smoothwall Express 3.0:

• config-ipblock_Smoothwall3: IP blocks for Smoothwall 3: includes the RBN, Chinese hackers, trojan servers, viral spam boxes, bogons and hijacked ranges (with descriptions). A base upon which to build a customized home firewall. Customizing your firewall: you can obtain bad IPs by looking at the Bleeding DShield rules, the Bleeding Compromised rules, the Bleeding Drop rules, and the Bleeding BotCC? rules (I have included group 1 of 16). Also, regularly read Symantec's Threat Explorer (http://www.symantec.com/business/security_response/threatexplorer/threats.jsp) and SRI's Multiperspective Malware Infection Analysis Page (http://www.cyber-ta.org/releases/malware-analysis/public/). If you are a Windows user, you can edit these files with Notepad++ (http://sourceforge.net/projects/notepad-plus/).

• config-hosts: 80,000 blacklisted domains for Smoothwall 3; leave last line blank. Place in /var/smoothwall/hosts/, then rename config-hosts to config. Includes the RBN's Malaysian domains. Updated 12-9-2007.

• hosts: 80,000 blacklisted domains for Smoothwall 3; also placed in /var/smoothwall/hosts/. Includes the RBN's Malaysian domains. Updated 12-9-2007.

Russian Business Network:

• RussianBusinessNetworkIPs.txt Updated 12-5-2007.
• 4000RBNDomainsAndObjects.txt: Apply liberally. Updated 12-5-2007.
• http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK7740
• http://blog.washingtonpost.com/securityfix/2007/11/russian_business_network_down.html
• http://blog.washingtonpost.com/securityfix/2007/10/mapping_the_russian_business_n.html
• http://blog.washingtonpost.com/securityfix/2007/10/taking_on_the_russian_business.html
• http://www.washingtonpost.com/wp-dyn/content/story/2007/10/12/ST2007101202661.html?hpid=moreheadlines
• http://www.washingtonpost.com/wp-dyn/content/article/2007/10/12/AR2007101201700.html?sub=new
• "The Russians Go Chinese": http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK7829
• Bleeding RBN Signatures: http://docs.bleedingthreats.net/bin/view/Main/RussianBusinessNetwork
• David Bizeul's research: http://isc.sans.org/presentations/RBN_study.pdf
• RBNExploit: http://rbnexploit.blogspot.com

• ChineseAttackIPs.txt Recent DOS attacks

• bogons: Complete list of bogons on 10-21-2007

Firekeeper for Firefox:

• BlackholeForFirekeeper.txt: Snort in the browser evil domain blocking

• BlackholeForFirekeeperInstructions.txt: Blackhole DNS in Firefox