Upgrading to Snort 2.8.4

Hopefully, everyone running Snort has been paying attention and noticed that Snort 2.8.4 was released on 07 April and the corresponding new rule sets were released on 08 April. If you pay for Snort rules, the new netbios.rules will not work with Snort versions prior to 2.8.4, so you need to upgrade.

Upgrading was mostly painless just to get Snort running, though the dcerpc2 preprocessor settings definitely may require tweaking beyond the defaults. Generally, when I'm upgrading and there is something like a new preprocessor, I will start by getting Snort upgraded and successfully running with the defaults for the preprocessor, then will tune the settings as needed after I'm sure the new version is working.

The first thing to do after downloading and extracting is read the RELEASENOTES and also any applicable READMEs. Since the dcerpc2 preprocessor is new, the README.dcerpc2 may be of particular interest. A lot of people don't realize how much documentation is included.

$ wget http://www.snort.org/dl/snort-2.8.4.tar.gz
$ tar xzf snort-2.8.4.tar.gz
$ cd snort-2.8.4/doc
$ ls
AUTHORS               README.alert_order            README.ppm
BUGS                  README.asn1                   README.sfportscan
CREDITS               README.csv                    README.ssh
INSTALL               README.database               README.ssl
Makefile.am           README.dcerpc                 README.stream5
Makefile.in           README.dcerpc2                README.tag
NEWS                  README.decode*                README.thresholding
PROBLEMS              README.decoder_preproc_rules  README.variables
README                README.dns                    README.wireless
README.ARUBA          README.event_queue            TODO
README.FLEXRESP       README.flowbits               USAGE
README.FLEXRESP2      README.frag3                  WISHLIST
README.INLINE         README.ftptelnet              faq.pdf
README.PLUGINS        README.gre                    faq.tex
README.PerfProfiling  README.http_inspect           generators
README.SMTP           README.ipip                   snort_manual.pdf
README.UNSOCK         README.ipv6                   snort_manual.tex
README.WIN32          README.pcap_readmode          snort_schema_v106.pdf

The following is the default configuration as listed in the README.dcerpc2.

preprocessor dcerpc2_server: default, policy WinXP, \
     detect [smb [139,445], tcp 135, udp 135, rpc-over-http-server 593], \
     autodetect [tcp 1025:, udp 1025:, rpc-over-http-server 1025:], \
     smb_max_chain 3

For some environments, it may be useful to turn off the preprocessor alerts or turn them off for specific systems.

preprocessor dcerpc2: memcap 102400, events none

Or:

preprocessor dcerpc2_server: default, policy WinXP, \
     detect [smb [139,445], tcp 135, udp 135, rpc-over-http-server 593], \
     autodetect [tcp 1025:, udp 1025:, rpc-over-http-server 1025:], \
     smb_max_chain 3
preprocessor dcerpc2_server: net $SCANNERS, detect none

No matter what, the dcerpc configuration should be removed from the snort.conf and replaced with a dcerpc2 configuration for Snort 2.8.4.

After that, I'll configure and install Snort.

$  ./configure --enable-dynamicplugin --enable-inline --enable-perfprofiling
$ make
$ sudo /etc/rc.d/rc.snort-inline stop
$ sudo make install
$ which snort
/usr/local/bin/snort
$ snort -V

      ,,_     -*> Snort! <*-
     o"  )~   Version 2.8.4 (Build 26) inline
      ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
              Copyright (C) 1998-2009 Sourcefire, Inc., et al.              
              Using PCRE version: 7.7 2008-05-07      

$ sudo /etc/rc.d/rc.snort-inline start    
Starting snort-inline    
Initializing Inline mode    
building cached socket reset packets

Although the old netbios.rules will still work with the new version, it's also time to update to the latest rules to take advantage of the smaller number of netbios.rules. Note that this only applies for subscription rules since the free ones won't reflect the changes for 30 days.

Some of the rules in the new netbios.rules file have SIDs that were unchanged, so I decided to re-enable any of those that I had previously disabled in my oinkmaster.conf. I can always disable them again, but with the new preprocessor and possible changes to the remaining SIDs, I decided it was best to reevaluate them.

Since I'm also using precompiled shared object rules, I also update from the ones compiled for 2.8.3.2 to the ones compiled for 2.8.4. I keep the rule stubs in a directory along with symlinks to the corresponding SO files, so I simply remove the symlink and recreate it to the new SO rules.

$ rm /etc/snort/so_rules/*so
$ ln -s /etc/snort/so_rules/precompiled/CentOS-5.0/i386/2.8.4/*so /etc/snort/so_rules/

Tweet