1 ###################################################
4 # some parts of this file are changed/updated by the webif
5 ###################################################
8 include /etc/snort/vars
10 ###################################################
11 # Step #1: Set the network variables. For more information, see README.variables
12 ###################################################
14 # taken from /etc/snort vars
17 # Set up the external network addresses. Leave as "any" in most situations
18 ipvar EXTERNAL_NET any
20 # List of DNS servers on your network
21 #ipvar DNS_SERVERS $HOME_NET
23 # List of SMTP servers on your network
24 ipvar SMTP_SERVERS $HOME_NET
26 # List of web servers on your network
27 ipvar HTTP_SERVERS $HOME_NET
29 # List of sql servers on your network
30 ipvar SQL_SERVERS $HOME_NET
32 # List of telnet servers on your network
33 ipvar TELNET_SERVERS $HOME_NET
35 # List of ssh servers on your network
36 ipvar SSH_SERVERS $HOME_NET
38 # List of ftp servers on your network
39 ipvar FTP_SERVERS $HOME_NET
41 # List of sip servers on your network
42 ipvar SIP_SERVERS $HOME_NET
44 # List of ports you run web servers on
45 portvar HTTP_PORTS [80,81,82,83,84,85,86,87,88,89,311,383,444,591,593,631,901,1220,1414,1741,1830,2301,2381,2809,3037,3057,3128,3702,4343,4848,5250,6080,6988,7000,7001,7144,7145,7510,7777,7779,8000,8008,8014,8028,8080,8085,8088,8090,8118,8123,8180,8181,8222,8243,8280,8300,8500,8800,8888,8899,9000,9060,9080,9090,9091,9443,9999,11371,34443,34444,41080,50002,55555]
47 # List of ports you want to look for SHELLCODE on.
48 portvar SHELLCODE_PORTS !80
50 # List of ports you might see oracle attacks on
51 portvar ORACLE_PORTS 1024:
53 # List of ports you want to look for SSH connections on:
54 portvar SSH_PORTS [22,222]
56 # List of ports you run ftp servers on
57 portvar FTP_PORTS [21,2100,3535]
59 # List of ports you run SIP servers on
60 portvar SIP_PORTS [5060,5061,5600]
62 # List of file data ports for file inspection
63 portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143]
65 # List of GTP ports for GTP preprocessor
66 portvar GTP_PORTS [2123,2152,3386]
68 # other variables, these should not be modified
69 ipvar AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]
71 # Path to your rules files (this can be a relative path)
72 # Note for Windows users: You are advised to make this an absolute path,
73 # such as: c:\snort\rules
74 var RULE_PATH /etc/snort/rules
75 var SO_RULE_PATH /etc/snort/so_rules
76 var PREPROC_RULE_PATH /etc/snort/preproc_rules
78 # If you are using reputation preprocessor set these
79 # Currently there is a bug with relative paths, they are relative to where snort is
80 # not relative to snort.conf like the above variables
81 # This is completely inconsistent with how other vars work, BUG 89986
82 # Set the absolute path appropriately
83 var WHITE_LIST_PATH /etc/snort/rules
84 var BLACK_LIST_PATH /etc/snort/rules
87 ###################################################
88 # Step #2: Configure the decoder. For more information, see README.decode
89 ###################################################
91 # Stop generic decode events:
92 config disable_decode_alerts
94 # Stop Alerts on experimental TCP options
95 config disable_tcpopt_experimental_alerts
97 # Stop Alerts on obsolete TCP options
98 config disable_tcpopt_obsolete_alerts
100 # Stop Alerts on T/TCP alerts
101 # config disable_tcpopt_ttcp_alerts
103 # Stop Alerts on all other TCPOption type events:
104 config disable_tcpopt_alerts
106 # Stop Alerts on invalid ip options
107 # config disable_ipopt_alerts
109 # Alert if value in length field (IP, TCP, UDP) is greater th elength of the packet
110 # config enable_decode_oversized_alerts
112 # Same as above, but drop packet if in Inline mode (requires enable_decode_oversized_alerts)
113 # config enable_decode_oversized_drops
115 # Configure IP / TCP checksum mode
116 config checksum_mode: all
118 # Configure maximum number of flowbit references. For more information, see README.flowbits
119 # config flowbits_size: 64
121 # Configure ports to ignore
122 # config ignore_ports: tcp 21 6667:6671 1356
123 # config ignore_ports: udp 1:17 53
125 # Configure active response for non inline operation. For more information, see REAMDE.active
126 # config response: eth0 attempts 2
128 # Configure DAQ related options for inline operation. For more information, see README.daq
131 # config daq_dir: <dir>
132 # config daq_mode: <mode>
133 # config daq_var: <var>
135 # <type> ::= pcap | afpacket | dump | nfq | ipq | ipfw
136 # <mode> ::= read-file | passive | inline
137 # <var> ::= arbitrary <name>=<value passed to DAQ
138 # <dir> ::= path as to where to look for DAQ module so's
140 # Configure specific UID and GID to run snort as after dropping privs. For more information see snort -h command line options
145 # Configure default snaplen. Snort defaults to MTU of in use interface. For more information see README
150 # Configure default bpf_file to use for filtering what traffic reaches snort. For more information see snort -h command line options (-F)
155 # Configure default log directory for snort to log to. For more information see snort -h command line options (-l)
160 ###################################################
161 # Step #3: Configure the base detection engine. For more information, see README.decode
162 ###################################################
164 # Configure PCRE match limitations
165 config pcre_match_limit: 3500
166 config pcre_match_limit_recursion: 1500
168 # Configure the detection engine See the Snort Manual, Configuring Snort - Includes - Config
169 config detection: search-method ac-split search-optimize max-pattern-len 20
171 # Configure the event queue. For more information, see README.event_queue
172 config event_queue: max_queue 8 log 5 order_events content_length
174 ###################################################
175 ## Configure GTP if it is to be used.
176 ## For more information, see README.GTP
177 ####################################################
181 ###################################################
182 # Per packet and rule latency enforcement
183 # For more information see README.ppm
184 ###################################################
186 # Per Packet latency configuration
187 #config ppm: max-pkt-time 250, \
188 # fastpath-expensive-packets, \
191 # Per Rule latency configuration
192 #config ppm: max-rule-time 200, \
194 # suspend-expensive-rules, \
195 # suspend-timeout 20, \
198 ###################################################
199 # Configure Perf Profiling for debugging
200 # For more information see README.PerfProfiling
201 ###################################################
203 #config profile_rules: print all, sort avg_ticks
204 #config profile_preprocs: print all, sort avg_ticks
206 ###################################################
207 # Configure protocol aware flushing
208 # For more information see README.stream5
209 ###################################################
210 config paf_max: 16000
212 ###################################################
213 # Step #4: Configure dynamic loaded libraries.
214 # For more information, see Snort Manual, Configuring Snort - Dynamic Modules
215 ###################################################
217 # path to dynamic preprocessor libraries
218 dynamicpreprocessor directory /usr/lib/snort_dynamicpreprocessor/
220 # path to base preprocessor engine
221 dynamicengine /usr/lib/snort_dynamicengine/libsf_engine.so
223 # path to dynamic rules libraries
224 # dynamicdetection directory /usr/local/lib/snort_dynamicrules
227 ###################################################
228 # Step #5: Configure preprocessors
229 # For more information, see the Snort Manual, Configuring Snort - Preprocessors
230 ###################################################
232 # GTP Control Channle Preprocessor. For more information, see README.GTP
233 # preprocessor gtp: ports { 2123 3386 2152 }
235 # Inline packet normalization. For more information, see README.normalize
236 # Does nothing in IDS mode
237 preprocessor normalize_ip4
238 preprocessor normalize_tcp: ips ecn stream
239 preprocessor normalize_icmp4
240 preprocessor normalize_ip6
241 preprocessor normalize_icmp6
243 # Target-based IP defragmentation. For more inforation, see README.frag3
244 preprocessor frag3_global: max_frags 65536
245 preprocessor frag3_engine: policy windows detect_anomalies overlap_limit 10 min_fragment_length 100 timeout 180
247 # Target-Based stateful inspection/stream reassembly. For more inforation, see README.stream5
248 preprocessor stream5_global: track_tcp yes, \
253 max_active_responses 2, \
254 min_response_seconds 5
255 preprocessor stream5_tcp: policy windows, detect_anomalies, require_3whs 180, \
256 overlap_limit 10, small_segments 3 bytes 150, timeout 180, \
257 ports client 21 22 23 25 42 53 70 79 109 110 111 113 119 135 136 137 139 143 \
258 161 222 445 513 514 587 593 691 1433 1521 1741 2100 3306 6070 6665 6666 6667 6668 6669 \
259 7000 8181 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779, \
260 ports both 80 81 82 83 84 85 86 87 88 89 110 311 383 443 444 465 563 591 593 631 636 901 989 992 993 994 995 1220 1414 1830 2301 2381 2809 3037 3057 3128 3702 4343 4848 5250 6080 6988 7907 7000 7001 7144 7145 7510 7802 7777 7779 \
261 7801 7900 7901 7902 7903 7904 7905 7906 7908 7909 7910 7911 7912 7913 7914 7915 7916 \
262 7917 7918 7919 7920 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123 8180 8222 8243 8280 8300 8500 8800 8888 8899 9000 9060 9080 9090 9091 9443 9999 11371 34443 34444 41080 50002 55555
263 preprocessor stream5_udp: timeout 180
265 # performance statistics. For more information, see the Snort Manual, Configuring Snort - Preprocessors - Performance Monitor
266 # preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000
268 # HTTP normalization and anomaly detection. For more information, see README.http_inspect
269 preprocessor http_inspect: global iis_unicode_map unicode.map 1252 compress_depth 65535 decompress_depth 65535
270 preprocessor http_inspect_server: server default \
271 http_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA RPC_ECHO_DATA } \
272 chunk_length 500000 \
273 server_flow_depth 0 \
274 client_flow_depth 0 \
276 oversize_dir_length 500 \
277 max_header_length 750 \
280 small_chunk_length { 10 5 } \
281 ports { 80 81 82 83 84 85 86 87 88 89 311 383 444 591 593 631 901 1220 1414 1741 1830 2301 2381 2809 3037 3057 3128 3702 4343 4848 5250 6080 6988 7000 7001 7144 7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123 8180 8181 8222 8243 8280 8300 8500 8800 8888 8899 9000 9060 9080 9090 9091 9443 9999 11371 34443 34444 41080 50002 55555 } \
282 non_rfc_char { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 } \
284 extended_response_inspection \
287 unlimited_decompress \
288 normalize_javascript \
289 apache_whitespace no \
302 # ONC-RPC normalization and anomaly detection. For more information, see the Snort Manual, Configuring Snort - Preprocessors - RPC Decode
303 preprocessor rpc_decode: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779 no_alert_multiple_requests no_alert_large_fragments no_alert_incomplete
305 # Back Orifice detection.
308 # FTP / Telnet normalization and anomaly detection. For more information, see README.ftptelnet
309 preprocessor ftp_telnet: global inspection_type stateful encrypted_traffic no check_encrypted
310 preprocessor ftp_telnet_protocol: telnet \
311 ayt_attack_thresh 20 \
312 normalize ports { 23 } \
314 preprocessor ftp_telnet_protocol: ftp server default \
315 def_max_param_len 100 \
316 ports { 21 2100 3535 } \
318 ignore_telnet_erase_cmds yes \
319 ftp_cmds { ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP } \
320 ftp_cmds { CEL CLNT CMD CONF CWD DELE ENC EPRT } \
321 ftp_cmds { EPSV ESTA ESTP FEAT HELP LANG LIST LPRT } \
322 ftp_cmds { LPSV MACB MAIL MDTM MIC MKD MLSD MLST } \
323 ftp_cmds { MODE NLST NOOP OPTS PASS PASV PBSZ PORT } \
324 ftp_cmds { PROT PWD QUIT REIN REST RETR RMD RNFR } \
325 ftp_cmds { RNTO SDUP SITE SIZE SMNT STAT STOR STOU } \
326 ftp_cmds { STRU SYST TEST TYPE USER XCUP XCRC XCWD } \
327 ftp_cmds { XMAS XMD5 XMKD XPWD XRCP XRMD XRSQ XSEM } \
328 ftp_cmds { XSEN XSHA1 XSHA256 } \
329 alt_max_param_len 0 { ABOR CCC CDUP ESTA FEAT LPSV NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD } \
330 alt_max_param_len 200 { ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD } \
331 alt_max_param_len 256 { CWD RNTO } \
332 alt_max_param_len 400 { PORT } \
333 alt_max_param_len 512 { SIZE } \
334 chk_str_fmt { ACCT ADAT ALLO APPE AUTH CEL CLNT CMD } \
335 chk_str_fmt { CONF CWD DELE ENC EPRT EPSV ESTP HELP } \
336 chk_str_fmt { LANG LIST LPRT MACB MAIL MDTM MIC MKD } \
337 chk_str_fmt { MLSD MLST MODE NLST OPTS PASS PBSZ PORT } \
338 chk_str_fmt { PROT REST RETR RMD RNFR RNTO SDUP SITE } \
339 chk_str_fmt { SIZE SMNT STAT STOR STRU TEST TYPE USER } \
340 chk_str_fmt { XCRC XCWD XMAS XMD5 XMKD XRCP XRMD XRSQ } \
341 chk_str_fmt { XSEM XSEN XSHA1 XSHA256 } \
342 cmd_validity ALLO < int [ char R int ] > \
343 cmd_validity EPSV < [ { char 12 | char A char L char L } ] > \
344 cmd_validity MACB < string > \
345 cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
346 cmd_validity MODE < char ASBCZ > \
347 cmd_validity PORT < host_port > \
348 cmd_validity PROT < char CSEP > \
349 cmd_validity STRU < char FRPO [ string ] > \
350 cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } >
351 preprocessor ftp_telnet_protocol: ftp client default \
354 ignore_telnet_erase_cmds yes \
358 # SMTP normalization and anomaly detection. For more information, see README.SMTP
359 preprocessor smtp: ports { 25 465 587 691 } \
360 inspection_type stateful \
363 bitenc_decode_depth 0 \
370 normalize_cmds { ATRN AUTH BDAT CHUNKING DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN EVFY } \
371 normalize_cmds { EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND SOML } \
372 normalize_cmds { STARTTLS TICK TIME TURN TURNME VERB VRFY X-ADAT X-DRCP X-ERCP X-EXCH50 } \
373 normalize_cmds { X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \
374 max_command_line_len 512 \
375 max_header_line_len 1000 \
376 max_response_line_len 512 \
377 alt_max_command_line_len 260 { MAIL } \
378 alt_max_command_line_len 300 { RCPT } \
379 alt_max_command_line_len 500 { HELP HELO ETRN EHLO } \
380 alt_max_command_line_len 255 { EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET } \
381 alt_max_command_line_len 246 { SEND SAML SOML AUTH TURN ETRN DATA RSET QUIT ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \
382 valid_cmds { ATRN AUTH BDAT CHUNKING DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN EVFY } \
383 valid_cmds { EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND SOML } \
384 valid_cmds { STARTTLS TICK TIME TURN TURNME VERB VRFY X-ADAT X-DRCP X-ERCP X-EXCH50 } \
385 valid_cmds { X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \
386 xlink2state { enabled }
388 # Portscan detection. For more information, see README.sfportscan
389 preprocessor sfportscan: proto { all } memcap { 10000000 } sense_level { medium }
391 # ARP spoof detection. For more information, see the Snort Manual - Configuring Snort - Preprocessors - ARP Spoof Preprocessor
392 # preprocessor arpspoof
393 # preprocessor arpspoof_detect_host: 192.168.40.1 f0:0f:00:f0:0f:00
395 # SSH anomaly detection. For more information, see README.ssh
396 preprocessor ssh: server_ports { 22 222 } \
398 max_client_bytes 19600 \
399 max_encrypted_packets 20 \
400 max_server_version_len 100 \
401 enable_respoverflow enable_ssh1crc32 \
402 enable_srvoverflow enable_protomismatch
404 # SMB / DCE-RPC normalization and anomaly detection. For more information, see README.dcerpc2
405 preprocessor dcerpc2: memcap 102400, events [co ]
406 preprocessor dcerpc2_server: default, policy WinXP, \
407 detect [smb [139,445], tcp 135, udp 135, rpc-over-http-server 593], \
408 autodetect [tcp 1025:, udp 1025:, rpc-over-http-server 1025:], \
409 smb_max_chain 3, smb_invalid_shares ["C$", "D$", "ADMIN$"]
411 # DNS anomaly detection. For more information, see README.dns
412 preprocessor dns: ports { 53 } enable_rdata_overflow
414 # SSL anomaly detection and traffic bypass. For more information, see README.ssl
415 preprocessor ssl: ports { 443 444 465 563 636 989 992 993 994 995 7801 7802 7900 7901 7902 7903 7904 7905 7906 7907 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 }, trustservers, noinspect_encrypted
417 # SDF sensitive data preprocessor. For more information see README.sensitive_data
418 preprocessor sensitive_data: alert_threshold 25
420 # SIP Session Initiation Protocol preprocessor. For more information see README.sip
421 preprocessor sip: max_sessions 40000, \
422 ports { 5060 5061 5600 }, \
445 max_call_id_len 80, \
446 max_requestName_len 20, \
450 max_contact_len 512, \
453 # IMAP preprocessor. For more information see README.imap
458 bitenc_decode_depth 0 \
461 # POP preprocessor. For more information see README.pop
466 bitenc_decode_depth 0 \
469 # Modbus preprocessor. For more information see README.modbus
470 preprocessor modbus: ports { 502 }
472 # DNP3 preprocessor. For more information see README.dnp3
473 preprocessor dnp3: ports { 20000 } \
477 # Reputation preprocessor. For more information see README.reputation
478 #preprocessor reputation: \
480 # priority whitelist, \
482 # whitelist $WHITE_LIST_PATH/white_list.rules, \
483 # blacklist $BLACK_LIST_PATH/black_list.rules
486 ###################################################
487 # Step #6: Configure output plugins
488 # For more information, see Snort Manual, Configuring Snort - Output Modules
489 ###################################################
492 # Recommended for most installs
493 # output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types
495 # Additional configuration for specific types of installs
496 # output alert_unified2: filename snort.alert, limit 128, nostamp
497 # output log_unified2: filename snort.log, limit 128, nostamp
500 # output alert_syslog: LOG_AUTH LOG_ALERT
503 # output log_tcpdump: tcpdump.log
506 # output database: alert, <db_type>, user=<username> password=<password> test dbname=<name> host=<hostname>
507 # output database: log, <db_type>, user=<username> password=<password> test dbname=<name> host=<hostname>
510 # output alert_prelude
512 # metadata reference data. do not modify these lines
513 include /etc/snort/rules/classification.config
514 include /etc/snort/rules/reference.config
517 ###################################################
518 # Step #7: Customize your rule set
519 # For more information, see Snort Manual, Writing Snort Rules
520 ###################################################
523 # site specific rules