config/snort/snort.conf

   1 ###################################################
   2 #
   3 # This file contains the default snort configuration.
   4 # for all IPFire Versions
   5 # Unless you are totally happy with this file, please
   6 # only change whats needed
   7 # This file is automatically changed by
   8 # the webinterface, too.
   9 #
  10 #  1) Set the network variables for your network
  11 #  2) Configure preprocessors
  12 #  3) Configure output plugins
  13 #  4) Customize your rule set
  14 #
  15 ###################################################
  16 # Only area a user needs to edit
  17 include /etc/snort/vars
  18 var EXTERNAL_NET    !$HOME_NET
  19 var SMTP_SERVERS    $HOME_NET
  20 var HTTP_SERVERS    $HOME_NET
  21 var SQL_SERVERS     $HOME_NET
  22 var TELNET_SERVERS  $HOME_NET
  23 var HTTP_PORTS      80
  24 var SSH_PORTS       22 222
  25 var SHELLCODE_PORTS !80
  26 var ORACLE_PORTS    1521
  27 var AIM_SERVERS     [64.12.24.0/24,64.12.25.0/24,64.12.26.14/24,64.12.28.0/24,64.12.29.0/24,64.12.161.0/24,64.12.163.0/24,205.188.5.0/24,205.188.9.0/24]
  28 var RULE_PATH       /etc/snort/rules
  29
  30 ###################################################
  31 # Do NOT Edit past this line
  32 ###################################################
  33 config detection: search-method lowmem
  34 preprocessor flow: memcap 2097152, stats_interval 0, hash 2
  35 preprocessor frag2: memcap 2097152
  36 preprocessor stream4: memcap 2097152, detect_scans, disable_evasion_alerts
  37 preprocessor stream4_reassemble: noalerts
  38 preprocessor http_inspect: global iis_unicode_map unicode.map 1252
  39 preprocessor http_inspect_server: server default profile all ports { 80 8080 }
  40 preprocessor rpc_decode: 111 32771
  41 preprocessor bo
  42 preprocessor telnet_decode
  43 preprocessor flow-portscan: \
  44         scoreboard-memcap-talker 1048576 \
  45         scoreboard-rows-talker 10000 \
  46         talker-sliding-scale-factor 0.50 \
  47         talker-fixed-threshold 30 \
  48         talker-sliding-threshold 30 \
  49         talker-sliding-window 20 \
  50         talker-fixed-window 30 \
  51         scoreboard-memcap-scanner 1048576 \
  52         scoreboard-rows-scanner 10000 \
  53         scanner-sliding-window 20 \
  54         scanner-sliding-scale-factor 0.50 \
  55         scanner-fixed-threshold 15 \
  56         scanner-sliding-threshold 40 \
  57         scanner-fixed-window 15 \
  58         unique-memcap 1048576 \
  59         unique-rows 10000 \
  60         server-memcap 1048576 \
  61         server-rows 10000 \
  62         server-watchnet $HOME_NET \
  63         server-ignore-limit 100 \
  64         server-learning-time 3600 \
  65         server-scanner-limit 4 \
  66         alert-mode once \
  67         output-mode msg \
  68         tcp-penalties on
  69 #=========================================
  70 include $RULE_PATH/classification.config
  71 include $RULE_PATH/reference.config
  72 #=========================================
  73 include $RULE_PATH/community-bot.rules
  74 include $RULE_PATH/community-deleted.rules
  75 include $RULE_PATH/community-dos.rules
  76 include $RULE_PATH/community-exploit.rules
  77 include $RULE_PATH/community-ftp.rules
  78 include $RULE_PATH/community-game.rules
  79 include $RULE_PATH/community-icmp.rules
  80 include $RULE_PATH/community-imap.rules
  81 include $RULE_PATH/community-inappropriate.rules
  82 include $RULE_PATH/community-mail-client.rules
  83 include $RULE_PATH/community-misc.rules
  84 include $RULE_PATH/community-nntp.rules
  85 include $RULE_PATH/community-oracle.rules
  86 include $RULE_PATH/community-policy.rules
  87 include $RULE_PATH/community-sip.rules
  88 include $RULE_PATH/community-smtp.rules
  89 include $RULE_PATH/community-sql-injection.rules
  90 include $RULE_PATH/community-virus.rules
  91 include $RULE_PATH/community-web-attacks.rules
  92 include $RULE_PATH/community-web-cgi.rules
  93 include $RULE_PATH/community-web-client.rules
  94 include $RULE_PATH/community-web-dos.rules
  95 include $RULE_PATH/community-web-iis.rules
  96 include $RULE_PATH/community-web-misc.rules
  97 include $RULE_PATH/community-web-php.rules