Possible Software RAID Issue With Recent mdadm Package

We identified an issue with mdadm version "mdadm - v4.4 - 2024-11-07 - 4" that can cause software RAID issues after a reboot. We have removed this version and pushed a downgraded version "mdadm - v4.4 - 2024-11-07 - 2" to the Security Onion repo.

If you are not running software RAID, then you should not be affected at all.

If you are running software RAID, then you should check to see what version of the mdadm package is installed on all of your grid members to see if they need to be downgraded.

Please note that the following instructions assume that you installed using our official Security Onion ISO image. If you are using some other unsupported installation method, then your mileage may vary.

Check the existing mdadm version on all grid nodes:

sudo salt \* cmd.run 'mdadm --version'

If all grid nodes show version "mdadm - v4.4 - 2024-11-07 - 2", then you are running the correct version.

If one or more grid nodes have version "mdadm - v4.4 - 2024-11-07 - 4" then you need to downgrade mdadm:

sudo salt \* cmd.run 'echo y | dnf downgrade mdadm'

Once that completes, then verify the downgraded version on all nodes:

sudo salt \* cmd.run 'mdadm --version'

Security Onion and Linux Kernel Copy Fail Vulnerability CVE-2026-31431

A flaw was found in the Linux kernel that allows for local privilege escalation:

https://access.redhat.com/security/cve/cve-2026-31431

Updated kernel packages should be coming soon to resolve this issue.

UPDATE 2026/05/04 Oracle has released an updated UEK kernel (5.15.0-319.201.4.4) to address this vulnerability (https://linux.oracle.com/errata/ELSA-2026-50253.html). Assuming you're running Security Onion on Oracle 9 with the Oracle UEK kernel, you can update to this new kernel with a standard soup (https://docs.securityonion.net/en/3/main/soup/) followed by a reboot.

If you can't wait until updated kernels are released and need to apply a temporary mitigation, you can run the following command and then reboot:

sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"

After updated kernels are released, that temporary mitigation can be reverted by running the following command and then rebooting:

sudo grubby --update-kernel=ALL --remove-args="initcall_blacklist=algif_aead_init"

 

Security Onion 2.4 Base OS

Introduction

Recent events have forced us to change course on the base operating system (OS) for Security Onion 2.4. 

On 6/21/2023, Red Hat announced changes to their source code availability for Red Hat Enterprise Linux (RHEL):

https://www.redhat.com/en/blog/furthering-evolution-centos-stream

On 6/26/2023, Red Hat then posted a follow-up:

https://www.redhat.com/en/blog/red-hats-commitment-open-source-response-gitcentosorg-changes

These announcements prompted us to go back to first principles and re-evaluate the base OS options for our upcoming Security Onion 2.4 RC1 release.

First Principles

To re-evaluate our base OS options based on first principles, we start with the basic hard requirements. Security Onion 2.4 primarily consists of Docker images orchestrated by Saltstack, so here are our requirements for the base OS:

• stable Linux kernel
• stable Docker packages
• stable Saltstack packages
• freely available at no cost
• long term support (greater than 3 years)

In addition to the requirements above, our customers have indicated certain preferences:

• Most customers prefer some sort of Red Hat derivative.
• Some customers strongly prefer operating systems that meet specific US government standards or certifications.
  
  

Options

Based on the requirements and preferences above, we considered the following options:

• Rocky Linux 9 (free RHEL rebuild) - https://rockylinux.org/ 
• Alma Linux 9 (free RHEL/CentOS rebuild) - https://almalinux.org/ 
• Oracle Linux 9 (free RHEL rebuild) - https://www.oracle.com/linux/ 
• CentOS Stream 9 (free RHEL upstream) - https://www.centos.org/centos-stream/ 
• Ubuntu 22.04 (free Debian derivative) - https://ubuntu.com/ 
• Debian 12 - https://www.debian.org/ 

Over the last few weeks, we performed an exhaustive investigation of each option to see if they satisfy the requirements and preferences above and also determine if there are any additional advantages or disadvantages.

Security Onion 2.4 ISO Image

At the conclusion of our exhaustive investigation, we decided to base our Security Onion 2.4 ISO image on Oracle Linux 9 for the following reasons:

• Oracle Linux 9 satisfies the highest number of requirements and preferences for the greatest number of customers.
• Oracle Linux is a RHEL rebuild that has been available since 2006 so they have a long track record.
• Oracle Linux is free. From https://yum.oracle.com/oracle-linux-downloads.html:
  Since 2006, Oracle Linux has been completely free to download and use. Free source code, binaries, and updates. Freely redistributable. Free for production use.
• Oracle is well funded and fully committed to Oracle Linux in the long term:
  https://www.oracle.com/news/announcement/blog/keep-linux-open-and-free-2023-07-10/ 
• Oracle Linux 9 FIPS (Federal Information Processing Standards) certification is listed as “Under Test” as of 3/7/2023:
  https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/IUT-List 
• Oracle Linux offers the ability to run a newer Linux kernel which, in theory, should be more secure than the default kernel included in other RHEL rebuilds:
  https://unix.foo/posts/enterprise-linux/
  https://blogs.oracle.com/linux/post/tracking-linux-stable-kernels-with-uek 
  
  

Network Installation

If you don’t want to use our Security Onion 2.4 ISO image, you can still perform a network installation of our Security Onion components after manually installing one of the following:

• Oracle Linux 9
• Rocky Linux 9
• Alma Linux 9
• CentOS Stream 9
• RHEL 9
• Ubuntu 22.04
• Debian 12
  
  

Support

Customers with premium support and professional services can reach out to their normal support contacts for more information about support. 

If you are a non-paid community user, then please pay close attention to the support levels below.

Supported

Our Security Onion 2.4 ISO image (based on Oracle Linux 9) is the only fully supported installation method. Choose this option if any of the following apply to you:

• You are deploying in an enterprise environment.
• You are deploying in an airgap environment.
• You are performing a distributed deployment.
• You want the quickest and easiest installation with the fewest issues.
• You need full support.
  
  

Unsupported

If you don’t want to use our Security Onion 2.4 ISO image and choose to perform a manual OS installation followed by a network installation of our Security Onion components, then we recommend using Oracle Linux 9 or Rocky Linux 9. CentOS Stream 9 or Alma Linux 9 should also work. Another option might be RHEL 9 itself although that is a paid option.

If you really want to run Ubuntu 22.04 or Debian 12, then please note that these distros may work but they get less testing and therefore you will be more likely to run into issues.

Q&A

What will the Security Onion 2.4 ISO image be based on?

Our Security Onion 2.4 ISO image will be based on Oracle Linux 9.

Why Oracle Linux?

Oracle Linux has been around since 2006 and so it has a long track record. Additionally, FIPS certification is in progress. Finally, Oracle Linux offers a newer Linux kernel which, in theory, should be more secure than the default kernel included in other RHEL rebuilds.

Is Oracle Linux free?

Yes, from https://yum.oracle.com/oracle-linux-downloads.html:

Since 2006, Oracle Linux has been completely free to download and use. Free source code, binaries, and updates. Freely redistributable. Free for production use.

If we don’t want to use the Security Onion 2.4 ISO image or Oracle Linux, do we have other options?

If you don’t want or need support, then you can choose from Rocky Linux 9, Alma Linux 9, CentOS Stream 9, RHEL 9, Ubuntu 22.04, or Debian 12. However, please note that if you choose one of these options there will be more manual work required and you may be more likely to run into issues.

Why not use Rocky Linux 9 for the Security Onion 2.4 ISO image?

As of 7/25/2023, Rocky Linux 9 is not yet listed at the FIPS certification pages:

https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/IUT-List

https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List 

Why not use Alma Linux 9 for the Security Onion 2.4 ISO image?

Alma Linux does not yet have FIPS certification. Also, it has only been around since 2021 so it doesn’t have that long of a track record.

Why not use CentOS Stream for the Security Onion 2.4 ISO image?

CentOS Stream does not have any FIPS certification whatsoever.

Why not use Ubuntu for the Security Onion 2.4 ISO image?

Standard Ubuntu has no FIPS certification. FIPS certification requires a paid upgrade to Ubuntu Pro. Additionally, Ubuntu seems to be focused on their own snap architecture for the future.

Why not use Debian for the Security Onion 2.4 ISO image?

Debian does not have any FIPS certification whatsoever.

Why not use another Linux distro like fill in the blank?

We considered several other Linux distributions but only the ones listed above met the core requirements.

When do these Security Onion changes take effect?

These changes go into effect for the upcoming Security Onion 2.4 RC1 release.

When will Security Onion 2.4 reach General Availability (GA)?

These OS changes delayed our release schedule for Security Onion 2.4, but it was important to take our time and fully investigate our options. Security Onion 2.4 RC1 is coming soon. Stay tuned!

What does all of this mean for Security Onion 2.3?

There are no planned OS changes for 2.3.

I am a current customer with premium support and professional services and I have other questions about this change. To whom should I reach out?

Please feel free to reach out to your account manager.

I am a community user of Security Onion and I have other questions about this change. How may I ask those questions?

You may start a new discussion at https://securityonion.net/discuss. 

UPDATE 2023/07/27 - Added that these changes go into effect for the upcoming Security Onion 2.4 RC1 release.

Grepping an Active Log File and Mailing Matches

Recently, I had a need to be alerted by email each and every time a certain user logged in. After a few false starts, I eventually settled on something like this (sanitized and simplified for this blog):

tail -n0 -f /var/log/secure | grep --line-buffered "user" | while read line; do echo $line | mail myemail@example.com -s "Found"; done

We use the standard "tail -f" to follow the /var/log/secure file. The "-n0" option is used so that tail will start 0 lines from the end of the file. We only care about new entries in the file, so we start at the very end of the file, ignoring any existing entries.

Next, we pipe that to grep, looking for the username "user". The "--line-buffered" option is used to force grep to flush each and every line of output (instead of waiting for its default buffer to fill). Per the man page, this option can be a performance penalty, but this is not a concern in this scenario.

Then, we pipe that to a while loop that iterates over each line. For each line of output, we generate an email with a subject of "Found" and include what was found in the body of the email.

This solution works quite nicely and can very easily be extended in the following ways:

• adding multiple grep criteria
• modifying format of log entry to be emailed
• changing final action from email to something else (like adding an IPTables drop rule)

Enjoy!

SANS 401 Mentor class coming to Augusta!

I'll be mentoring SANS 401 Security Essentials in Augusta, GA on Tuesday nights starting January 12, 2010. ISSA members are eligible for a 25% discount!

SANS 401 Security Essentials mentored by Doug Burks in Augusta GA

Why should you take SANS 401 Security Essentials?

* Are you a Systems Administrator or Network Engineer who would like to learn more about security? This course gives a very thorough overview of security theory and practice. Additionally, the tools and techniques that you learn in this class are directly applicable to your current job (and will prepare you for the future).

* DoD 8570 Compliance. If you work for the Department of Defense (or would like to), DoD Mandate 8570 requires security certification for any employee performing Information Assurance (security) work. The Security Essentials certification is among those required for 8570. For more information, please see the SANS 8570 page.

* Complement your CISSP. If you've already taken the CISSP, SANS 401 Security Essentials is the perfect technical complement. It takes all the theory that you learned at a high level for the CISSP and applies it in a very practical and updated manner. SANS 401 is "where the rubber meets the road".

* Augment your Windows/Linux skills. Highly experienced with Windows, but not so much with Linux? Or the other way around? SANS 401 Security Essentials dedicates an entire section to Windows security and another entire section to Linux security.

* Considering the SANS GSE (GIAC Security Expert) or SANS Masters program? SANS 401 Security Essentials is required for both.

These are just a few reasons to register for SANS 401 Security Essentials. For more information, please see:

SANS 401 Security Essentials mentored by Doug Burks in Augusta GA

Don't forget that ISSA members are eligible for a 25% discount! If you would like to register for the ISSA and/or SANS 401, please let me know and I'll be glad to help get you registered.

Using Metasploit's db_autopwn on the Security Onion LiveCD

UPDATE: This issue has been fixed in the Security Onion LiveCD 20090731 release.

I was testing the new Security Onion LiveCD yesterday and trying to use Metasploit's db_autopwn function. The first step of db_autopwn is to create a database to hold the information about your potential targets. This is done with the db_create command. When I issued this command, I got an error about sqlite3 (the default database driver for db_autopwn).

I had forgotten to install the sqlite and libsqlite3-ruby packages. If you're having this problem, you can fix it with the following command:
sudo aptitude -y install sqlite libsqlite3-ruby

This will be fixed in the next release of the Security Onion LiveCD.

securityonion@securityonion:/usr/local/bin/framework3$ ./msfconsole

=[ msf v3.3-dev
+ -- --=[ 392 exploits - 234 payloads
+ -- --=[ 20 encoders - 7 nops
=[ 168 aux

msf > db_create
[*] Creating a new database instance...
[-] Error while running command db_create: no such file to load -- sqlite3
msf > quit

securityonion@securityonion:/usr/local/bin/framework3$ sudo aptitude -y install sqlite libsqlite3-ruby
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
The following NEW packages will be installed:
libsqlite0{a} libsqlite3-ruby libsqlite3-ruby1.8{a} sqlite
0 packages upgraded, 4 newly installed, 0 to remove and 0 not upgraded.
Need to get 247kB of archives. After unpacking 811kB will be used.
Writing extended state information... Done
Get:1 http://archive.ubuntu.com jaunty/main libsqlite0 2.8.17-4build1 [176kB]
Get:2 http://archive.ubuntu.com jaunty/universe libsqlite3-ruby1.8 1.2.4-2 [51.3kB]
Get:3 http://archive.ubuntu.com jaunty/universe libsqlite3-ruby 1.2.4-2 [4042B]
Get:4 http://archive.ubuntu.com jaunty/main sqlite 2.8.17-4build1 [16.2kB]
Fetched 247kB in 1s (150kB/s)
Selecting previously deselected package libsqlite0.
(Reading database ... 118520 files and directories currently installed.)
Unpacking libsqlite0 (from .../libsqlite0_2.8.17-4build1_i386.deb) ...
Selecting previously deselected package libsqlite3-ruby1.8.
Unpacking libsqlite3-ruby1.8 (from .../libsqlite3-ruby1.8_1.2.4-2_i386.deb) ...
Selecting previously deselected package libsqlite3-ruby.
Unpacking libsqlite3-ruby (from .../libsqlite3-ruby_1.2.4-2_all.deb) ...
Selecting previously deselected package sqlite.
Unpacking sqlite (from .../sqlite_2.8.17-4build1_i386.deb) ...
Processing triggers for man-db ...
Setting up libsqlite0 (2.8.17-4build1) ...

Setting up libsqlite3-ruby1.8 (1.2.4-2) ...
Setting up libsqlite3-ruby (1.2.4-2) ...
Setting up sqlite (2.8.17-4build1) ...
Processing triggers for libc6 ...
ldconfig deferred processing now taking place
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
Writing extended state information... Done

securityonion@securityonion:/usr/local/bin/framework3$ ./msfconsole

=[ msf v3.3-dev
+ -- --=[ 392 exploits - 234 payloads
+ -- --=[ 20 encoders - 7 nops
=[ 168 aux

msf > db_create
[*] Creating a new database instance...
[*] Successfully connected to the database
[*] File: /home/securityonion/.msf3/sqlite3.db
msf >

Suggestions for the Security Onion LiveCD

I'm currently working on the next version of the Security Onion LiveCD. What specific packages/features would you like to see added to the Security Onion LiveCD? Post a comment here or contact me on Twitter. Thanks!

The Security Onion LiveCD is now available!

The Security Onion LiveCD is now available! You can download it from the following location:
http://distro.ibiblio.org/pub/linux/distributions/security-onion/

What is it?
The Security Onion LiveCD is a bootable CD that contains software used for installing, configuring, and testing Intrusion Detection Systems.

What software does it contain?
The Security Onion LiveCD is based on Xubuntu 9.04 and contains Snort 2.8.4.1, Snort 3.0.0b3 (Beta), sguil, idswakeup, nmap, metasploit, scapy, hping, fragroute, fragrouter, netcat, paketto, tcpreplay, and many other security tools.

What can it be used for?

• The Security Onion LiveCD can be used for Intrusion Detection. Simply boot the CD and double-click either the Snort-Sguil or SnortSP-Sguil desktop shortcuts. The Snort and Sguil daemons will then start, listening on eth0 for any suspicious traffic and creating alerts in the Sguil console.
• The Security Onion LiveCD can be used to test an Intrusion Detection System. Simply boot the CD and use the included tools (such as nmap, metasploit, idswakeup, scapy, hping, and others) to test your existing IDS or to test the included Snort 2.8.4.1 and Snort 3.0 Beta 3.
• The Security Onion LiveCD can be used to install an Intrusion Detection System. Simply boot the CD and double-click the Install desktop shortcut. For more information about installation, please see the README desktop shortcut.

You can read more about the Security Onion LiveCD (and, specifically, the integration of Snort 3.0 and Sguil) in my SANS GCIA Gold Paper "Snort 3.0 Beta 3 for Analysts".

Please take a look at the Security Onion LiveCD and let me know what you think!

* Special thanks to:

• Marty Roesch and the whole SourceFire team for all of their work these last 10 years to get Snort to where it is today.
  
• The Sguil team for the best open-source tool to manage Snort alerts.
  
• The SecurixLive crew for their awesome NSMnow installer, the easiest way to install and configure Snort/Sguil on Ubuntu Linux.
• Ubuntu (and Debian) for their well-made Linux distribution(s).
• The Reconstructor team for a very easy to use tool for remastering Ubuntu LiveCDs.
• All developers in the open-source community who work so hard and produce such amazing tools.
  

Snort 3.0 (SnortSP) Beta 3 -- Inline Bridging Mode in 3 Steps

To complete the updating of my 3-part series on Installing and Configuring Snort 3 Beta 3, I now present to you the final chapter in this trilogy: the updated recipe for Snort 3 Inline Bridging Mode in 3 Steps. Snort 3.0 Beta 3 has changed the syntax for creating a new dsrc, so this has been reflected in the new recipe.

Step 1: Add a new function to your snort.lua file
If you followed the updated Snort 3.0 Beta 3 Installation HOWTO, then the default snort.lua file is in /etc/snortsp/snort.lua. Open the file and add the following function:

function bridge (interface1, interface2)
if interface2 == nil then
error("Two interface strings must be specified ( e.g. bridge(\"eth0\", \"eth1\") )")
end
dsrc1 = {name="src1",
type="afpacket",
intf=interface1..":"..interface2,
flags=10,
snaplen=1514,
display="none",
tcp={maxflows=262144, maxidle=30, flow_memcap=10000000},
other={maxflows=131072, maxidle=30, flow_memcap=1000000},
cksum_mode=0x0,
}
dsrc.new(dsrc1)
eng.new({name="e1"})
eng.link({engine="e1", source="src1"})
eng.start("e1")
end

Step 2: Start SnortSP
Start SnortSP using the following command:

sudo snortsp -L /etc/snortsp/snort.lua

SnortSP will start up and read your new snort.lua file. You will then be greeted by the SnortSP Lua shell.

Step 3: Use the bridge() function
In the Lua shell, type the following (replacing eth0 and eth1 with the correct interfaces on your system):

bridge("eth0", "eth1")

Once the bridge is up and running, you can do the following to display packets traversing the bridge:

eng.set_display({engine="e1", display="none"})
Press the Up arrow and change "none" to "classic".
View the output.
Press the Up arrow twice to retrieve the "none" command and press Enter.

When finished, shut down SnortSP by running the following command:

ssp.shutdown()

Integrating Snort 3.0 Beta 3 and Sguil in 3 Steps

Since I updated the "Installing Snort 3.0 Beta on Ubuntu 8.04" post to work with Snort 3.0 Beta 3, here's the update for the "Integrating Snort 3.0 (SnortSP) and Sguil in 3 Steps" post. Since the original post, NSMnow 1.3.5 has been released, so the URL has been updated in the recipe to reflect this new version. Also, there appears to be a bug in the current sspiffy.sh whereby it configures the dsrc type to be "file" instead of "pcap". I added a quick one-liner to correct this in the snort.lua file.

Please note that if you have an existing NSMnow installation, following this recipe may or may not work. This recipe is designed for new NSMnow installations.

The best open source tool to manage Snort alerts is Sguil and the easiest way to install Sguil is using NSMnow. NSMnow automatically installs and configures barnyard2 (compatible with SnortSP's unfied2 format), sancp, Sguil, and Snort 2.x. We're going to replace NSMnow's snort alert process with Snort 3.0.

This quick recipe assumes that you're running on Ubuntu 8.04 and your primary network interface is eth0. You should be able to copy/paste each of the three code blocks into your terminal.

Obligatory disclaimer: I offer no warranty of any kind. If this breaks your box, you get to keep both pieces.

Step 1: Get root privileges

##########################
sudo -i
##########################

Step 2: Install NSMnow

##########################
mkdir /usr/local/src/NSMnow
cd /usr/local/src/NSMnow
wget http://www.securixlive.com/download/nsmnow/NSMnow-1.3.5.tar.gz
tar zxvf NSMnow-1.3.5.tar.gz
./NSMnow -i -y
##########################

Step 3: Configure NSMnow and SnortSP and start

##########################
if ! grep "/nsm/server_data/server1/load" /etc/apparmor.d/usr.sbin.mysqld > /dev/null
then
sed -i 's|}| /nsm/server_data/server1/load/* r,|g' /etc/apparmor.d/usr.sbin.mysqld
echo "}" >> /etc/apparmor.d/usr.sbin.mysqld
fi
/etc/init.d/apparmor restart
/usr/local/sbin/nsm --server --start
/usr/local/sbin/nsm_sensor_ps-start --skip-snort-alert
mkdir /etc/snortsp_alert
cd /etc/snortsp_alert
cp -R /etc/nsm/sensor1/* .
mv snort.conf snort_orig.conf
sspiffy.sh /usr/local -c snort_orig.conf -i eth0
sed -i 's|type="file"|type="pcap"|g' snort.lua
grep -v "sameip" rules/bad-traffic.rules > rules/bad-traffic.rules.2
rm -f rules/bad-traffic.rules
mv rules/bad-traffic.rules.2 rules/bad-traffic.rules
snortsp -C -L snort.lua
##########################

Snort 3.0 is now capturing packets on eth0 and analyzing them. Let's verify that now.

Launch the Sguil client by opening a new terminal and typing the following:

##########################
sguil.tk
##########################

When prompted, login to Sguil using the default credentials:
Username: sguil
Password: password

Next, create some alerts by opening a browser and going to:
http://www.testmyids.com

Finally, go into the Sguil console and you should see two new alerts:


This demonstrates that SnortSP is capturing packets, analyzing them with the Snort 2.8.2 Detection Engine, and outputting in unified2 format, which is then read by Barnyard2 and inserted into the Sguil database.

When finished, return to your SnortSP window and press ctrl-c to terminate the SnortSP process. Then type "nsm --all --stop" to terminate all NSMnow processes.

Installing Snort 3.0 (SnortSP) Beta 3 on Ubuntu 8.04 in 3 Steps

Snort 3.0 Beta 3 was released on April 1. You can read an overview of the changes in Snort 3.0 Beta 3 in the mailing list announcement. For more details on the underlying architectural changes in Beta 3, see Marty Roesch's blog. Thanks to Marty and the rest of the Snort 3 Development Team for their hard work in this release!

Installing Snort 3.0 Beta 3 on Ubuntu 8.04 is almost identical to installing Snort 3.0 Beta 2 on Ubuntu 8.04. However, I did have an issue with the Snort 2.8 Detection Engine not compiling correctly. This turned out to be libtool not liking the fact that /bin/sh was symlinked to /bin/dash instead of /bin/bash. The one-line fix was:

rm /bin/sh && ln -s /bin/bash /bin/sh

(Special thanks to Russ Combs of the SnortSP development team for his assistance with this issue.)

Here's the complete install recipe that worked for me:

Step 1: Get root privileges

##########################
sudo -i
##########################

Step 2: Install dependencies

##########################
aptitude update
aptitude -y install build-essential \
libdumbnet1 libdumbnet-dev \
uuid uuid-dev \
libncurses5 libncurses5-dev \
libreadline5 libreadline5-dev \
libpcap0.8 libpcap0.8-dev \
libpcre3 libpcre3-dev \
liblua5.1-0 liblua5.1-0-dev \
flex bison
##########################

Step 3: Download, compile, and install Snort 3.0 Beta 3

##########################
rm /bin/sh && ln -s /bin/bash /bin/sh
cd /usr/local/src/
wget http://dl.snort.org/snortsp/\
snortsp-3.0.0b3.tar.gz
tar zxvf snortsp-3.0.0b3.tar.gz
cd snortsp-3.0.0b3/
./configure
make
make install
mkdir /etc/snortsp/
cp etc/* /etc/snortsp/
cd src/analysis/snort/
./configure \
--with-platform-includes=/usr/local/include \
--with-platform-libraries=/usr/local/lib
make
make install
ldconfig
##########################

Creating md5 and sha1 hashes using dcfldd

Have you ever been in a situation where you needed to calculate multiple hashes (md5 and sha1, for example) of a large drive image, but you didn't want to wait the long time it would take to do the following?

md5 image.dd
sha1 image.dd

dcfldd can calculate multiple hashes at the same time. All you have to do is set dcfldd's output to /dev/null like this:

dcfldd if=image.dd of=/dev/null hash=md5,sha1
512 blocks (16Mb) written.Total (md5): 95581c2eb1d0e18d4c9d0a08f06e1b28
Total (sha1): f80c5845df633e5ed586cf5006a746cc648abd9a

572+1 records in
572+1 records out

Upgrading from Fedora 9 to Fedora 10 using Preupgrade

A few months ago, I upgraded from Fedora 8 to Fedora 9 using Preupgrade. Last night, I decided it was time to upgrade to Fedora 10 (F10), so I went the Preupgrade route again.

I did a yum update and then launched preupgrade. It downloaded all the necessary F10 RPMs and said it was ready for reboot. I rebooted into the installer and was greeted with an error message saying it couldn't find the RPM repository. I surmised that the installer hadn't mounted my /var partition (Preupgrade creates a local RPM repository at /var/cache/yum/preupgrade/). I did some searching and found Bugzilla bug 473782, which describes this exact problem. The fix was to reboot back into Fedora 9 and install Preupgrade 1.0.1-1 from the testing repository with the following command:

yum --enablerepo=updates-testing-newkey update preupgrade

I then launched Preupgrade again, rebooted into the installer, and successfully upgraded from Fedora 9 to Fedora 10. I rebooted into Fedora 10 and did a full yum update. I then noticed that I couldn't SSH into this Fedora 10 machine using SSH keys anymore. I did some more searching and found Bugzilla bug 473014. It seems that the upgrade process changes the SELinux security context on the user .ssh directories. The fix is to run the following command as root:

restorecon -r /home/*/.ssh

Haven't seen any other problems so far.

Upgrading from Fedora 8 to Fedora 9 using Preupgrade

In the past, I've upgraded to the latest Fedora version by using the unsupported "yum upgrade". This is potentially dangerous, but it always worked for me. When I read in Red Hat Magazine that Fedora had a new tool to do in-place upgrades, I was excited to try it out.

I tried out Preupgrade on a few Fedora 8 virtual machines and everything went smoothly. Preupgrade had earned my confidence, so I proceeded to "yum -y update && yum -y install preupgrade && preupgrade" on my main Fedora 8 desktop. It downloaded all the RPMs and rebooted into the installer. It upgraded the system and said it was ready for the final reboot. So I rebooted the machine and was greeted by a blinking GRUB prompt. Somehow, GRUB had lost its configuration and could no longer boot my Fedora installation. Doh!

I've never really played around in the GRUB shell, so I never realized how powerful and versatile it is. All I had to do was the following (the {tab} indicates to use the Tab key for filename completion):

kernel (hd0,2)/vmlinuz{tab} root=/dev/sda5
initrd (hd0,2)/initrd{tab}
boot

The system came up and I then did the following to re-write GRUB into the MBR:

grub-install /dev/sda

And we have a working Fedora 9 installation!

Building Ubuntu LiveCDs with Reconstructor

As I mentioned previously, I'm currently working on the Security Onion LiveCD. I started building custom LiveCDs years ago by going through the painstakingly manual process of remastering Knoppix. Last year, I began using the Fedora Revisor tool which didn't require as much manual work, but it is limited in that it seems to require that software is installed using RPMs and configuration is done via kickstart file as the ISO is being generated. Earlier this year, I produced a custom BackTrack CD for the Greater Augusta ISSA using Gene Bransfield Jr.'s guide and the Linux Live scripts. For the Security Onion LiveCD, I decided to try a new approach. This is my first time using Reconstructor and it provides a good balance of automation while still allowing you to easily customize at any time.

The process hasn't been totally painless, however (I should mention that I'm using Reconstructor 2.8.1.):

• I ran into a squashfs bug, which required updating squashfs-tools to a newer version than is currently available in Ubuntu's repositories.
  
• In the main Customization interface, there is an Apply button above the Next button. When I first starting using Reconstructor, I assumed that when you click Next, your settings are automatically applied, but that is not the case. You must click Apply or else your settings will be lost.
  
• If you select a custom Gnome background color, Reconstructor seems to increment it each time it is launched. For example, I configured my background color to be #486ac1. The next time I opened Reconstructor, it showed the value as #486ac2. The next time I opened Reconstructor, it was #486ac3, and so on.
  
• As with any LiveCD, there is always the issue of space--one has to balance having every remotely-useful tool available with the size limitation of a 700MB CD. Reconstructor helps somewhat in that it estimates the ISO size before generation, but this estimation isn't always accurate. You still may have to fully generate the ISO before you know for sure that it is under 700MB.

Overall, Reconstructor is a very good tool. If you can work through the minor issues detailed above, it is the easiest way to build a fully customized LiveCD. I look forward to the upcoming Reconstructor 3.

Security Onion LiveCD

As part of my GCIA Gold research paper, I'm building a security LiveCD based on Ubuntu 8.04. The Security Onion LiveCD includes both Snort 2.8 and the new SnortSP. This gives Snort users a way of trying out SnortSP without having to worry about satisfying all the dependencies and compiling and installing it. The LiveCD also contains the following network/security utilities.

bastille
cheops-ng
corkscrew
daemonlogger
doscan
dsniff
etherape
fragroute
fragrouter
honeyd
hping2
hping3
hunt
idswakeup
iperf
ipgrab
iptraf
knocker
labrea
lanmap
ndiff
nemesis
netcat
netcat6
netcat-openbsd
netcat-traditional
netdiscover
netdude
netrw
netsed
ngrep
nmap
nsm-console
nwatch
p0f
pads
paketto
pbnj
pcaputils
pnscan
potion
psad
python-scapy
scanssh
scapy
sendip
socat
ssldump
tcpflow
tcpick
tcpreplay
tcpslice
tcpspy
tcpstat
tcptrace
tcpxtract
tshark
wireshark
xprobe
yersinia
zenmap

What other utilities would you like to see in the Security Onion LiveCD?