securityonion-setup - 20120912-0ubuntu0securityonion222 resolves several issues

Wes Lambert submitted some Pull Requests for Setup.  Thanks, Wes!

I've packaged Wes's changes and securityonion-setup - 20120912-0ubuntu0securityonion222 should resolve the following issues:

Issue 925: Setup: ask user for MTU of sniffing interface(s) and allow VLAN tags
https://github.com/Security-Onion-Solutions/security-onion/issues/925

Issue 926: Setup: ask user for HOME_NET
https://github.com/Security-Onion-Solutions/security-onion/issues/926

Issue 948: Setup: configure email
https://github.com/Security-Onion-Solutions/security-onion/issues/948

Issue 949: Setup: change http links to https
https://github.com/Security-Onion-Solutions/security-onion/issues/949

Issue 953: Setup: change "Emerging Threats GPL" to "Emerging Threats Open"
https://github.com/Security-Onion-Solutions/security-onion/issues/953

Issue 955: Setup: Nonstandard interface names not being detected
https://github.com/Security-Onion-Solutions/security-onion/issues/955

Issue 304: Setup: support unique interface names
https://github.com/Security-Onion-Solutions/security-onion/issues/304

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Training
Need training?  Please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Security Onion 20120511 now available!

Security Onion 20120511 is now available!  This resolves the following issues:

Issue 205:      Bro's http.log needs to be per-interface
http://code.google.com/p/security-onion/issues/detail?id=205

Issue 264:      NSM package is missing the bro cron job
http://code.google.com/p/security-onion/issues/detail?id=264

Issue 265:      Upgrade httpry_agent to http_agent to support Bro logs
http://code.google.com/p/security-onion/issues/detail?id=265

Issue 266:      Remove httpry from NSM scripts
http://code.google.com/p/security-onion/issues/detail?id=266

In summary, this update migrates from the combination of httpry/httpry_agent to Bro/http_agent.  As noted in http://securityonion.blogspot.com/2012/02/security-onion-20120224-now-available.html, this means that networks with VLAN tags will now get HTTP logs in Sguil.

New Users
New users can download and install the 20120125 ISO image using the instructions here. The step marked "Install Security Onion updates" will automatically install this update.

In-place Upgrade
Existing Security Onion users can perform an in-place upgrade using the following command (if you're behind a proxy, remember to set your proxy variables as described in the Proxy page of our FAQ):

sudo -i "curl -L http://sourceforge.net/projects/security-onion/files/security-onion-upgrade.sh > ~/security-onion-upgrade.sh && bash ~/security-onion-upgrade.sh"

Screenshots

Upgrade Process

Feedback
If you have any questions, please join our mailing list and ask away!
http://groups.google.com/group/security-onion

Thanks
Thanks to Paul Halliday for adding Bro http.log support to http_agent!
Thanks to Seth Hall for the security-onion.bro script for splitting Bro's http.log when necessary!
Thanks to the following for their help in testing this release!
Scott Runnels
Tom De Vries
David Zawdie

Help Wanted!
Security Onion needs you!  Please see the new Team Members page on the wiki!

Want to learn more about Intrusion Detection?
Doug Burks will be teaching SANS 503 Intrusion Detection In-Depth in Augusta, GA in June!  For more information, please see:
http://securityonion.blogspot.com/2012/03/sans-is-coming-to-augusta-ga-in-june.html

Security Onion 20120329 now available!

Security Onion 20120329 is now available!  This resolves the following issues:

Issue 114: Provide single location for configuring BPF filters
Issue 224: typo in nsm_sensor-ps-start
Issue 242: Set Suricata runmode to autofp
Issue 243: Remove VLAN setting from pcap_agent.conf


Notes
As you can see in the screenshot below, this update will create a bpf.conf file for each sensor interface on your system.  For example, if you have two sensor interfaces (eth0 and eth1), you'll now have two bpf.conf files:
/etc/nsm/$HOSTNAME-eth0/bpf.conf
/etc/nsm/$HOSTNAME-eth1/bpf.conf

The NSM scripts now pass the "-F /etc/nsm/$HOSTNAME-$INTERFACE/bpf.conf" to Snort and Suricata and "-f /etc/nsm/$HOSTNAME-$INTERFACE/bpf.conf" to daemonlogger.  However, Suricata's afpacket mode currently doesn't support bpf.  I've created Suricata feature request #440 for this.

New Users
New users can download and install the 20120125 ISO image using the instructions here. The step marked "Install Security Onion updates" will automatically install this update.

In-place Upgrade
Existing Security Onion users can perform an in-place upgrade using the following command (if you're behind a proxy, remember to set your proxy variables as described in the FAQ):

sudo -i "curl -L http://sourceforge.net/projects/security-onion/files/security-onion-upgrade.sh > ~/security-onion-upgrade.sh && bash ~/security-onion-upgrade.sh"

Screenshots

Upgrade Process

Feedback
If you have any questions, please join our mailing list and ask away!
http://groups.google.com/group/security-onion

Thanks!
Thanks to the following for their help in testing this release!
Craig Shannon
Scott Runnels

Help Wanted!
Security Onion needs you!  Please see the new Team Members page on the wiki!

Want to learn more about Intrusion Detection?
Doug Burks will be teaching SANS 503 Intrusion Detection In-Depth in Augusta, GA in June!  For more information, please see:
http://securityonion.blogspot.com/2012/03/sans-is-coming-to-augusta-ga-in-june.html

Security Onion 20120224 now available!

Problem #1

Suppose you're monitoring traffic that has VLAN tags (in both directions).  By default, when you right-click the Alert ID in Sguil and request the transcript/pcap, you would get nothing.  In order to get transcripts/pcaps to work correctly in Sguil, you would have to manually set VLAN to "1" in pcap_agent.conf.

Problem #2
Suppose you're monitoring traffic that has VLAN tags in one direction but not the other.  When you right-click the Alert ID in Sguil and request the transcript/pcap, you would only get the non-VLAN side of the flow.  If you set VLAN to "1" in pcap_agent.conf, you would then receive just the VLAN side of the flow.

Solution

Security Onion 20120224 is now available!  This resolves the following issues:
Issue 148: Update tcpflow
Issue 222: Modify pcap_agent.tcl to support ip & vlan tagged interfaces

The updated pcap_agent.tcl and tcpflow allow Sguil to transparently support all cases of traffic with VLAN tags, without VLAN tags, and with mixed VLAN tags.  When you right-click the Alert ID and request the transcript/pcap, you should now get the entire flow.

Caveat
httpry doesn't support VLAN tags, so you still won't see HTTP events in Sguil where VLAN tags are involved.  However, we'll soon be removing httpry in favor of Bro's HTTP logging, which does handle VLAN tags properly.  In the meantime, you can query the Bro logs directly from the command-line using something like the following:

zgrep "192.168.123.234" /nsm/bro/logs/*/http*

New Users
New users can download and install the 20120125 ISO image using the instructions here. The step marked "Install Security Onion updates" will automatically install this update.

In-place Upgrade
Existing Security Onion users can perform an in-place upgrade using the following command (if you're behind a proxy, remember to set your proxy variables as described in the FAQ):

sudo -i "curl -L http://sourceforge.net/projects/security-onion/files/security-onion-upgrade.sh > ~/security-onion-upgrade.sh && bash ~/security-onion-upgrade.sh"

Note
If you had manually set VLAN to "1" in pcap_agent.conf, then you should set it back to the default of 0 and restart pcap_agent:

sudo nsm_sensor_ps-restart --only-pcap-agent

Screenshots

Upgrade Process

Feedback
If you have any questions, please join our mailing list and ask away!
http://groups.google.com/group/security-onion

Thanks
Thanks to Bamm Visscher for the updated pcap_agent.tcl!
Thanks to Simson Garfinkel for the updated tcpflow!
Thanks to Liam Randall, Scott Runnels, and Eric Ooi for testing this release!