Security Onion Success Stories

I received a couple of Security Onion Success Stories recently.  I appreciate Brett S. and Gene A. taking the time to say thanks.   It's a great source of encouragement and motivation for me to continue with the project.  If you would like to share your Security Onion Success Story, please post it in the Comments section.  Thanks!

Doug,

I wanted to thank you for providing Security Onion and maintaining it
so diligently.  I was a faculty advisor for the U.S. Coast Guard's
Cyber Defense Exercise this year.  Every year, the service academies
set up their networks and have NSA's red team try to bring down
servers and steal information.  For Coast Guard, the team is recruited
from the members of the only Networks course.

It was my first year with the cadets, and I had realized early that
the team had no IDS experience, and was thoroughly swamped just trying
to get the network up and running.  Security Onion to the rescue --
requiring just a few of the less experienced members with some
guidance, we were able to watch the more obvious attacks from outside
the firewall as well as the false positives from the exercise scoring
software.  It really was educational for the group -- rather than just
wondering what hit us, there was ample information in near real time
to figure out what was happening.   Knowing how to respond is another
story, of course.

 In the end, Coast Guard placed 3rd, which is pretty good given the
size and amount of resources available compared to Air Force and
Army.  Some of the team have expressed interest in getting more
involved with configuration and fine-tuning Snort next year, because
they had first-hand experience with how it behaved under basic
defaults.

Thanks again for providing such a useful tool -- it significantly
enhanced the educational impact of the exercise.

Brett S.

Doug, Brett, It wasn't just the USCG that was using Security Onion during the CDX.  We here at the Naval Postgraduate School also used Security Onion as a quick and easy IDS solution.  Of all the tools we employed during the exercise Security Onion was by far the easiest to get up and running and provided us with a great insight into the attacks used during the exercise. 
 Great job, Doug!  Keep up the good work.
Sincerely, 

Gene A. 

Security Onion featured in ISSA Journal

I always look forward to Russ McRee's Toolsmith column in the ISSA Journal.  This month's Toolsmith column features Security Onion!  Russ, thanks for the article and your kind words!

Security Onion 20110321: Distributed Sguil Sensors

Security Onion 20110321 is now available!  This new version includes an updated Setup script that allows you to easily create a Sguil server and then create multiple Sguil sensors that report back to the Sguil server.

How do I get it?
New users can download the latest ISO image from here.  Existing Security Onion users can perform an in-place upgrade to version 20110321 using the following commands:

wget http://downloads.sourceforge.net/project/security-onion/security-onion-upgrade.sh
sudo bash security-onion-upgrade.sh 

Existing users, please note that running Setup on a previously configured system will remove any existing configuration.

How do I create a Sguil server?
You have three options:
1.  Launch Setup and choose "Quick Setup".  This will install a Sguil server AND create a Sguil sensor for each ethernet interface on the server.
2.  Launch Setup, choose "Advanced Setup", and choose "Both".  This will install a Sguil server AND create a Sguil sensor for each ethernet interface on the server, but will give you more options than "Quick Setup".
3.  Launch Setup, choose "Advanced Setup", and choose "Server".  This will just install a Sguil server.

How do I create a Sguil sensor?
Launch Setup, choose "Advanced Setup", and choose "Sensor".  Enter the name/address of the Sguil server and a username that has sudo permissions on the server.  A terminal window will appear prompting you to login to the server to complete the server configuration.

Demo
Download the latest ISO image from here.
Boot the Security Onion ISO and choose Install from the boot menu.
Standard Ubuntu installer appears.  Follow the prompts to complete your installation.
Reboot into your new Security Onion installation and login using the username/password you specified in the previous step.
Double-click the Setup desktop shortcut.
Administrative password prompt appears.  Enter your password and click OK.

Welcome screen appears.  Press Enter.

Quick Setup screen appears.  Press Enter.

Username screen appears.  Enter your desired Sguil username and press Enter.

Password screen appears.  Enter your desired Sguil password and press Enter.

Password confirmation screen appears.  Confirm your desired Sguil password and press Enter.

Settings confirmation screen appears.  Press Enter.

Setup creates the Sguil server and sensors and then starts all services.

Setup Complete screen appears.  Press Enter.

Double-click the Sguil desktop shortcut.  Login window appears.  Enter the Sguil username/password you specified in Setup.

Sensors window appears.  Click "Select All" and then click "Start Sguil".

Sguil main window appears.  Simulate an attack by going to a terminal and typing "curl http://testmyids.com".

A new alert should appear in the Sguil window.  Notice that the sensor is named server-eth0, where "server" is the hostname and "eth0" is the interface that saw the traffic.

We've now verified that the Sguil server is running correctly.  Let's go to our second machine and build a sensor.

Boot the Security Onion ISO and choose Install from the boot menu.

Standard Ubuntu installer appears.  Follow the prompts to complete your installation.

Reboot into your new Security Onion installation and login using the username/password you specified in the previous step.

Double-click the Setup desktop shortcut.

Administrative password prompt appears.  Enter your password and click OK.

Welcome screen appears.  Press Enter.

Quick Setup screen appears.  Click "No, use Advanced Setup".

Components screen appears.  Click "Sensor" and click "OK".

Server Hostname screen appears.  Enter server hostname/address and press Enter.

SSH Username screen appears.  Enter username on server and press Enter.

IDS Engine screen appears.  Press Enter.

Interfaces screen appears.  Select your desired interface(s) and click OK.

Confirm Settings screen appears.  Click "Yes, proceed with the changes!".

Terminal appears prompting to accept SSH key of server.  Type "yes" and press Enter.

Password prompt appears.  Enter password and press Enter.

Sudo prompt appears.  Enter password and press Enter.

Setup creates the Sguil sensor(s).

 Setup starts all Sguil services.

Setup Complete screen appears.  Press Enter.

Simulate an attack by opening a terminal and typing "curl http://testmyids.com".  

At this point, we can return to our server.  In the Sguil window, click File and then click "Change monitored networks".

Sensor selection window appears.  Notice that there are new sensors named sensor-eth0, sensor-eth1, sensor-eth2, and sensor-ossec.  Select the new sensors and click "Start Sguil".

Click the "Agent Status" tab and verify that the the new sensors are checking in.

Notice that there is a new alert with a sensor name of sensor-eth0, where "sensor" is the hostname of the sensor and "eth0" is the interface which saw the traffic.

In this blog post, we've demonstrated how Security Onion can build an army of distributed Sguil sensors in just a few minutes.

Security Onion 20110222 Resolves 2 Issues

I've uploaded a new security-onion-upgrade.sh script which resolves a couple of issues:

http://code.google.com/p/security-onion/issues/detail?id=80
http://code.google.com/p/security-onion/issues/detail?id=87

To download and run the upgrade script, open a terminal and execute the following:

wget http://downloads.sourceforge.net/project/security-onion/security-onion-upgrade.sh
sudo bash security-onion-upgrade.sh 

Security Onion 20110122 fixes DNS error in Sguil

I received Issue 77 in the Security Onion Issue Tracker.  The Issue describes an error when enabling Reverse DNS queries in Sguil.  I was able to duplicate the issue.

I consulted with Bamm Visscher and he said this was due to Ubuntu's libudp-tcl package.  I removed libudp-tcl and Reverse DNS queries started working again.

I've released a new upgrade script that fixes this issue automatically.  Just download security-onion-upgrade.sh from http://sourceforge.net/projects/security-onion/files/ and run it like so:
sudo bash security-onion-upgrade.sh

It will then upgrade your Security Onion installation to version 20110122 and Reverse DNS queries should start working correctly.

Introduction to Sguil and Squert: Part 4

This post is the fourth in a multi-part series designed to introduce Sguil and Squert to beginners.

I'm assuming you've already been through the steps in the previous posts in this series:
Introduction to Sguil and Squert: Part 1
Introduction to Sguil and Squert: Part 2
Introduction to Sguil and Squert: Part 3

In Part 3, we saw Sguil's killer feature of being able to pull session transcripts from the full packet captures to show an entire attack from beginning to end.  In Part 4, we're going to see one of Squert's killer features: alert visualization.


Using the alerts from yesterday's demo, we display them in Squert.

Right above the alerts, we click "create" and are then prompted for some options.  We give it a name and keep the other options at their default settings.

We then click the "create" button and then a graph is generated of the alert data.

We can then click on the graph to open a larger version and see more detail.

Security Onion nsm_all_del script

This blog post will demonstrate the nsm_all_del script.  If you ran through Setup and configured your sensors but decide that you need to re-run Setup for some reason (perhaps you want to choose Advanced Setup to choose specific interfaces), then you need to run nsm_all_del first.  nsm_all_del will delete your current sensor configuration in preparation for running Setup again.

Suppose I ran through Setup using Quick Setup which enumerated my ethernet interfaces and created Sguil sensors for eth0, eth1, and eth2.

Now suppose I want eth0 to be just a management interface with no Sguil sensor.  I need to run Setup again and choose Advanced Setup to exclude eth0, but first I need to run nsm_all_del to delete the current Sguil configuration.

Once clicked, nsm_all_del displays a warning.

It then begins deleting sensors, asking for confirmation along the way.

Once nsm_all_del completes, I then run Setup again and choose Advanced Setup so that I can choose which network interfaces should have Sguil sensors.

Once Setup completes, I login to Sguil and see that I only have Sguil sensors for eth1 and eth2.

Security Onion Upgrade Script

This is a quick blog post to demonstrate the Security Onion Upgrade Script.  If you're running Security Onion 20110101 or newer, you can download and run the Security Onion Upgrade script to do an in-place upgrade.  In the screenshot below, you can see that I started with Security Onion 20110116 and then ran the following commands:

wget http://downloads.sourceforge.net/project/security-onion/security-onion-upgrade.sh

sudo bash security-onion-upgrade.sh

The upgrade script then upgraded the system to 20110117 and then to 20110118.

Introduction to Sguil and Squert: Part 3

This post is the third in a multi-part series designed to introduce Sguil and Squert to beginners.


I'm assuming you've already been through the steps in Introduction to Sguil and Squert: Part 1 and Introduction to Sguil and Squert: Part 2.


In Parts 1 and 2, we compared Sguil and Squert and showed how you can accomplish the same thing in both.  In Part 3, we're going to contrast them and see why we need both.


Let's start with Sguil.  Sguil's killer feature is the ability to take an alert and pull a full session transcript.  By doing this, we not only see the traffic that triggered the alert, but also the traffic in the session that occurred before and after the alert.  


Time for an example.  Download "Scan of the Month 19" from the Honeynet Project:
wget http://old.honeynet.org/scans/scan19/scan19.tar.gz


Expand the tarball:
tar zxvf scan19.tar.gz


If you haven't already, log into Sguil so that you'll be able to see the alerts as they populate.  Now use tcpreplay to replay newdat3.log onto your eth0 interface (you may need/want to use a different interface, just make sure it's one that's being monitored by Sguil):
sudo tcpreplay -i eth0 -t newdat3.log


As soon as you hit Enter, switch over to your Sguil console so that you can see the alerts.  You should see something like this:

Go to either of the "GPL FTP SITE ..." events, right-click the Alert ID, and click Transcript.  A new window will appear like this:

It may take a few seconds to pull the entire transcript.  Once it does, you'll be able to scroll down and see the entire FTP attack, from the buffer overflow to the attacker catting the passwd file:

Can your commercial IDS do that?  Come back tomorrow to see one of the killer features that Squert has.