PulledPork
・Perl モジュール
[root]# cpan LWP::UserAgent::Determined Net::SSLeay
LWP::Protocol::https Sys::Syslog Archive::Tar
・インストール
[root]# mkdir -p /usr/local/pulledpork/etc
[root]# git clone https://github.com/shirkdog/pulledpork.git
[root]# cp -v pulledpork/pulledpork.pl /usr/local/pulledpork/
[root]# cp -v pulledpork/etc/* /usr/local/pulledpork/etc/
[root]# chown -R snort:snort /usr/local/pulledpork/
[root]# chmod 755 /usr/local/pulledpork/pulledpork.pl
・設定
[root]# vim /usr/local/pulledpork/etc/pulledpork.conf
rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|<OINKCODE>
ignore=snort3-deleted.rules,snort3-experimental.rules
rule_path=/usr/local/snort/rules/snort.rules
local_rules=/usr/local/snort/rules/local.rules
sid_msg=/usr/local/snort/etc/snort/sid-msg.map
snort_path=/usr/local/snort/bin/snort
config_path=/usr/local/snort/etc/snort/snort.lua
distro=Centos-8
block_list=/usr/local/snort/intel/ip-blocklist
IPRVersion=/usr/local/snort/intel/
pid_path=/var/log/snort/snort.pid
#snort_version=3.1.0.0
snort_version=3.1.9.0
# PulledPork がルールを処理する方法
# enablesid.conf(全てのルールを有効)disablesid.conf(特定のルールを無効)
enablesid=/usr/local/pulledpork/etc/enablesid.conf
dropsid=/usr/local/pulledpork/etc/dropsid.conf
disablesid=/usr/local/pulledpork/etc/disablesid.conf
modifysid=/usr/local/pulledpork/etc/modifysid.conf
・PulledPork を実行し、ルールファイルを更新
[root]# perl /usr/local/pulledpork/pulledpork.pl
-c /usr/local/pulledpork/etc/pulledpork.conf
-PE -v -I security -T -H SIGHUP
・cron でなく、systemd タイマーで PulledPork を定期実行
[root]# vim /etc/systemd/system/pulledpork.service
[Unit]
Description=PulledPork service for updating Snort 3 rules
Wants=pulledpork.timer
[Service]
Type=oneshot
RemainAfterExit = yes # Type=oneshot 終了後もサービスをアクティブとみなす
ProtectSystem = true # /usr, /boot 読み取りのみ
ProtectHome = true # /home, /root, /run/user アクセスできない
ReadWritePaths = /usr/local/snort /usr/local/pulledpork # 指定ディレクトリ読み書き許可
ExecStart=perl /usr/local/pulledpork/pulledpork.pl -c
/usr/local/pulledpork/etc/pulledpork.conf -PE -v -I security -T -H SIGHUP
[Install]
WantedBy=multi-user.target
[root]# vim /etc/systemd/system/pulledpork.timer
[Unit]
Description=PulledPork service timer for updating Snort 3 rules
Requires=pulledpork.service
[Timer]
Unit=pulledpork.service
OnCalendar=*-*-* 00:15:00
AccuracySec=1us
[Install]
WantedBy=timers.target
[root]# systemctl daemon-reload
[root]# systemctl enable pulledpork.timer