Repository files navigation
Download Linux dependencies
Recommend Ubuntu-based, raspbian is good
sudo apt-get install build-essential python-dev libmysqlclient-dev python-virtualenv python-pip
If some don’t resolve, install what Linux tells you to
Git clone https://github.com/blaverick62/SIREN.git
Change remote to your repository if using it for dev Setup VENV and install pip requirements
cd SIREN
. ./VENV/bin/activate
pip install -r requirements.txt
If some pip dependencies don’t install, install what python tells you
sudo apt-get install libkrb5-dev
pip install python-gssapi
pip install paramiko
sudo ./sirenstart.sh
sudo apt-get install flex bison build-essential checkinstall libpcap-dev libnet1-dev libpcre3-dev libmysqlclient15-dev libnetfilter-queue-dev iptables-dev libdumbnet-dev autoconf libtool libdaq-dev
snort setup: sudo apt-get install snort
set up home net and interface
add file siren.rules to /etc/snort/rules
add line alert tcp $HOME_NET any -> any any (msg:"Target file accessed!"; content:"malarkey"; sid:1000037;)
add line include $RULE_PATH/siren.rules to snort.conf near line 550 with other includes
On SIREN_DB ubuntu server VM
sudo apt-get install mysql-server
mysql -u root -p
Enter root password
create user ‘sirenlocal’@’localhost’ identified by ‘sirenproj’;
grant all privileges on . to ‘sirenlocal’@’localhost’;
quit
mysql -u sirenlocal -p
sirenproj
create schema siren_db;
use siren_db;
quit
cd /usr/src
sudo git clone github.com/firnsy/barnyard2 barnyard_src cd barnyard_src
cd barnyard_src
sudo autoreconf -fvi -I ./m4
sudo ln -s /usr/include/dumbnet.h /usr/include/dnet.h
sudo ldconfig
cd /usr/src/barnyard_src
./configure --with-mysql --with-mysql-libraries=/usr/lib/YOUR-ARCH-HERE-linux-gnu
make
sudo make install
sudo cp etc/barnyard2.conf /etc/snort
sudo mkdir /var/log/barnyard2
sudo chown snort.snort /var/log/barnyard2
sudo touch /var/log/snort/barnyard2.bookmark
sudo chown snort.snort /var/log/snort/barnyard2.bookmark
scp /usr/src/barnyard_src/schemas/create_mysql to siren_db box
Change output format line for unified2 in /etc/snort.conf from snort.log to merged.log and remove nostamp option
mysql -u sirenlocal -p
enter password
create schema snort
quit
mysql -u sirenlocal -p snort </home/"username"/create_mysql
find sid-msg.map online, download and copy into /etc/snort
start snort with: sudo snort -q -c /etc/snort/snort.conf -i ens33
start barnyard2 with: sudo barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f merged.log -w /var/log/snort/barnyard2.bookmark
On SIREN_DB ubuntu server VM
sudo apt-get install apache2
sudo service apache2 restart
sudo apt-get install php libapache2-mod-php
sudo nano /etc/apache2/apache2.conf
uncomment <directory /srv/> block
change /srv/ to path to /siren/Website/myapp/public
sudo nano /etc/apache2/sites-available/000-default.conf
About
Semi-Intelligent HoneyPot Network - Semi-Intelligent Reactive Environment Network
Resources
Stars
Watchers
Forks
You can’t perform that action at this time.