Friday, December 2, 2016

Send SYSLOG to remote servers through Snort being hosted on Kali

root@LinuxTest:~# snort -V

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.7.0 GRE (Build 149)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
           Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using libpcap version 1.8.1
           Using PCRE version: 8.39 2016-06-14
           Using ZLIB version: 1.2.8


root@LinuxTest:~# cat /etc/rsyslog.conf|grep '*.*'|grep 514|grep -v '#'
*.*                             @192.168.0.1:514

root@LinuxTest:~# cat /etc/snort/snort_syslog.conf|grep syslog|grep -v '#'
output alert_syslog: host=192.168.0.1:514, LOG_LOCAL1 LOG_ALERT

root@LinuxTest:~# ps -aef|grep snort
root      8709     1  0 01:59 ?        00:00:02 /usr/sbin/snort -c /etc/snort/snort_syslog.conf -i eth0 -A full -D -s

P.S.: In this case, 192.168.0.1 is the remote syslogd server. Moreover, after everything above is set, rebooting the system is a must. Otherwise, the rsyslogd may not function properly.

No comments:

Post a Comment