Configuring Snort Decoder | HP UX Internet Express Software manual

./snort -vde(include the data link layer headers)

•Packet Logger Mode — log TCP/IP packet headers to disk

Use the previous snort commands along with the -lswitch and a log directory name to automatically go into packet logger mode.

./snort -vd -l ./log

You must have an existing directory by that name to prevent Snort from exiting with an error. You should also specify the local host address, using the -h ipaddress switch.

Other switches in packet logger mode include the following:

-b(log the packets in binary mode)

-r(followed by name of binary log will run the log through Snort in sniffer mode)

There are several ways in which you may configure the Snort output. See the Snort Users Manual for details.

Use the Internet Express Administration utility to perform the following actions with Snort:

•Configure the Snort Decoder (see Section : Configuring Snort Decoder)

•Configure the Snort Preprocessor (Section : Configuring Snort Preprocessor)

•Run Snort (see Section : Running Snort)

•View alert messages (Section : Viewing Alert Messages)

Configuring Snort Decoder

Follow these steps to configure the Snort decoder.

1.From the Manage Components menu, choose Snort.

2.From the Configure Snort menu, choose Configure Snort Decoder. The Configure Menu is displayed.

3.Click in a checkbox to select the desired decoder option:

Option

Disable Decode Alert

Disable Alerts on Invalid IP options Disable Alerts on obsolete TCP options

Description

Turns of the alerts generated by the decode phase of Snort.

Disables IP option validation alerts.

Turns off alerts generated by obsolete TCP options.

4.Click on Submit.

Configuring Snort Preprocessor

Follow these steps to configure the Snort preprocessor:

1.From the Manage Components menu, choose Snort.

2.From the Configure Snort menu, choose Configure Snort Preprocessor. The Configure Menu is displayed.

Snort Intrusion Detection System 185

Image 185

HP UX Internet Express Software manual Configuring Snort Decoder, Configuring Snort Preprocessor, Snort -vd -l ./log

Contents

Abstract Internet Express for Tru64 Unix VersionPage Contents User Authentication Mail Delivery Administration Mail Access Administration 132 Network Security Administration 167 Web Services Administration 155XML Component Administration 164 Ldap Directory Server Administration 195 Proxy Services Administration 190 Samba File and Print Server Administration 216 OpenSLP Administration 207FTP Server Administration 213 Internet Relay Chat Administration 248 InterNetNews Server Administration 225 Bind Domain Name Server Administration 260 PostgreSQL Database and MySQL Administration 249Jabber 265 Twiki 266 Document Organization About This DocumentIntended Audience Typographic Conventions CommandComputer output User input Reading Documentation Using the Public Web Server Reading Documentation Using the Administration UtilityRelated Information Reading the Documentation Reading Reference Pages for Internet Express Components Reading Documentation from the Internet Express CD-ROMOn a Tru64 Unix System On a PC Reading the Open Source Software Component Documentation Readers Comments# man -M /usr/news/man active.5 Internet electronic mail readerscomment@zk3.dec.com Readers Comments Using the Administration Utility Using the Administration Utility Administration Utility Menu Options and Tasks Using the Administration Utility Main Menu Navigating the Administration Utility Registering Your Internet Express InstallationUsing Administration Utility Forms Register Online Sample Administration Utility Form Internet Express Accounts and Ports Accessing Administration ServersPort Number Description 8081 Internet Express Managing Internet Express in a TruCluster Environment Accessing the Internet Express Login AccountAccessing and Managing the Internet Monitor TruCluster Impact on Internet Express Administration Installing and Removing ComponentsUsing Internet Express Services in a Cluster Keywords for URL Line Installing and Removing ComponentsHostname of the local host Port number from the current Web server Performing Web-Based System Management Accessing Web-Based System Management Tools Accessing Web-Based System Management Tools Tuning Kernel Attribute Values Using the Administration Utility Open Source Software Web Sites Where to Find More InformationInternet Express and AlphaServer Products Web Sites Firefox ExpectFreeRADIUS GnuPG Jabber IRC ServerLynx Web Browser Majordomo Automated Internet Mailing Lists Manager OpenLDAP MySQLOpenSLP Perl Procmail Mail Filtering Language PostgreSQL Relational Database Management SystemPure-FTP Server Samba File and Print Server System Security Web Sites Applications Other Useful Web SitesInterNIC Microsoft Encompass Manage Users Menu User Administration Overview of User Accounts User Administration Purging Obsolete Passwords Assigning Passwords to User AccountsSpecifying User Names Overview of User Accounts Searching for User Accounts Searching for User Accounts Selecting User Accounts Assigning Users to Groups Shows the Create Named User Account form Creating Captive Accounts for Named Users Creating a Named User Account Creating Captive Accounts for Generic Users Creating Generic User Accounts Creating a Noncaptive Account for a Unix System User Creating a Noncaptive Account for a Unix System User To create a group, see Section Creating Groups Creating a System User Account Creating Groups Creating Groups Displaying User Account Information Displaying User Account Information Deleting User Accounts Changing Groups for User Accounts Changing Groups for User Accounts User Administration Changing the Password for an Account Changing the Password for an Account Changing Mail Services for Users Changing Mail Services for Users Assigning Regular Delivery Mail ServiceAssigning POP with Password Mail Service Assigning Cyrus Imap with Password Mail Service Assigning the Cyrus Imap Mail Service Managing the iass Account Assigning Apop with Password Mail ServiceChanging the iass Account Forwarding Address Managing the .users.list File Listing User Accounts and Passwords Managing the User Self-Administration FeaturePurging Passwords for User Accounts Removing the .users.list File Managing the User Self-Administration Feature Enabling and Disabling the User Self-Administration Feature Manage User Self-Administration Menu Configure Web Server for Self-Administration Form Modifying the Web Server Configuration Modify Web Server Configuration Enabling and Disabling Login Delays Adding Groups Managing User Self-Administration Groups Adding Groups Deleting and Modifying Groups Enabling and Disabling Groups Customizing the User Self-Administration Feature User Administration Managing the Ldap Module for System Authentication User AuthenticationManaging the Ldap Module for System Authentication User Authentication Example 1 Security Matrix Enabled for Ldap Ldap Caching Daemon Example 2 Ldap Caching Daemon Configuration File Value of searchbase Value of machinedn Value of machinepass Creating Branches Userbranch ou=accounts,searchbase Extended Ldap Schema for Unix Account Information Indexing Attributes for the Directory Servers Ldap Database Index Types Configuring the Ldap Module for System AuthenticationAdding Indices for OpenLDAP Defining Ldap System Parameters Modifying the Ldap Module ConfigurationConfiguring the Ldap Module for System Authentication Configuring Ldap Password Attributes Configuring Ldap Group Attributes Enabling and Disabling the Ldap Module Testing the Ldap Module ConfigurationImporting and Exporting Users from /etc/passwd Importing Users from NIS Importing Users into the Directory ServerExporting Users from the Directory Server Adding an Ldap User in a C2 Environment Access Control Ldap Database Utilities Remove login names from all groups Remove login names from specified groupFile in which to store search results the default is Authentication mechanism Adding a User Entry Checking the Ldap Server ConfigurationExtracting Users from the /etc/passwd File Retrieving a User Entry Deleting a User Entry Ldapsyncuser -b branch filename Synchronizing with a Password FileAdding a Group Entry Deleting a Group Entry Maintaining Group Membership Retrieving a Group Entry Setting a Users Password in the Ldap Directory ServerStarting the ldapcd Daemon Ldapgetgroup -b branch -f input-file Stopping the ldapcd Daemon Maintaining the Ldap Directory Server Using Ldap CommandsAdding Entries to an Ldap Database Modifying Entries in an Ldap Database Files Modified by theLDAP Module for System Authentication Authentication Actions PerformedOverview of the Ldap Client Actions Performed by the Ldap Client Behavior of the the ldapdc Daemon Operation of login/suDebugging ldapdc Etc/ldapusers.allow # su user1 Sendmail Server Administration Mail Delivery AdministrationMail Delivery Administration Bogofilter to filter spam Section Bogofilter Spam Filter Configuring the System as a Mail Client Configuring the System as a Standalone Mail SystemConfiguring the System as a Mail Server Ldap see Section Configuring Ldap Creating and Deleting Host Aliases for a Mail Server Sendmail Server Administration Changing the Sendmail Server Configuration PSInet see Section Configuring the X.25 Protocol Configuring Mail ProtocolsThrough Section Configuring the X.25 Protocol Creating and Deleting Pseudo Domain Aliases Configuring the DECnet Phase IV Protocol Configuring the MTS Protocol Configuring the DECnet/OSI Protocol Configuring the X.25 Protocol Configuring the Uucp Protocol Accessing the Configure Masquerading Form Configuring Masquerading Root Postmaster News Uucp Mailer-daemon Rdist Nobody Daemon Pop Imap Configuring Your System for Masquerading Example 4 Sample Virtual Domain Table Configuring Virtual Domains # makemap btree virtusertable virtusertable Enabling Anti-Virus Enabling Procmail as a Local Mailer Configuring Relaying Configuring Anti-Spam Example 5 Sample Access Database for the Sendmail Server Configuring the Access Database Configuring an Access Database Configuring Checking on Senders Information Configuring Ldap Shows the Configure Ldap form Configuring Mail Filters Milter Socket inet1099@remotehost.com Socket local/var/run/f1.sockSocket inet61066@myhost.com Socket inet1066@myhost.com,T=C5mS10sR10sE5m Sample -p local/var/run/example1.sock Adding a Queue Configuring Queues Deleting a Queue Group # sendmail -bt -q queue-nameModifying a Queue Group General Queue Properties Configuring Queue PerformanceQueue Timers Sendmail Tunable Parameters Configuring Trusted Layer SecuritySendmail Timers Certificate Issuer One that issues certificates a CA Certificate DefaultsTLS Certificate Values Certicate Authority Abbreviation Certificate Authority Enabling Support Using the Access Database Marked as permanent VERIFYbits CIname Sendmail Server AdministrationFailure marked as temporary Side Relay or Subject Configuring Mailbox AccessControlling the Sendmail Server Majordomo Mailing List Administration Majordomo Mailing List AdministrationViewing the Sendmail Server Log Creating a Majordomo Mailing List Changing List Owner or Charter Changing a Majordomo Mailing List Configuration Changing Subscription Parameters Changing Administration Parameters Changing Message Content Parameters Changing Digest Parameters Changing Command Access Parameters Changing List Restriction Parameters Changing Moderated List Parameters Deleting a Majordomo List MailmanChanging Address Processing Parameters Mailman Create a Mailing List Creating the Initial Mailman List Using a ScriptDeleting a Mailing List Managing Mailman Mailman Mailing List Administration Menu Mailman Scripts Bogofilter Spam FilterMailman Log Files Training Bogofilter Filtering with Bogofilter Using Bogofilter with procmailFilter Integration with Other Tools Bogofilter/wordlist.db Mail Transport Agent MTA Integration with Bogofilter Mutt Integration with BogofilterPine Integration with Bogofilter Bogofilter Spam Filter POP Mail Server Administration Mail Access AdministrationControlling the POP3 Server Controlling the POP2 Server Viewing the POP Mail Server Log Imap Mail Server AdministrationImap Mail Server Administration Converting Imap Mail Folders Setting Up a Unix User Account for UW ImapSetting Up a Unix User Account for Cyrus Imap Controlling the UW Imap Server Controlling the Cyrus Imap ServerUsr/dt/bin/mailcv -evdt -I -f foldername directoryname user Usr/dt/bin/mailcv -I -t -f ./bar duke Viewing the Imap Server Log Configuring SSL for UW-IMAP IMP Webmail Administration IMP Webmail Administration Enabling and Disabling IMP Webmail Accessing the IMP Webmail Administration Menu Enable/Disable IMP Webmail Managing Mail Server Settings Adding a Mail Server IMP Mail Server SettingsModifying the Mail Server List IMP Mail Server List Settings Deleting a Mail Server Managing Mailbox SettingsModifying a Mail Server IMP Mailbox Settings Managing Compose Settings Preference settings Managing Message SettingsIMP Compose Settings IMP Message Settings Managing Logging Settings IMP Logging Settings Preference Driver Settings Managing Preference Driver Settings Managing Horde Settings Managing Miscellaneous IMP SettingsMiscellaneous IMP Settings Setting Description Allow usage of folders Horde Settings Managing Turba Settings IMP Turba Settings Using IMP Upgrade ToolsSetting Description Enabled Have access to their addressbook Upgrading IMP Databases Upgrading IMP Configurations IMP Database Upgrade Settings New Preference Table Accessing IMP WebmailAdditional Webmail Documentation Secure Web Server Administration Web Services AdministrationSecure Web Server Administration Internet Express Ports and URLs Accessing the Secure Web Servers Configuration Files for Secure Web Servers Changing Configuration ParametersWeb Server Management Server Httpd.conf Srm.conf Access.conf Changing the Password for the Administration Web Server Creating the Search Index Ht//Dig Search Tool AdministrationHt//Dig Search Tool Administration Ht//Dig Indexing and Search Administration Link to Ht//Dig Search Index Updated Ht//Dig Configuration File Message Http//hostname/htdig/search.html Searching the IndexDocumentation Directories and Subsets for XML Components XML Component AdministrationDirectories and Subsets for XML Components Apache Cocoon Servlet Administration Apache Axis Server AdministrationApache Axis Server Administration Managing the Apache Axis Server Viewing the Cocoon Log Files Managing the Apache Cocoon ServletEnabling and Disabling the Cocoon Servlet TCP Wrapper Administration Network Security AdministrationNetwork Services Wrapped by Internet Express Network Services Wrapped by Internet Express Modifying Access to a Wrapped Network Service Controlling Access to Other Network Services Network Service Access Options Testing TCP Security Modifications FireScreen Administration Menu FireScreen Administration FireScreen Administration Installing FireScreen Etc/rc.config file Checking FireScreen Installation Prerequisites FireScreen Administration Install FireScreen Page with Gateway Screening Enabled Configuring FireScreen Configure FireScreen Menu Setting Command-Line Options Set Options Confirmation Adding a Screening Rule Setting the Screening Mode Add New Screening Rule Form Deleting a Screening Rule Checking Syntax of Screening Rules Starting FireScreen Starting and Stopping FireScreen Stopping FireScreen Start/Stop FireScreen Form with Restart Option Enabled Viewing the FireScreen Log Viewing FireScreen StatusViewing FireScreen Screening Rules Usr/internet/docs/snort Snort documentation Snort Intrusion Detection SystemViewing FireScreen Statistics Configuring Snort Preprocessor Configuring Snort DecoderOption Disable Decode Alert Snort -vd -l ./log Viewing Alert Messages FreeRADIUS Server AdministrationRunning Snort Understanding FreeRADIUS Configuration Files Considerations While Installing FreeRADIUSStarting and Stopping the FreeRADIUS Server Users File Radiusd.conf file Configure --disable-shared make make installClients.conf file Viewing FreeRADIUS Log File Dante Socks Server Administration Proxy Services AdministrationProxy Services Administration Controlling the Dante Socks Server Configuring the Dante Socks Server Squid Proxy/Caching Server AdministrationAccessing Dante Socks Information Squid Proxy/Caching Server Administration Managing the Squid Proxy/Caching Server Configuring the Squid Proxy/Caching ServerReinitializing the Disk Cache Rotating Log Files Displaying Access Statistics Controlling the Squid Proxy/Caching Server Understanding the Ldap Directory Schema Ldap Directory Server AdministrationUnderstanding the Ldap Directory Schema Example 6 Ldap Standard Object Class Definition for Person Using the Ldap BrowserLdap Directory Server Administration Connecting to an Ldap Server Installing and Running the Ldap BrowserManaging Frequently Used Connections Creating or Editing Frequently Used Connections Connecting to an Ldap Server using SSL Reconnecting to an Ldap Server Using the Main Browsing WindowDisconnecting from an Ldap Server Opening a New Main Window Controlling Client-Side Schema CheckingClosing a Main Window Viewing a Directory Entry in a Separate Window Modifying a Directory Entry Adding a New Directory EntryDeleting a Directory Entry Copying a Directory Entry Moving a Directory Entry Renaming a Directory EntryAdding Attributes Modifying Attributes Managing Directory Entry Templates Deleting AttributesCreating Entry Templates Modifying Entry Templates Searching the Directory Viewing the Object Class SchemaViewing the Attribute Schema User Configuration File Managing and Using the OpenLDAP Directory ServerConfiguring the OpenLDAP Directory Server Managing the OpenLDAP Directory Server Ldap Directory Server Administration OpenSLP Overview OpenSLP AdministrationConfiguration Files and Examples Configuring Optional Security Configuring OpenSLPUsing the OpenSLP Configuration and Registration Files Configuring OpenSLP Running the Services Considerations for Using SLP APIs Running the Example Configuration Documentation Documentation OpenSLP Administration Administering Pure-FTP Server FTP Server AdministrationAdministering Pure-FTP Server Creating or Modifying an Anonymous Pure-FTP User Account FTP Server Administration Enabling or Disabling Anonymous Pure-FTP AccessEnabling or Disabling chroot Upload /data/ftp /pub yes ftp daemon Enabling or Disabling Pure-FTP server Displaying Active Pure-FTP Users Options for Modifying the smb.conf Configuration File Samba File and Print Server AdministrationUnderstanding the smb.conf Configuration File Samba File and Print Server Administration Workgroup Understanding the smb.conf Configuration File Add the following value Administering the Samba Server Using the Swat Program Administering the Samba Server Using the Swat ProgramConfiguring the Samba Server Using the Swat Program Samba File and Print Server Administration Configure the Samba Server Menu Manage passwords see Section Administering Passwords Configuring Global VariablesConfiguring Share Parameters Administering Passwords Viewing the Current ConfigurationControlling Printers Viewing the Status of the Server Samba File and Print Server Administration 225 InterNetNews Server Administration INN Daemons Specifying INN Configuration DataInterNetNews Server Administration Configuring an External Newsfeed Configuring an External Newsfeed Recommended Spool Space for News Articles Displaying an External NewsfeedArticle Retention Period Days 12 GB Adding an External Newsfeed Typically, a newsfeed has the following flags set Removing an External Newsfeed Modifying Newsfeed DefaultsModifying an External Newsfeed Updating the Local Active File Managing Client Access Access Groups Form Fields Displaying Client Access GroupsAdding a Client Access Group Removing a Client Access Group Modifying an Existing Client Access Group Managing Client Authentication Groups Displaying Client Authentication GroupsAdding Client Authentication Groups Client Authentication Groups Menu Fields Usr/bin/news/auth/passwd Modifying Client Authentication Groups Configuring Storage Method Entries Configuring Storage OptionsDeleting Client Authentication Groups Configuring Storage Options Modifying a Storage Method Class Options on the Configure Storage MenuAdding a New Storage Method Class Deleting a Storage Method Class Configuring the Cnfs Storage MethodDisplaying Cnfs Entries Adding New Cnfs Entries Modifying Cnfs Entries Displaying Article Expiration Definitions Managing Article ExpirationDeleting Cnfs Entries Managing Article Expiration Specific newsgroup for example, rec.photo Adding an Article Expiration Definition Managing Article Expiration Specifying an Article Expiration Definition Modifying an Article Expiration Definition Deleting an Article Expiration Definition Managing Local NewsgroupsModifying the Retention Period for Expired Articles Managing Local Newsgroups Deleting Local Newsgroups Viewing INN Log FilesCreating Local Newsgroups Controlling the INN Server Controlling the INN Server Configuring IRC Internet Relay Chat AdministrationInternet Relay Chat Administration Controlling the IRC Server Installing PostgreSQL PostgreSQL Database and MySQL AdministrationInstalling PostgreSQL Starting and Stopping PostgreSQL Server Viewing the PostgreSQL Log File PostgreSQL Database and MySQL Administration Important Files and Directories Administering PostgreSQL AccountsAdministering PostgreSQL Accounts Using Existing PostgreSQL Accounts Setting up a Crontab Entry for Vacuuming DatabasesRunning the Postmaster Startup Script PostgreSQL Files and Directories Setting up a Crontab Entry for Vacuuming Databases PostgreSQL Database and MySQL Administration Setup Vacuum Crontab Form #/sbin/init.d/postgres start Scaling PostgreSQL#/sbin/init.d/postgres stop Scaling PostgreSQL #/sbin/sysconfig -q ipc#ps -ef grep postmaster Directories and Files Established by MySQL Installation Administering MySQLStarting and Stopping MySQL MySQL Directories MySQL Configuration Files Starting and Stopping the MySQL Server Using a Command LineViewing the MySQL Error Log MySQL Log Files Bind Overview Bind Domain Name Server AdministrationImportant Bind Files and Directories Bind Files and Directories Bind Binary File Directories Enabling Bind Bind Documentation Running the Bind Startup ScriptEnter /sbin/init.d/named start Enter /sbin/rcinet start Running the Bind Startup Script Http//ops.ietf.org/dns/dynupd/secure-ddns-howto.html Controlling the Jabber Server JabberControlling the Jabber Server Twiki TwikiStarting TWiki Stunnel Sample client server configurationSample client server configuration Creating a Certificate of Authority Sendmail Supplemental InformationBackground OpenSSL Certificate Creation Sample mail filter Section Mail Filter Example Mail Filter Example Mail Filter Example Sendmail Supplemental Information Smfiversion Glossary Glossary 273 FTP See also Https 275 See TCP/IP Index SymbolsIndex 277 Decus see Encompass deinstall.sh scriptWeb site, 30 external newsfeed adding Index 279 Ldap client, 87 Ldap commandsLog file FireScreen viewing, 183 login account Index 281 OpenLDAP Project Web sitePoppassd server controlling Screening mode, 178 screening rule FireScreen 283 TIN