Bonjour

J'ai un problème avec snort_inline. Je souhaite qu'il détecte le passage de d'un virus "eicar" pour le moment. J'arrive a le détecter a travers du ftp ou du http mais impossible à travers samba. Pourtant si je lance snort_inline avec l'option -v le trafic semble être vu.

J'ai également essayé de faire passer le virus en HTTP mais par un port pris au hazard ( 56464 pour les curieux ) et le virus est également détecté.

Voici ma configuration de snort_inline

var HOME_NET any
var HONEYNET any
var EXTERNAL_NET any
var SMTP_SERVERS any
var TELNET_SERVERS any
var HTTP_SERVERS any
var SQL_SERVERS any
var DNS_SERVERS any

var HTTP_PORTS 80

var SHELLCODE_PORTS !80

var ORACLE_PORTS 1521

var SSH_PORTS 22

var AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]

config checksum_mode: all

var RULE_PATH /etc/snortinline/rules

config detection: search-method lowmem

dynamicpreprocessor directory /usr/local/snortinline/lib/snort_dynamicpreprocessor/
dynamicengine /usr/local/snortinline/lib/snort_dynamicengine/libsf_engine.so


preprocessor flow: stats_interval 0 hash 2
preprocessor stream4: disable_evasion_alerts, \
			disable_norm_wscale, \
			detect_scans, \
			stream4inline, \
			memcap 134217728, \
			timeout 3600, \
			truncate, \
			window_size 3000

preprocessor stream4_reassemble: both, favor_new 

preprocessor clamav: ports all !22 !443, action-drop, dbdir /var/lib/clamav, dbreload-time 43200

preprocessor http_inspect: global \
    iis_unicode_map unicode.map 1252

preprocessor http_inspect_server: server default \
    profile all ports { 80 8080 8180 } oversize_dir_length 500

preprocessor rpc_decode: 111 32771

preprocessor bo

preprocessor ftp_telnet: global \
   encrypted_traffic yes \
   inspection_type stateful

preprocessor ftp_telnet_protocol: telnet \
   normalize \
   ayt_attack_thresh 200

preprocessor ftp_telnet_protocol: ftp server default \
   def_max_param_len 100 \
   alt_max_param_len 200 { CWD } \
   cmd_validity MODE < char ASBCZ > \
   cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
   chk_str_fmt { USER PASS RNFR RNTO SITE MKD } \
   telnet_cmds yes \
   data_chan

preprocessor ftp_telnet_protocol: ftp client default \
   max_resp_len 256 \
   bounce yes \
   telnet_cmds yes



preprocessor smtp: \
  ports { 25 } \
  inspection_type stateful \
  normalize cmds \
  normalize_cmds { EXPN VRFY RCPT } \
  alt_max_command_line_len 260 { MAIL } \
  alt_max_command_line_len 300 { RCPT } \
  alt_max_command_line_len 500 { HELP HELO ETRN } \
  alt_max_command_line_len 255 { EXPN VRFY }


preprocessor sfportscan: proto  { all } \
                         scan_type { all } \
                         sense_level { medium }



preprocessor dcerpc: \
    autodetect \
    max_frag_size 3000 \
    memcap 100000


preprocessor dns: \
    ports { 53 } \
    enable_rdata_overflow

output alert_syslog: LOG_LOCAL3 LOG_ALERT

include $RULE_PATH/classification.config
include $RULE_PATH/reference.config

include $RULE_PATH/exploit.rules
include $RULE_PATH/finger.rules
include $RULE_PATH/ftp.rules
include $RULE_PATH/telnet.rules
include $RULE_PATH/rservices.rules
include $RULE_PATH/dos.rules
include $RULE_PATH/ddos.rules
include $RULE_PATH/dns.rules
include $RULE_PATH/sql.rules
include $RULE_PATH/x11.rules
include $RULE_PATH/netbios.rules
include $RULE_PATH/mysql.rules
include $RULE_PATH/snmp.rules
include $RULE_PATH/smtp.rules
include $RULE_PATH/imap.rules
include $RULE_PATH/web-attacks.rules
include $RULE_PATH/virus.rules
include $RULE_PATH/nntp.rules

include $RULE_PATH/spyware-put.rules

include $RULE_PATH/bleeding-attack_response.rules
include $RULE_PATH/bleeding-dos.rules
include $RULE_PATH/bleeding-exploit.rules
include $RULE_PATH/bleeding-malware.rules
include $RULE_PATH/bleeding-virus.rules

$ uptime
19:28:06 up 12 days, 20:46,  2 users,  load average: 213.96, 212.37, 208.44

Poste le Wednesday 19 March 2008 12:18:21