You have already set up a Unix management system using Webmin. You would like to integrate Snort with this management system.
Figure 5-34. Webmin main screen
Figure 5-35. Webmin Configuration
Figure 5-36. Webmin Modules
Figure 5-37. Install Module
Webmin is a web-based system-administration interface for Unix. It allows you to manage your Unix system and softwarein this case, Snort. Once you have installed the Snort Webmin Module, you need to configure the various settings by clicking on the Snort IDS Admin link in the Install Module window, or by navigating to the plug-in through the Webmin interface. On first use, you are presented with a screen prompting for the details of your Snort installation (Figure 5-38). Note that Webmin can handle only the control of one Snort daemon running on the machine.
Figure 5-38. Initial configuration
You need to set the full path to your Snort executable, the Snort configuration file, the rules directory, and the Snort PID file. Optionally, you can set the command to start Snort and set the URL to your ACID installation. Once you have filled in the information, click Save.
There are five main sections to the Webmin interface to Snort: Rulesets, Network Settings, PreProcessors, Alerts & Logging, and Edit Config File (Figure 5-39). Start in the Rulesets screen to select which rules you wish to enable. Note that changes will take effect only once you have restarted Snort. To facilitate this, there is a Restart Snort button at the bottom of this screen.
Figure 5-39. Snort IDS
The Network Settings screen allows you to set the various network options, including your Home and External networks, various servers, and port selections (Figure 5-40).
Figure 5-40. Network settings
The PreProcessors screen allows you to enable and disable the various preprocessors, along with setting required options (Figure 5-41).
Figure 5-41. Preprocessors
The Alerts & Logging screen allows you to enable, disable, and set the options on the assorted output plug-ins (Figure 5-42).
Figure 5-42. Alerts & Logging
The final screen, Edit Config File, allows you to directly edit the Snort configuration file by hand (Figure 5-43).
Figure 5-43. Edit Config File
In all the screens, you should set up Snort per your requirements, following the recommendations that we have provided in the other recipes in this book.
Administering Snort with HenWen
Installing Snort from Source on Unix
Logging to a File Quickly
How to Build Rules
Detecting Stateless Attacks and Stream Reassembly
Managing Snort Sensors
Generating Statistical Output from Snort Logs
Monitoring Network Performance