# Testing snort via commandline
# /usr/sbin/snort -s -A fast -d -i all -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort
# true installs snort, false installs suricata
default['snort']['enabled'] = true
default['snort']['oinkmaster']['local_sniffing_enabled'] = true
default['snort']['packet_checksumming'] = ''

# User by /etc/sysconfig/snort (snort.init.erb)
default['snort']['interface'] = 'eth0'
default['snort']['start_snort'] = true

# Used in snort.conf.erb
default['snort']['version'] = '2.9.9.0'

default['snort']['rpm']['daq_version'] = '2.0.6-1.centos7'
default['snort']['rpm']['version'] = "#{node['snort']['version']}-1.centos7"

default['snort']['daq_rpm_name'] = "daq-#{node['snort']['rpm']['daq_version']}.x86_64.rpm"
default['snort']['snort_rpm_name'] = "snort-#{node['snort']['rpm']['version']}.x86_64.rpm"

# Generate checksum: shasum -a 256 snort-2.9.7.6-1.src.rpm
default['snort']['rpm']['checksum'] = '4e40da758f49701c8cf418a1b28021f646a7d442357939334411481a760ad8e7'
default['snort']['rpm']['daq_checksum'] = '9e3a45d6b265d3cc7868220eb9152a73803adda7829f150f7c8b5d707c6b4c43'

# default['snort']['snort_url_prefix'] = "https://www.snort.org/downloads/snort"
# Override the following 2 items to download snort RPMs from somewhere else
# default['snort']['snort_url'] = "#{node['snort']['snort_url_prefix']}/#{node['snort']['snort_rpm_name']}"
# default['snort']['daq_url'] = "#{node['snort']['snort_url_prefix']}/#{node['snort']['daq_rpm_name']}"

default['snort']['use_default_oinkmaster_conf'] = true
default['snort']['oinkmaster']['download_rules'] = true
default['snort']['oinkmaster']['rules'] = [
  {
    'path' => '/etc/snort/snortrules-snapshot-2990.tar.gz',
    'url' => 'http://download.lunar-linux.org/lunar/mirrors/snortrules-snapshot-2990.tar.gz'
  },
  {
    'path' => '/etc/snort/emerging.rules.tar.gz',
    'url' => 'http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz'
  }
]
default['snort']['oinkmaster']['conf_entries'] = [
  'disablesid 1390   # 20111122 shell code false pos',
  'disablesid 17750  # 20111130 Noisy IIS rule',
  'disablesid 648    # 20111130 Noisy shellcode',
  'disablesid 3813   # 20111206 Dont use awstats.pl',
  'disablesid 10997  # 20111220 Noisy OpenSSL rule',
  'disablesid 16008  # HTTP 304 Not Modified seem normal for us',
  'disablesid 13974  # 20120111 Client side IE false positive',
  'disablesid 20258  # 20120124 MS only',
  'disablesid 1201   # 20120301 403 forbidden',
  'disablesid 17317  # 20120301 OpenSSH sshd Identical Blocks DOS attempt',
  'disablesid 18611  # 20120312 Java Web Server Webdav Stack Buffer Overflow',
  'disablesid 882    # 20120319 WEB-CGI calendar access',
  'disablesid 1325   # 20120319 ssh CRC32 overflow filler',
  'disablesid 5708   # 20120319 web server file upload attempt',
  'disablesid 1603   # 20120319 WEB-MISC DELETE attempt',
  'disablesid 1852   # 20120319 robots.txt',
  'disablesid 13249  # 20120319 dns response for rfc1918',
  'disablesid 1010   # 20120319 IIS encoding access',
  'disablesid 21039  # 20120319 javascript unescape obfuscation attempt',
  'disablesid 1852   # 20120320 robots.txt',
  'disablesid 1042   # 20120320 IIS view source via translate header',
  'disablesid 20212  # 20120320 SSL CBC encryption mode weakness brute force',
  'disablesid 2281   # 20120320 PHP Setup.php access',
  'disablesid 19887  # 20120320 javascript unescape obfuscation attempt',
  'disablesid 366    # 20120320 ICMP-INFO PING *NIX ',
  'disablesid 402    # 20120320 ICMP-INFO Destination Unreachable',
  'disablesid 1545   # 20120320 DOS Cisco attempt',
  'disablesid 1436   # 20120320 Apple Quicktime User Agent access',
  'disablesid 12800  # 20120321 SHELLCODE base64 x86 NOOP',
  'disablesid 1546   # 20120321 Cisco /%% DOS attempt',
  'disablesid 408    # 20120322 ICMP-INFO Echo Reply',
  'disablesid 1394   # 20120322 SHELLCODE x86 inc ecx NOOP',
  'disablesid 990    # 20120322 WEB-FRONTPAGE _vti_inf.html access',
  'disablesid 1288   # 20120322 WEB-FRONTPAGE /_vti_bin/ access',
  'disablesid 962    # 20120322 WEB-FRONTPAGE shtml.exe access',
  'disablesid 937    # 20120322 WEB-FRONTPAGE _vti_rpc access',
  'disablesid 1079   # 20120322 Microsoft Windows WebDAV propfind access',
  'disablesid 868    # 20120322 WEB-CGI rsh access',
  'disablesid 2381   # 20120323 Checkpoint Firewall-1 HTTP parsing format string',
  'disablesid 12798  # 20120326 SHELLCODE base64 x86 NOOP',
  'disablesid 18335  # 20120326 Microsoft MHTML XSS attempt',
  'disablesid 865    # 20120326 WEB-CGI ksh access',
  'disablesid 7861   # 20120326 Google Desktop activity',
  'disablesid 1214   # 20120326 WEB-MISC intranet access',
  'disablesid 1147   # 20120326 WEB-MISC cat%20 access',
  'disablesid 1091   # 20120326 ICQ Webfront HTTP ',
  'disablesid 20093  # 20120327 IRC channel notice on non-standard port',
  'disablesid 16078  # 20120328 PHP memory_limit vulnerability exploit attempt',
  'disablesid 12801  # 20120328 SHELLCODE base64 x86 NOOP',
  'disablesid 17567  # 20120330 LANDesk Management Suite Alerting Service buffer',
  'disablesid 7567   # 20120330 funwebproducts mywebsearchtoolbar-funtools',
  'disablesid 21454  # 20120402 Trojan.Win32.Banbra.vec',
  'disablesid 21556  # 20120419 Windows 98 User-Agent string',
  'disablesid 17338  # 20120423 SHELLCODE x86 Windows 32-bit SEH get EIP',
  'disablesid 1807   # 20120423 Chunked-Encoding transfer attempt',
  'disablesid 1861   # 20120502 Linksys router default username and password',
  'disablesid 18475  # 20120509 HP Openview OvWebHelp.exe buffer overflow',
  'disablesid 885    # 20120511 CGI bash access (alerts on string \"bash\"!)',
  'disablesid 1969   # 20120511 ion-p access (alerts on \"ion-plated\"!)',
  'disablesid 8427   # 20120511 openssl get shared ciphers overflow (2006)',
  'disablesid 1044   # 20120515 IIS webhits access (dont run IIS)',
  'disablesid 974    # 20120516 IIS Directory transversal attempt',
  'disablesid 1861   # 20120517 Linksys router default username and password',
  'disablesid 13719  # 20120521 ORACLE database username buffer overflow',
  'disablesid 3481   # 20120521 ARCserve backup UDP slot info domain overflow',
  'disablesid 3531   # 20120523 ARCserve backup UDP 0x99 client domain overflow',
  'disablesid 18612  # 20120524 Oracle Java Web Server Webdav Buffer Overflow',
  'disablesid 18487  # 20120531 Ingres Database iidbms heap overflow',
  'disablesid 22097  # 20120611 PHP-CGI command injection attempt',
  'disablesid 17429  # 20120614 Microsoft Windows ASP.NET information disclosure',
  'disablesid 1213   # 20120615 WEB-MISC backup access',
  'disablesid 1979   # 20120621 perl post attempt (dont use perl)',
  'disablesid 1048   # 20120626 Netscape Enterprise directory listing attempt',
  'disablesid 17245  # 20120628 Mozilla Firefox image dragging exploit',
  'disablesid 6504   # 20120709 Sophos Anti-Virus CAB file overflow attempt',
  'disablesid 1142   # 20120712 /.... access',
  'disablesid 1136   # 20120712 cd..',
  'disablesid 649    # 20120717 SHELLCODE x86 setgid 0 (triggers on SSL)',
  'disablesid 23361  # 20120816 WEB-IIS tilde character file name discovery attempt',
  'disablesid 23407  # 20120816 Apple iChat url format string exploit attempt',
  'disablesid 17433  # 20120828 Oracle Solaris DHCP Client Code Execution',
  'disablesid 13719  # 20120828 ORACLE database username buffer overflow',
  'disablesid 3550   # 20120911 Microsoft Internet Explorer hostname overflow',
  'disablesid 23861  # 20120917 heapspray characters detected',
  'disablesid 15415  # 20120919 AIM or ICQ deny unencrypted login',
  'disablesid 20437  # 20121009 DOS multiple TLSv1 Encrypted Handshake messages',
  'disablesid 11687  # 20121017 Apache SSI error page cross-site scripting',
  'disablesid 2447   # 20121025 ServletManager access (GroupWise)',
  'disablesid 19183  # 20121102 IIS FastCGI heap overflow attempt',
  'disablesid 24348  # 20121107 Apache mod_rpaf x-forwarded-for header DoS',
  'disablesid 1172   # 20121112 bigconf.cgi access',
  'disablesid 24379  # 20121116 Microsoft Windows IIS FastCGI request header',
  'disablesid 18611  # 20121123 Oracle Java Web Server Webdav Stack Buffer',
  'disablesid 881    # 20121127 WEB-CGI archie access',
  'disablesid 20173  # 20130122 SCADA Cogent DataHub server-side information disclosure',
  'disablesid 2003394 # 20130129 User Agent Containing http Suspicious',
  'disablesid 2007854 # 20130129 User-Agent (Mozilla)',
  'disablesid 19786  # 20130129 User-Agent known malicious user agent',
  'disablesid 2010908 # 20130129 Mozilla User-Agent',
  'disablesid 2009295 # 20130129 Suspicious Mozilla User-Agent Likely Fake',
  'disablesid 2008453 # 20130130 Tomcat Auth Brute Force attempt',
  'disablesid 2010706 # 20130201 Internet Explorer 6 in use',
  'disablesid 2012936 # 20130205 ZmEu Scanner User-Agent Inbound',
  'disablesid 2001117 # 20130206 ET DNS Standard query response, Name Error',
  'disablesid 21235   # 20130206 LOCK Webdav Stack Buffer Overflow (Sun only)',
  'disablesid 2001815 # 20130207 Spambot Suspicious 220 Banner on Local Port',
  'disablesid 2002910 # 20130213 ET Potential VNC Scan 5800-5820',
  'disablesid 2101852 # 20130213 GPL WEB_SERVER robots.txt access',
  'disablesid 2015561 # 20130213 ET INFO PDF Using CCITTFax Filter',
  'disablesid 2009005 # 20130214 ET MALWARE Simbar Spyware User-Agent Detected',
  'disablesid 2012251 # 20130214 ET MOBILE_MALWARE Google Android Device HTTP Request',
  'disablesid 2016074 # 20130214 ET TROJAN User-Agent seen with confirmed CC check-in',
  'disablesid 2011015 # 20130214 ET WEB_SERVER Sun Java System Web Server File Disclosure Attempt',
  'disablesid 2002166 # 20130214 Alexa Search Toolbar User-Agent',
  'disablesid 2008085 # 20130214 Alexa Search Toolbar User-Agent 2',
  'disablesid 2101603 # 20130218 GPL WEB_SERVER DELETE attempt',
  'disablesid 2101852 # 20130218 GPL WEB_SERVER robots.txt access',
  'disablesid 2002758 # 20130218 ET EXPLOIT WMF Escape Record Exploit',
  'disablesid 2010697 # 20130218 ET USER_AGENTS Suspicious User-Agent Beginning with digits',
  'disablesid 2001664 # 20130221 ET P2P GNUtella Potential corporate privacy breech',
  'disablesid 2101979 # 20130221 GPL WEB_SERVER perl post attempt',
  'disablesid 2011712 # 20130221 ET P2P Bittorrent P2P Client User-Agent (FDM 3.x) Potential Corporate Privacy Violation',
  'disablesid 2002742 # 20130221 ET EXPLOIT WMF Escape Record Exploit - Version 3 (Windows)',
  'disablesid 2001855 # 20130221 ET MALWARE Fun Web Products Spyware User-Agent',
  'disablesid 2010524 # 20130221 ET WEB_SERVER Possible HTTP 500 XSS Attempt',
  'disablesid 2013068 # 20130221 ET WEB_SERVER Possible GRANT TO SQL Injection Attempt',
  'disablesid 2003466 # 20130225 ET WEB_SERVER PHP Attack Tool Morfeus F Scanner',
  'disablesid 2100556 # 20130225 GPL P2P Outbound GNUTella client request [Classification: Potential Corporate Privacy Violation]',
  'disablesid 2003099 # 20130225 Poison Null Byte (Webmin)',
  'disablesid 2012251 # 20130304 ET MOBILE_MALWARE Google Android Device HTTP Request',
  'disablesid 2003385 # 20130307 ET USER_AGENTS sgrunt Dialer User Agent',
  'disablesid 2003387 # 20130307 ET MALWARE dialno Dialer User-Agent',
  'disablesid 16295   # 20130311 WEB-CLIENT Kaspersky antivirus library heap buffer overflow',
  'disablesid 2007994 # 20130311 ET MALWARE Suspicious User-Agent (1 space)',
  'disablesid 2008559 # 20130314 ET ATTACK_RESPONSE Windows LMHosts File Download',
  'disablesid 23860   # 20130314 WEB-CLIENT heapspray characters detected',
  'disablesid 2009345 # 20130314 ET ATTACK_RESPONSE HTTP 401 Unauthorized',
  'disablesid 2101288 # 20130314 GPL WEB_SERVER /_vti_bin/ access',
  'disablesid 2016204 # 20130327 ET CURRENT_EVENTS Possible CVE-2013-0156 Ruby On Rails XML YAML tag with !ruby ',
  'disablesid 2016222 # 20130327 ET SCAN GET with HTML tag in start of URI seen with PHPMyAdmin scanning',
  'disablesid 2016175 # 20130403 ET CURRENT_EVENTS Possible CVE-2013-0156 Ruby On Rails XML POST to Disallowed Type YAML',
  'disablesid 2016222 # 20130425 ET SCAN GET with HTML tag in start of URI seen with PHPMyAdmin scanning',
  'disablesid 2015822 # 20130425 ET INFO Suspicious Windows NT version 9 User-Agen',
  'disablesid 2015820 # 20130425 ET INFO Suspicious Windows NT version 7 User-Agent',
  'disablesid 2010963 # 20130507 ET WEB_SERVER SELECT USER SQL Injection Attempt in URI',
  'disablesid 2012536 # 20130521 ET MALWARE Mozilla 3.0 and Indy Library User-Agent Likely Hostile',
  'disablesid 2011513 # 20130521 ET CURRENT_EVENTS Possible Phoenix Exploit Kit - PROPFIND AVI',
  'disablesid 2101201 # 20130523 GPL WEB_SERVER 403 Forbidden',
  'disablesid 2016184 # 20130531 ET WEB_SERVER ColdFusion administrator access',
  'disablesid 2016983 # 20130612 ET WEB_SERVER Access to /phppath/php Possible Plesk 0-day Exploit',
  'disablesid 2016979 # 20130627 ET WEB_SERVER suhosin.simulation PHP config option in uri',
  'disablesid 2016982 # 20130711 ET WEB_SERVER auto_prepend_file PHP config option in uri',
  'disablesid 2016980 # 20130711 ET WEB_SERVER disable_functions PHP config option in uri',
  'disablesid 2016977 # 20130711 ET WEB_SERVER allow_url_include PHP config option in uri',
  'disablesid 2016981 # 20130719 ET WEB_SERVER open_basedir PHP config option in uri',
  'disablesid 2016978 # 20130722 ET WEB_SERVER safe_mode PHP config option in uri',
  'disablesid 2011768 # 20130723 ET WEB_SERVER PHP tags in HTTP POST',
  'disablesid 2002117 # 20130904 ET GAMES Battle.net connection reset',
  'disablesid 2008974 # 20131023 ET MALWARE User-Agent (Mozilla/4.0 (compatible))',
  'disablesid 2011088 # 20131023 ET SCAN Possible DavTest WebDav Vulnerability Scanner',
  'disablesid 2520485 # 20131119 ET TOR Known Tor Exit Node UDP Traffic group 243',
  'disablesid 2406251 # 20131119 ET RBN Known Russian Business Network IP UDP group 126',
  'disablesid 2009414 # 20131119 ET DOS Large amount of TCP ZeroWindow - Possible Nkiller2 DDos attack',
  'disablesid 2522611 # 20140108 ET TOR Known Tor Relay/Router (Not Exit) Node UDP Traffic group 306',
  'disablesid 2012621 # 20140327 ET CURRENT_EVENTS Adobe Flash SWF File Embedded in XLS FILE',
  'disablesid 2008470 # 20140912 ET DNS Excessive NXDOMAIN responses',
  'disablesid 2002158 # 20141106 ET WEB_SERVER XML-RPC',
  'disablesid 2017825 # 20141127 ET EXPLOIT Zollard PHP Exploit UA Outbound',
  'disablesid 2011040 # 20150108 ET WEB_SERVER Possible Usage of MYSQL Comments in URI for SQL Injection',
  'disablesid 2018232 # 20150108 ET CURRENT_EVENTS Possible ZyXELs ZynOS Configuration Download Attempt',
  'disablesid 2009288 # 20150210 ET WEB_SERVER Attack Tool Revolt Scanner',
  'disablesid 32959   # 20150210 PROTOCOL-DNS Microsoft SMTP excessive answer records buffer overflow attempt',
  'disablesid 2020912 # 20150522 ET WEB_SERVER Possible IIS Integer Overflow DoS (CVE-2015-1635)',
  'disablesid 2101243 # 20150522 GPL EXPLOIT ISAPI .ida attempt',
  'disablesid 2018132 # 20150526 ET WORM TheMoon.linksys.router 2',
  'disablesid 2017798 # 20150526 ET EXPLOIT Zollard PHP Exploit UA',
  'disablesid 2020102 # 20150608 ET WEB_SERVER PHP System Command in HTTP POST',
  'disablesid 2001689 # 20150724 ET WORM Potential MySQL bot scanning for SQL server',
  'disablesid 2020868 # 20150817 ET EXPLOIT FritzBox RCE GET Request',
  'disablesid 14410   # 20151007 BLACKLIST DNS request for known malware domain xpg.com.br',
  'disablesid 2002802 # 2002802  ET EXPLOIT Windows Media Player parsing BMP file with 0 size offset to start of image'
]

default['snort']['oinkmaster']['local_sniffing_conf'] = [
  'disablesid 2100527 # 20151019 GPL SCAN same SRC/DST',
  'disablesid 2100528 # 20151019 GPL SCAN loopback traffic'
]
