- Recommend Ubuntu-based, raspbian is good
- sudo apt-get install build-essential python-dev libmysqlclient-dev python-virtualenv python-pip If some don’t resolve, install what Linux tells you to
- Git clone https://github.com/blaverick62/SIREN.git
- cd SIREN
- . ./VENV/bin/activate
- pip install -r requirements.txt
- sudo apt-get install libkrb5-dev
- pip install python-gssapi
- pip install paramiko
- sudo ./sirenstart.sh
- sudo apt-get install flex bison build-essential checkinstall libpcap-dev libnet1-dev libpcre3-dev libmysqlclient15-dev libnetfilter-queue-dev iptables-dev libdumbnet-dev autoconf libtool libdaq-dev
- snort setup: sudo apt-get install snort
- set up home net and interface
- add file siren.rules to /etc/snort/rules
- add line alert tcp $HOME_NET any -> any any (msg:"Target file accessed!"; content:"malarkey"; sid:1000037;)
- add line include $RULE_PATH/siren.rules to snort.conf near line 550 with other includes
- sudo apt-get install mysql-server
- mysql -u root -p
- Enter root password
- create user ‘sirenlocal’@’localhost’ identified by ‘sirenproj’;
- grant all privileges on . to ‘sirenlocal’@’localhost’;
- quit
- mysql -u sirenlocal -p
- sirenproj
- create schema siren_db;
- use siren_db;
- quit
- cd /usr/src
- sudo git clone github.com/firnsy/barnyard2 barnyard_src cd barnyard_src
- cd barnyard_src
- sudo autoreconf -fvi -I ./m4
- sudo ln -s /usr/include/dumbnet.h /usr/include/dnet.h
- sudo ldconfig
- cd /usr/src/barnyard_src
- ./configure --with-mysql --with-mysql-libraries=/usr/lib/YOUR-ARCH-HERE-linux-gnu
- make
- sudo make install
- sudo cp etc/barnyard2.conf /etc/snort
- sudo mkdir /var/log/barnyard2
- sudo chown snort.snort /var/log/barnyard2
- sudo touch /var/log/snort/barnyard2.bookmark
- sudo chown snort.snort /var/log/snort/barnyard2.bookmark
- scp /usr/src/barnyard_src/schemas/create_mysql to siren_db box
- Change output format line for unified2 in /etc/snort.conf from snort.log to merged.log and remove nostamp option
- mysql -u sirenlocal -p
- enter password
- create schema snort
- quit
- mysql -u sirenlocal -p snort </home/"username"/create_mysql
- find sid-msg.map online, download and copy into /etc/snort
- start snort with: sudo snort -q -c /etc/snort/snort.conf -i ens33
- start barnyard2 with: sudo barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f merged.log -w /var/log/snort/barnyard2.bookmark
- sudo apt-get install apache2
- sudo service apache2 restart
- sudo apt-get install php libapache2-mod-php
- sudo nano /etc/apache2/apache2.conf
- uncomment <directory /srv/> block
- change /srv/ to path to /siren/Website/myapp/public
- sudo nano /etc/apache2/sites-available/000-default.conf