Tutorial Setup dan Pengujian Snort IDS (Keamanan Jaringan)

 

1. Beralih ke Root User

Gunakan root agar memiliki akses penuh administrator:

sudo su

2. Update Sistem

Pastikan paket up-to-date. Import GPG key dari repo Kali:

curl -fsSL https://archive.kali.org/archive-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/kali-archive-keyring.gpg
apt update

3. Install Snort

Install Snort dengan:

apt install snort -y

Cek versi untuk memastikan berhasil:

snort -V

4. Masuk ke Direktori Konfigurasi Snort

cd /etc/snort/
ls -l

5. Konfigurasi Snort Utama

Edit file konfigurasi:

pico /etc/snort/snort.lua

Tambahkan blok konfigurasi IPS:

ips = 
{ 
    variables = default_variables, 
    rules = [[ 
        include /etc/snort/rules/local.rules 
    ]] 
} 

Simpan (Ctrl+O, Enter, Ctrl+X).

6. Membuat Snort Rules

Buat/ubah local.rules:

pico /etc/snort/rules/local.rules

Tambahkan rules deteksi scanning umum (1 baris tiap rule):

alert tcp any any -> any any (msg:"Nmap SYN Scan Detected"; flags:S; sid:1000001; rev:1;) 
alert tcp any any -> any any (msg:"Nmap Xmas Scan Detected"; flags:FPU; sid:1000002; rev:1;) 
alert tcp any any -> any any (msg:"Nmap Null Scan Detected"; flags:0; sid:1000003; rev:1;) 
alert icmp any any -> any any (msg:"HPING3 ICMP Flood Detected"; sid:1000004; rev:1;) 

7. Menjalankan Snort dalam Mode Konsol

Monitor interface tertentu:

Interface eksternal (contoh eth0):

sudo snort -c /etc/snort/snort.lua -R /etc/snort/rules/local.rules -i eth0 -A alert_fast

Loopback (lo):

sudo snort -c /etc/snort/snort.lua -R /etc/snort/rules/local.rules -i lo -A alert_fast

8. Simulasi Serangan untuk Testing

Nmap Scan:

nmap -sS localhost      # SYN Scan
nmap -sN localhost      # Null Scan
nmap -sX localhost      # Xmas Scan

ICMP Flood dengan hping3:

sudo hping3 -1 -c 1000 -d 120 -S -w 64 --flood --rand-source localhost

Jika konfigurasi benar, alert akan muncul di konsol Snort.

9. Membuat Snort sebagai Service (Opsional)

Buat file systemd:

sudo nano /etc/systemd/system/snort.service

Isi dengan:

[Unit] 
Description=Snort IDS 
After=network.target 

[Service] 
ExecStart=/usr/sbin/snort -c /etc/snort/snort.lua -R /etc/snort/rules/local.rules -i lo -A alert_fast 
Restart=on-failure 

[Install] 
WantedBy=multi-user.target 

10. Enable & Start Snort Service

Reload systemd dan aktifkan Snort agar jalan otomatis:

sudo systemctl daemon-reload
sudo systemctl enable snort
sudo systemctl start snort

Stop service bila perlu:

sudo systemctl stop snort

11. Verifikasi Snort Berjalan

Cek status:

sudo systemctl status snort