Snort3(PulledPork によるルールファイルの自動更新)

PulledPork

・Perl モジュール
    [root]# cpan LWP::UserAgent::Determined Net::SSLeay
                            LWP::Protocol::https Sys::Syslog Archive::Tar
・インストール
    [root]# mkdir -p /usr/local/pulledpork/etc
    [root]# git clone https://github.com/shirkdog/pulledpork.git
    [root]# cp -v pulledpork/pulledpork.pl /usr/local/pulledpork/
    [root]# cp -v pulledpork/etc/* /usr/local/pulledpork/etc/
    [root]# chown -R snort:snort /usr/local/pulledpork/
    [root]# chmod 755 /usr/local/pulledpork/pulledpork.pl
・設定
    [root]# vim /usr/local/pulledpork/etc/pulledpork.conf

      rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|<OINKCODE>

      ignore=snort3-deleted.rules,snort3-experimental.rules

      rule_path=/usr/local/snort/rules/snort.rules

      local_rules=/usr/local/snort/rules/local.rules

      sid_msg=/usr/local/snort/etc/snort/sid-msg.map

      snort_path=/usr/local/snort/bin/snort

      config_path=/usr/local/snort/etc/snort/snort.lua

      distro=Centos-8

      block_list=/usr/local/snort/intel/ip-blocklist

      IPRVersion=/usr/local/snort/intel/

      pid_path=/var/log/snort/snort.pid

      #snort_version=3.1.0.0
      snort_version=3.1.5.0

      # PulledPork がルールを処理する方法
      # enablesid.conf(全てのルールを有効)disablesid.conf(特定のルールを無効)
      enablesid=/usr/local/pulledpork/etc/enablesid.conf
      dropsid=/usr/local/pulledpork/etc/dropsid.conf
      disablesid=/usr/local/pulledpork/etc/disablesid.conf
      modifysid=/usr/local/pulledpork/etc/modifysid.conf
・PulledPork を実行し、ルールファイルを更新
    [root]# perl /usr/local/pulledpork/pulledpork.pl
                        -c /usr/local/pulledpork/etc/pulledpork.conf
                        -PE -v -I security -T -H SIGHUP
・cron でなく、systemd タイマーで PulledPork を定期実行
    [root]# vim /etc/systemd/system/pulledpork.service

      [Unit]
      Description=PulledPork service for updating Snort 3 rules
      Wants=pulledpork.timer
      [Service]
      Type=oneshot
      ExecStart=perl /usr/local/pulledpork/pulledpork.pl -c
            /usr/local/pulledpork/etc/pulledpork.conf -PE -v -I security -T -H SIGHUP
      [Install]
      WantedBy=multi-user.target

    [root]# vim /etc/systemd/system/pulledpork.timer

      [Unit]
      Description=PulledPork service timer for updating Snort 3 rules
      Requires=pulledpork.service
      [Timer]
      Unit=pulledpork.service
      OnCalendar=*-*-* 00:15:00
      AccuracySec=1us
      [Install]
      WantedBy=timers.target

    [root]# systemctl daemon-reload
    [root]# systemctl enable pulledpork.timer