Barnyard Installation on Ubuntu

 

About

Barnyard is an addon for snort. Barnyard let snort to write its log and alert data very fast in a binary files and then Barnyard read those files and send them to whatever output you configure it, here we will configure to output the data to a mysql database in oreder to watch the data using php application called BASE.

 

Prerequisite

• Snort installation

 

Install Barnyard

• Install MySQL

apt-get install mysql-client libmysqlclient-dev mysql-server -y

• Create MySQL DB and Set permission

mysqladmin create snort -p mysql -p grant ALL PRIVILEGES on snort.* to snort@localhost with GRANT option; SET PASSWORD FOR snort@localhost=PASSWORD('snort'); \q cd /usr/local/src/snort/snort-2.9.*/schemas/ mysql -p < create_mysql snort

• Download Barnyard

cd /usr/local/src/snort wget http://www.securixlive.com/download/barnyard2/barnyard2-1.9.tar.gz

• Extract Barnyard

tar zxvf barnyard2-1.9.tar.gz cd barnyard2-1.9

• Configure Barnyard
• On i386 system

./configure --with-mysql

• On x86_64 system

./configure --with-mysql --with-mysql-libraries=/usr/lib/x86_64-linux-gnu

• Install Barnyard

make && make install

• Configure Barnyard start script to run at startup

cp rpm/barnyard2 /etc/init.d/ chmod +x /etc/init.d/barnyard2 cp rpm/barnyard2.config /etc/default/barnyard2 update-rc.d barnyard2 defaults 98

• Create links for Barnyard files and directory for archive files

ln -s /usr/local/etc/barnyard2.conf /etc/snort/barnyard.conf ln -s /usr/local/bin/barnyard2 /usr/bin/ mkdir -p /var/log/snort/eth0/archive/

• Make the following changes in barnyard2 startup script

vi /etc/init.d/barnyard2

...
source /etc/rc.d/init.d/functons
source /etc/sysconfig/network 

### Check that networking is up.
[ "${NETWORKING}" == "no" ] && exit 0 
...
SYSCONFIG="/etc/default/barnyard2"

### Read configuration
[ -r "$SYSCONFIG" ] && . "$SYSCONFIG"
...
        for INT in $INTERFACES; do
                PIDFILE="/var/lock/subsys/barnyard2-$INT.pid"
                ARCHIVEDIR="$SNORTDIR/$INT/archive"
...
BARNYARD_OPTS="-D -c $CONF -d $SNORTDIR/${INT} -w $WALDO_FILE -l $SNORTDIR/${INT} -a $ARCHIVEDIR -f $LOG_FILE -X $PIDFILE $EXTRA_ARGS"
daemon $prog $BARNYARD_OPTS
...
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/$prog
...
killall $prog
...
        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$prog
...
killall $prog
...
  condrestart)
        [ -e /var/lock/subsys/$prog ] && restart
...

• Edit LOG_FILE variable in Barnyard default config file
vi /etc/default/barnyard2 

 

...
LOG_FILE="snort.log"
...  

• Edit Barnyard config file and change the output line to
vi /usr/local/etc/barnyard2.conf 

 

...
output database: log, mysql, user=snort password=snort dbname=snort host=localhost
...

• Start Snort and Barnyard

service snortd start service barnyard2 start

Barnyard installation completed. Now that we have Snort server and Barnyard writing Snort logs and alerts to a MySQL database we can install frontend application like BASE to see and analyze snort data in aconvenient web application.

Here is a link for BASE Installation.