A role to install many different Intrusion Detection Systems, these are defined as "providers" to the Role.
Current supported list of providers:
- snort
Red Hat Enterprise Linux 7.x, or derived Linux distribution such as CentOS 7, Scientific Linux 7, etc
Role variables that get put into use are IDS provider specific, they are listed below.
ids_install_pkgs
- List of packages to install on the system, by default this
is left empty and the defaults will be selected for each provider.
For the Snort provider you will need to set the ids_install_provider
variable
as such:
vars:
ids_install_provider: snort
From there, all our ids_install_provider_*
variables will be namespaced to the
specific provider.
Note that the
ids_install_snort_version
andids_install_snort_daq_version
will change upstream sometimes and care should be taken that you are aligned with the correct version.
ids_install_provider
- Default value:"snort"
ids_install_snort_barnyard2_normalize_logs
- Default value:false
ids_install_snort_interface
- Default value:eth0
ids_install_snort_pkgs
- List of packages to install - Default value:['https://s3.amazonaws.com/linklight.securityautomation/daq-2.0.6-1.el7.x86_64.rpm', 'https://s3.amazonaws.com/linklight.securityautomation/snort-2.9.13-1.centos7.x86_64.rpm', 'libdnet', 'pulledpork']
ids_install_snort_promiscuous_interface
- Default value:False
ids_install_snort_logdir
- Default value:"/var/log/snort"
ids_install_snort_logfile
- Default value:"snort.log"
ids_install_snort_logfile
- Default value:"snort.log"
ids_install_snort_user
- Default value:"snort"
ids_install_snort_group
- Default value:"snort"
ids_install_snort_use_pulledpork
- Default value:True
ids_install_snort_community_rules_url
- URL to snort rules - Default value:https://s3.amazonaws.com/linklight.securityautomation/community-rules.tar.gz
ids_install_snort_registered_rules_url
- URL to snort registered rules - Default value:https://s3.amazonaws.com/linklight.securityautomation/snortrules-snapshot-29130.tar.gz
When ids_install_snort_barnyard2_normalize_logs
is set, the role will also install
barnyard2 in service of normalizing the
snort logs.
geerlingguy.repo-epel
- name: configure snort
hosts: idshosts
vars:
ids_install_provider: "snort"
ids_install_barnyard2_normalize_logs: True
tasks:
- name: import ids_install role
import_role:
name: "ids_install"
- This role does not start and enable the
ids_provider
service because this Role does not deal with the configuration of the service and only the installation.
BSD