Comment configurer Snort 3 IDS avancé en 2026

#!/bin/bash
apt update && apt upgrade -y
apt install -y build-essential cmake cpputest libpcap-dev libpcre2-dev libnet1-dev zlib1g-dev luajit hwloc libdnet-dev libdumbnet-dev bison flex liblzma-dev openssl libssl-dev pkg-config libhwloc-dev libluajit-5.1-dev libunwind-dev libcmocka-dev
cd /opt
git clone https://github.com/snort3/snort3.git
cd snort3
./configure_cmake.sh --prefix=/usr/local --enable-tsc-clock
git clone https://github.com/snort3/extra.git
cd extra
./configure_cmake.sh --prefix=/usr/local --with-snort3
cd ../src
cmake -B build -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_BUILD_TYPE=Release
cmake --build build --target snort3 --parallel
cmake --install build
cd ../extra
cmake -B build -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel
cmake --install build

ips = {
  mode = inline,
  variables = default_variables,
  include = 'lua/snort_defaults.lua',
}
HOME_NET = '192.168.1.0/24'
EXTERNAL_NET = '!$HOME_NET'
ports = {
  http = 80,
  http2 = 8080,
  mysql = 3306,
  ssh = 22,
}
ipvar dns_servers [8.8.8.8,8.8.4.4]
ips =
{
  rules = [[ include /etc/snort/rules ]],
  enable_builtin_rules = true,
}
stream =
{
  variables =
    default_variables,
  tcp = { memcap = 4194304 },
}
appid =
{
  app_detector_dir = '/usr/local/lib',
  categories =
  {
    default = 1,
  },
}
http_inspect =
{
  global =
  {
    max_concurrent_sessions = 8388608,
  },
}
packet_tracer = { enable = true }
process =
{
  trace_level = 1,
  trace_log = '/var/log/snort/packet_trace.log',
}

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"SSH Brute Force Attempt"; flow:to_server,established; content:"SSH-"; threshold:type both, track by_src, count 5, seconds 60; sid:1000001; rev:1;)

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"SQL Injection Attempt"; flow:to_server,established; http.uri; content:"union select"; nocase; http.method; content:"GET|20|"; sid:1000002; rev:1; metadata:service http;)

drop tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"SMB Exploit EternalBlue"; content:"|FF|SMB|25|`; flow:to_server,established; sid:1000003; rev:1;)

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Ping Flood"; itype:8; threshold:type threshold, track by_dst, count 100, seconds 10; sid:1000004; rev:1;)

binder =
{
  { when = { proto = 'http' }, use = { type = 'policy', policy_id = 0 } },
  { when = { service = 'ssh' }, use = { type = 'policy', policy_id = 1 } },
  { when = { nets = '$HOME_NET' }, use = { type = 'policy', policy_id = 0 } },
  { when = { role = 'server' }, use = { type = 'policy', policy_id = 1 } },
}
policy_0 =
{
  ips = { rules = '/etc/snort/rules/policy0.rules' },
}
policy_1 =
{
  ips = { rules = '/etc/snort/rules/policy1.rules' },
  stream = { tcp = { memcap = 10485760 } },
}

alert_json =
{
  limit = 1000,
  pkt_num = true,
  src_addr = true,
  dst_addr = true,
  src_port = true,
  dst_port = true,
  proto = true,
  action = true,
  details = true,
  msg = true,
  class = true,
  priority = true,
  rev = true,
  rule = true,
  time_stamp = true,
  file = true,
}
alert_full = { log = true, packet = true }
logfile = { file = true, limit_size = '10 MB', pkt_num = true }
packet_log = { file = '/var/log/snort/pkts.log', link_type = 'pcap' }

#!/bin/bash
mkdir -p /var/log/snort
chown snort:snort /var/log/snort
snort -c /etc/snort/snort.lua -i eth1 -A alert_json:alert.json -l /var/log/snort --daq afpacket -daq-mode read-file -daq-var buffer_size=65536 --daq-dir /usr/local/lib/daq --lua "ips.rules = '/etc/snort/rules/*.rules'" --enable-inline -Q --daq afpacket -i eth1:eth1 -q &
echo $! > /var/run/snort.pid
systemctl daemon-reload
cat <<EOF > /etc/systemd/system/snort.service
[Unit]
Description=Snort 3 IDS
After=network.target
[Service]
ExecStart=/usr/local/bin/snort -c /etc/snort/snort.lua -i eth1 -A alert_json -l /var/log/snort --daq afpacket --enable-inline -Q
Restart=always
User=snort
[Install]
WantedBy=multi-user.target
EOF
systemctl enable snort
systemctl start snort