Snare installation
Snare is available as an Self installing package that enables it to be installed and removed with relative ease on OSX Systems.
|
- An appropriate OSX Distribution.
- The SnareOSX package in binary format downloaded from the InterSect Alliance website. Snare for OSX provides the infrastructure required to filter, format and distribute audit log data to one or more central log collection systems.
|
|
Install Snare for OSX binary package.
There are two methods to install the Snare OSX Binary package. The first method uses the graphical OSX environment, the second method uses the command line installer.
To use the graphical environment:
- Double click the package SnareOSX-1.1.6.pkg in the GUI
- Follow the on screen instructions. This will install Snare for OSX and start/restart the audit daemon(auditd).
- Restart the machine
To use the command line
- Logon as root user, i.e. at the command prompt enter the command sudo -s and enter the root password when prompted. Issue the command, as root: installer -pkg SnareOSX-1.1.0.pkg -target / This will install Snare for OSX and start/restart the audit daemon (auditd).
- Restart the machine
|
|
Remove Snare for OSX binary package (if required).
OSX does not provide facilities for uninstallers for pkg based applications. Hence Intersect Alliance has provided an uninstall script to completely uninstall Snare for OSX if required. The uninstall script requires no confirmation. Hence once run it will uninstall Snare for OSX without any prompts. To uninstall Snare for OSX:
- Logon as root user, ie at the command prompt enter the command:
sudo -s and enter the root password.
- Run the command: /Applications/Utilities/SnareAgent\ WebConsole.app/\ Contents/Resources/uninstall.sh
|
Running Snare
Once the Snare agent is installed, it will begin to operate using a very simple configuration. The Remote Control Interface is accessible by entering http://localhost:6161 or the IP in the web browser, or by running the SnareAgent WebConsole application which is installed as part of the installation (found in the Application/Utilities Folder).
By default the Remote Control Interface (the web user interface) is set to enabled, and it is password protected for security reasons. The default username and password are:
Username: snare Password: snare
Tip: It is recommended you use a strong complex password of at least 12 characters.
The View Audit Service Status menu item displays whether the Snare service is active as well as information relating to the architecture of the machine.
