Snare installation

An appropriate Linux Distribution
The snarelinux package available for Enterprise customers from the Snare Secure Area at https://www.intersectalliance.com.

Install Snare for Linux binary RPM package.

To install the Snare package perform the following:
Download the required RPM or DEB
Logon as root user, i.e. at the command prompt enter the command /bin/su and enter the root password when prompted. Issue the command, as root as per your distribution: >rpm -Uvh filename.rpm E.g. >rpm -Uvh snarelinux-supp-4.1.0-SLED-10.i686.rpm

Or >dpkg -i filename.deb E.g. >dpkg -i snarelinux-supp-4.1.0-Debian-7.3.x86_64.deb
This will install Snare for Linux and restart the audit daemon (auditd).
NOTE: Red Hat may have a conflict during install. If this occurs, use –force flag E.g. >rpm -Uvh --force snarelinux-supp-4.1.0-SLED-10.i686.rpm

Remove Snare for Linux binary RPM package (if required).

Query the RPM database to ensure Snare for Linux is installed

>rpm -q snarelinux-supp
Remove the Snare for Linux package

>rpm -e snarelinux-supp
Remove Snare for Linux binary DEB package (if required).
Remove the Snare for Linux package
>dpkg -r snarelinux-supp

Audit configuration

The Snare configuration is stored as /etc/audit/snare.conf (SuSE 10 and 11 users the location is /etc/snare.conf). This file contains all the details required by Snare to configure the audit subsystem to successfully execute.
The configuration of /etc/audit/snare.conf can be changed either:

directly

Care should be taken if manually editing the snare.conf configuration file to ensure that it conforms to the required format for the audit daemon. Also, any use of the Remote Control Interface to modify security objectives or selected events, may result in manual configuration file changes being overwritten. Details on the configuration file format can be viewed in Appendix A - Configuration File Description. Failure to specify a correct configuration file will prevent Snare from running.

or by modifying the objectives via the Remote Control Interface

The Remote Control Interface is the most effective and simplest way to configure /etc/audit/snare.conf and operates completely in memory, with no reliance on any external files.

Remote Audit Monitoring
The Remote Control Interface can be turned off by editing the default /etc/audit/snare.conf file. You can either edit the /etc/audit/snare.conf file directly, commenting the allow=1 line under the [Remote] section, or by setting this value to 0.
Be sure to restart the agent for the change to take effect. The agent can be restarted by: >/etc/init.d/auditd restart

Note: For administrators, the system log files will be updated whenever settings are applied to the snare.conf, for example, /var/log/messages. This information may assist you when required.

Snare Solutions

Installing and running Snare Linux Agent

Snare installation

Audit configuration

Related pages