Security Onion LiveCD
Doug Burks
http://securityonion.blogspot.com
What is it?
The Security Onion LiveCD is a bootable CD that contains software used for installing, configuring, and testing Intrusion Detection Systems.
What software does it contain?
The Security Onion LiveCD is based on Xubuntu 9.04 and contains Snort 2.8.4.1, Snort 3.0.0b3 (Beta), sguil, idswakeup, nmap, metasploit, scapy, hping, fragroute, fragrouter, netcat, paketto, tcpreplay, and many other security tools.
What can it be used for?
* The Security Onion LiveCD can be used for Intrusion Detection. Simply boot the CD and double-click either the Snort-Sguil or SnortSP-Sguil desktop shortcuts. The Snort and Sguil daemons will then start, listening on eth0 for any suspicious traffic and creating alerts in the Sguil console.
* The Security Onion LiveCD can be used to test an Intrusion Detection System. Simply boot the CD and use the included tools (such as nmap, metasploit, idswakeup, scapy, hping, and others) to test your existing IDS or to test the included Snort 2.8.4.1 and Snort 3.0 Beta 3.
* The Security Onion LiveCD can be used to install an Intrusion Detection System. Simply boot the CD and double-click the Install desktop shortcut. For more information about installation, please see the "Installing to Hard Drive" section below.
You can read more about the Security Onion LiveCD (and, specifically, the integration of Snort 3.0 and Sguil) in my SANS GCIA Gold Paper "Snort 3.0 Beta 3 for Analysts".
System Requirements
512MB RAM is a minimum. 1GB or more is recommended.
Sguil
When launching Snort-Sguil or SnortSP-Sguil from the Desktop, you are prompted to login to Sguil. Here are the credentials:
Username: sguil
Password: password
NOTE! It's "sguil" with a 'g', NOT a 'q'!
Installing to Hard Drive
You can use the Install shortcut on the Desktop to install Security Onion to your hard drive. Once you've completed the installation process and have rebooted into your new installation, login with the following credentials:
Username: securityonion
Password: securityonion
Post-installation checklist:
* Create a new user account for yourself.
* Remove the securityonion user account.
* Install any available Ubuntu updates.
* Update the Snort rules (manually or using the included oinkmaster or pulledpork).
Changelog
2009/07/31: New Release!
* All Xubuntu 9.04 updates as of 2009/07/31.
* Added sqlite and libsqlite3-ruby packages for db_autopwn.
* Added fwbuilder.
* Latest Metasploit msf v3.3-dev as of 2009/07/31.
* Latest Nmap 5.05BETA1 as of 2009/07/31.
2009/07/24: New Release!
* All Xubuntu 9.04 updates as of 2009/07/24.
* Added a Security Onion section to the Applications menu.
* Latest Metasploit msf v3.3-dev as of 2009/07/24.
* Latest Nmap as of 2009/07/24.
2009/06/13: New Release!
* All Xubuntu 9.04 updates as of 2009/06/13.
* Added JJ Cummings's pulledpork as an alternative to oinkmaster.
* Added Leon Ward's dumbpig for checking custom Snort rules.
* Added Bro IDS for Marcus J Carey.
2009/06/01: New Release!
* All Xubuntu 9.04 updates as of 2009/06/01.
* Upgraded NSMnow to 1.4.1, which upgraded Barnyard2 to 1.5.
2009/05/26: New Release!
* Upgraded to Xubuntu 9.04 (and all patches as of 2009/05/26).
* Upgraded nmap to 4.85BETA9.
* Added ssdeep.
2009/04/26: New Release!
* All Xubuntu 8.04 updates as of 2009/04/26.
* NSMnow 1.40
* Snort 2.8.4
* Barnyard2-1.4
* ifenslave
* vncviewer
* ghex2
2009/04/03: New Release!
* All Xubuntu 8.04 updates as of 2009/04/03.
* Upgraded SnortSP to the new Beta 3 version.
* Added perl-tk so that Bastille can run in GUI mode.
* Created filesystem symlinks for md5 and sha256 to allow NSM-Console's hash functions to work properly.
2009/03/06: New Release!
* All Xubuntu 8.04 updates as of 2009/03/06 (including Firefox 3.0.7).
* Upgraded NSMnow to version 1.3.5, which upgraded barnyard2 to version 1.3.
* Added to README file.
2009/03/02: New Release!
* All Xubuntu 8.04 updates as of 2009/03/02.
* Added ptunnel, httptunnel, and udptunnel.
* Added to README file.
2009/02/20: New Release!
* All Xubuntu 8.04 updates as of 2009/02/20.
* Added README file on Desktop.
* Changed Firefox home page and added bookmarks.
2009/02/15: New Release!
* All Xubuntu 8.04 updates as of 2009/02/15.
* Added oinkmaster.
2009/02/09: New Release!
* All Xubuntu 8.04 updates as of 2009/02/09.
* Added SnortSP/Sguil integration.
Packet Tools:
bastille
cheops-ng
corkscrew
daemonlogger
doscan
dsniff
etherape
fragroute
fragrouter
honeyd
hping2
hping3
httptunnel
hunt
idswakeup
iperf
ipgrab
iptraf
knocker
labrea
lanmap
ndiff
nemesis
netcat
netcat6
netcat-openbsd
netcat-traditional
netdiscover
netdude
netrw
netsed
ngrep
nmap
nsm-console
nwatch
p0f
pads
paketto
pbnj
pcaputils
pnscan
potion
psad
ptunnel
python-scapy
scanssh
scapy
sendip
socat
ssldump
tcpflow
tcpick
tcpreplay
tcpslice
tcpspy
tcpstat
tcptrace
tcpxtract
tshark
udptunnel
wireshark
xprobe
yersinia
zenmap