Appendix B: A Complete fwsnort Script
The fwsnort project creates a shell script that automates the execution of the iptables commands necessary to create an iptables policy that is capable of detecting application layer attacks. Appendix B contains a complete example of an fwsnort.sh script generated by fwsnort. You can download this script here, and it is reproduced below for reference as well:#!/bin/sh # ############################################################################ # # File: /etc/fwsnort/fwsnort.sh # # Purpose: This script was auto-generated by fwsnort, and implements # an iptables ruleset based upon Snort rules. For more # information see the fwsnort man page or the documentation # available at http://www.cipherdyne.org/fwsnort/ # # Generated with: fwsnort --snort-sid 1332,1336,1338,1339,1341,1342,1360 # Generated on host: isengard # Time stamp: Tue Sep 18 19:46:56 2007 # # Author: Michael Rash <mbr@cipherdyne.org> # # Version: 1.0.2 (file revision: 400) # ############################################################################ # #==================== config ==================== ECHO=/bin/echo IPTABLES=/sbin/iptables #================== end config ================== ### ############ Create fwsnort iptables chains. ############ ### $IPTABLES -N FWSNORT_FORWARD 2> /dev/null $IPTABLES -F FWSNORT_FORWARD $IPTABLES -N FWSNORT_FORWARD_ESTAB 2> /dev/null $IPTABLES -F FWSNORT_FORWARD_ESTAB $IPTABLES -N FWSNORT_INPUT 2> /dev/null $IPTABLES -F FWSNORT_INPUT $IPTABLES -N FWSNORT_INPUT_ESTAB 2> /dev/null $IPTABLES -F FWSNORT_INPUT_ESTAB $IPTABLES -N FWSNORT_OUTPUT 2> /dev/null $IPTABLES -F FWSNORT_OUTPUT $IPTABLES -N FWSNORT_OUTPUT_ESTAB 2> /dev/null $IPTABLES -F FWSNORT_OUTPUT_ESTAB ### ############ Inspect ESTABLISHED tcp connections. ############ ### $IPTABLES -A FWSNORT_FORWARD -p tcp -m state --state ESTABLISHED -j FWSNORT_FORWARD_ESTAB $IPTABLES -A FWSNORT_INPUT -p tcp -m state --state ESTABLISHED -j FWSNORT_INPUT_ESTAB $IPTABLES -A FWSNORT_OUTPUT -p tcp -m state --state ESTABLISHED -j FWSNORT_OUTPUT_ESTAB ### ############ web-attacks.rules ############ ### $ECHO "[+] Adding web-attacks rules." ### alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS /usr/bin/id \ command attempt"; flow:to_server,established; content:"/usr/bin/id"; nocase; \ classtype:web-application-attack; sid:1332; rev:5;) $IPTABLES -A FWSNORT_FORWARD_ESTAB -p tcp --dport 80 -m string --string "/usr/bin/id" \ --algo bm -m comment --comment "sid:1332; msg:WEB-ATTACKS /usr/bin/id command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[1] SID1332 ESTAB " $IPTABLES -A FWSNORT_INPUT_ESTAB -p tcp --dport 80 -m string --string "/usr/bin/id" \ --algo bm -m comment --comment "sid:1332; msg:WEB-ATTACKS /usr/bin/id command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[1] SID1332 ESTAB " ### alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS chmod \ command attempt"; flow:to_server,established; content:"/bin/chmod"; nocase; \ classtype:web-application-attack; sid:1336; rev:5;) $IPTABLES -A FWSNORT_FORWARD_ESTAB -p tcp --dport 80 -m string --string "/bin/chmod" \ --algo bm -m comment --comment "sid:1336; msg:WEB-ATTACKS chmod command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[2] SID1336 ESTAB " $IPTABLES -A FWSNORT_INPUT_ESTAB -p tcp --dport 80 -m string --string "/bin/chmod" \ --algo bm -m comment --comment "sid:1336; msg:WEB-ATTACKS chmod command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[2] SID1336 ESTAB " ### alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS chown \ command attempt"; flow:to_server,established; content:"/chown"; nocase; \ classtype:web-application-attack; sid:1338; rev:6;) $IPTABLES -A FWSNORT_FORWARD_ESTAB -p tcp --dport 80 -m string --string "/chown" \ --algo bm -m comment --comment "sid:1338; msg:WEB-ATTACKS chown command attempt; \ classtype:web-application-attack; rev:6; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[3] SID1338 ESTAB " $IPTABLES -A FWSNORT_INPUT_ESTAB -p tcp --dport 80 -m string --string "/chown" \ --algo bm -m comment --comment "sid:1338; msg:WEB-ATTACKS chown command attempt; \ classtype:web-application-attack; rev:6; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[3] SID1338 ESTAB " ### alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS chsh command \ attempt"; flow:to_server,established; content:"/usr/bin/chsh"; nocase; \ classtype:web-application-attack; sid:1339; rev:5;) $IPTABLES -A FWSNORT_FORWARD_ESTAB -p tcp --dport 80 -m string --string "/usr/bin/chsh" \ --algo bm -m comment --comment "sid:1339; msg:WEB-ATTACKS chsh command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[4] SID1339 ESTAB " $IPTABLES -A FWSNORT_INPUT_ESTAB -p tcp --dport 80 -m string --string "/usr/bin/chsh" \ --algo bm -m comment --comment "sid:1339; msg:WEB-ATTACKS chsh command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[4] SID1339 ESTAB " ### alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS \ /usr/bin/gcc command attempt"; flow:to_server,established; content:"/usr/bin/gcc"; \ nocase; classtype:web-application-attack; sid:1341; rev:5;) $IPTABLES -A FWSNORT_FORWARD_ESTAB -p tcp --dport 80 -m string --string "/usr/bin/gcc" \ --algo bm -m comment --comment "sid:1341; msg:WEB-ATTACKS /usr/bin/gcc command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[5] SID1341 ESTAB " $IPTABLES -A FWSNORT_INPUT_ESTAB -p tcp --dport 80 -m string --string "/usr/bin/gcc" \ --algo bm -m comment --comment "sid:1341; msg:WEB-ATTACKS /usr/bin/gcc command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[5] SID1341 ESTAB " ### alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS gcc \ command attempt"; flow:to_server,established; content:"gcc%20-o"; nocase; \ classtype:web-application-attack; sid:1342; rev:5;) $IPTABLES -A FWSNORT_FORWARD_ESTAB -p tcp --dport 80 -m string --string "gcc%20-o" \ --algo bm -m comment --comment "sid:1342; msg:WEB-ATTACKS gcc command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[6] SID1342 ESTAB " $IPTABLES -A FWSNORT_INPUT_ESTAB -p tcp --dport 80 -m string --string "gcc%20-o" \ --algo bm -m comment --comment "sid:1342; msg:WEB-ATTACKS gcc command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[6] SID1342 ESTAB " ### alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS netcat \ command attempt"; flow:to_server,established; content:"nc%20"; nocase; \ classtype:web-application-attack; sid:1360; rev:5;) $IPTABLES -A FWSNORT_FORWARD_ESTAB -p tcp --dport 80 -m string --string "nc%20" \ --algo bm -m comment --comment "sid:1360; msg:WEB-ATTACKS netcat command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[7] SID1360 ESTAB " $IPTABLES -A FWSNORT_INPUT_ESTAB -p tcp --dport 80 -m string --string "nc%20" \ --algo bm -m comment --comment "sid:1360; msg:WEB-ATTACKS netcat command attempt; \ classtype:web-application-attack; rev:5; FWS:1.0.2;" -j LOG --log-ip-options \ --log-tcp-options --log-prefix "[7] SID1360 ESTAB " $ECHO " Rules added: 14" ### ############ Jump traffic to the fwsnort chains. ############ ### $IPTABLES -D FORWARD -i ! lo -j FWSNORT_FORWARD 2> /dev/null $IPTABLES -I FORWARD 1 -i ! lo -j FWSNORT_FORWARD $IPTABLES -D INPUT -i ! lo -j FWSNORT_INPUT 2> /dev/null $IPTABLES -I INPUT 1 -i ! lo -j FWSNORT_INPUT $IPTABLES -D OUTPUT -o ! lo -j FWSNORT_OUTPUT 2> /dev/null $IPTABLES -I OUTPUT 1 -o ! lo -j FWSNORT_OUTPUT $ECHO "[+] Finished." ### EOF ###
