This is part two of a four part series on getting started with the Bro IDS. See part one on installing the Bro prerequisites. This post is about installing and preparing Bro.
Bro Compilation and Installation
Now that the prerequisites are taken care of, it is time to compile and install Bro. I downloaded Bro 2.5 IDS from bro.org and extracted it. After entering the directory, I ran
./configure --with-pfring=/usr/src/PF_RING --with-pcap=/opt/pf_ring-6.5.0 --prefix=/opt/bro
Below is the output from my ./configure command. It is okay to see failures on some of the lines since some items might not be needed for your system. If you followed this guide, you should see successful messages for GeoIP, gperftools, and PF_RING as highlighted in the output below. (Note, I skipped installing GeoIP so my message will show false below.)
-bash$ ./configure --with-pcap=/opt/pf_ring-6.6.0 --prefix=/opt/bro Build Directory : build Source Directory: /usr/src/bro-2.5 -- Found sed: /usr/bin/sed -- Found PythonInterp: /usr/bin/python (found version "2.7.5") -- Found FLEX: /usr/bin/flex (found version "2.5.37") -- Found BISON: /usr/bin/bison -- Found PCAP: /opt/pf_ring-6.6.0/lib/libpcap.so -- Performing Test PCAP_LINKS_SOLO -- Performing Test PCAP_LINKS_SOLO - Success -- Looking for pcap_get_pfring_id -- Looking for pcap_get_pfring_id - found -- Found OpenSSL: /usr/lib64/libssl.so;/usr/lib64/libcrypto.so (found version "1.0.1e") -- Performing Test ns_initparse_works_none -- Performing Test ns_initparse_works_none - Failed -- Performing Test res_mkquery_works_none -- Performing Test res_mkquery_works_none - Failed -- Performing Test ns_initparse_works_libresolv.a -- Performing Test ns_initparse_works_libresolv.a - Failed -- Performing Test res_mkquery_works_libresolv.a -- Performing Test res_mkquery_works_libresolv.a - Failed -- Performing Test ns_initparse_works_resolv -- Performing Test ns_initparse_works_resolv - Success -- Performing Test res_mkquery_works_resolv -- Performing Test res_mkquery_works_resolv - Success -- Found BIND: /usr/lib64/libresolv.so -- Found ZLIB: /usr/lib64/libz.so (found version "1.2.7") -- Check if the system is big endian -- Searching 16 bit integer -- Looking for sys/types.h -- Looking for sys/types.h - found -- Looking for stdint.h -- Looking for stdint.h - found -- Looking for stddef.h -- Looking for stddef.h - found -- Check size of unsigned short -- Check size of unsigned short - done -- Using unsigned short -- Check if the system is big endian - little endian -- Check size of unsigned int -- Check size of unsigned int - done ==================| BinPAC Build Summary |==================== Install prefix: Install skipped Debug mode: false CC: /bin/cc CFLAGS: -Wall -Wno-unused -O2 -g -DNDEBUG CXX: /bin/c++ CXXFLAGS: -Wall -Wno-unused -O2 -g -DNDEBUG CPP: /bin/c++ ================================================================ -- Found BinPAC: binpac -- Could NOT find LibGeoIP (missing: LibGeoIP_LIBRARY LibGeoIP_INCLUDE_DIR) -- Found GooglePerftools: /usr/lib64/libtcmalloc.so -- Found tcmalloc: /usr/lib64/libtcmalloc.so -- Check if the system is big endian -- Searching 16 bit integer -- Using unsigned short -- Check if the system is big endian - little endian -- Looking for htonll -- Looking for htonll - not found -- Check size of long int -- Check size of long int - done -- Check size of long long -- Check size of long long - done -- Check size of void * -- Check size of void * - done -- Check size of int32_t -- Check size of int32_t - done -- Check size of u_int32_t -- Check size of u_int32_t - done -- Check size of u_int16_t -- Check size of u_int16_t - done -- Check size of u_int8_t -- Check size of u_int8_t - done -- Check size of socklen_t -- Check size of socklen_t - done -- Check size of struct ip6_opt -- Check size of struct ip6_opt - done -- Check size of struct ip6_ext -- Check size of struct ip6_ext - done -- Looking for include file getopt.h -- Looking for include file getopt.h - found -- Looking for include file memory.h -- Looking for include file memory.h - found -- Looking for include file netinet/ether.h -- Looking for include file netinet/ether.h - found -- Looking for 4 include files sys/socket.h, ..., netinet/if_ether.h -- Looking for 4 include files sys/socket.h, ..., netinet/if_ether.h - found -- Looking for 4 include files sys/socket.h, ..., netinet/ip6.h -- Looking for 4 include files sys/socket.h, ..., netinet/ip6.h - found -- Looking for 3 include files sys/socket.h, ..., net/ethernet.h -- Looking for 3 include files sys/socket.h, ..., net/ethernet.h - found -- Looking for include file sys/ethernet.h -- Looking for include file sys/ethernet.h - not found -- Looking for include file net/ethertypes.h -- Looking for include file net/ethertypes.h - not found -- Looking for include file sys/time.h -- Looking for include file sys/time.h - found -- Looking for include files time.h, sys/time.h -- Looking for include files time.h, sys/time.h - found -- Looking for include file os-proto.h -- Looking for include file os-proto.h - not found -- Performing Test HAVE_READLINE_HISTORY_ENTRIES -- Performing Test HAVE_READLINE_HISTORY_ENTRIES - Failed -- Looking for include files stdio.h, readline/readline.h -- Looking for include files stdio.h, readline/readline.h - not found -- Looking for include files stdio.h, readline/history.h -- Looking for include files stdio.h, readline/history.h - not found -- Performing Test SIN_LEN -- Performing Test SIN_LEN - Failed -- Looking for IPPROTO_HOPOPTS -- Looking for IPPROTO_HOPOPTS - found -- Looking for IPPROTO_IPV6 -- Looking for IPPROTO_IPV6 - found -- Looking for IPPROTO_IPV4 -- Looking for IPPROTO_IPV4 - not found -- Looking for IPPROTO_ROUTING -- Looking for IPPROTO_ROUTING - found -- Looking for IPPROTO_FRAGMENT -- Looking for IPPROTO_FRAGMENT - found -- Looking for IPPROTO_ESP -- Looking for IPPROTO_ESP - found -- Looking for IPPROTO_AH -- Looking for IPPROTO_AH - found -- Looking for IPPROTO_ICMPV6 -- Looking for IPPROTO_ICMPV6 - found -- Looking for IPPROTO_NONE -- Looking for IPPROTO_NONE - found -- Looking for IPPROTO_DSTOPTS -- Looking for IPPROTO_DSTOPTS - found -- Looking for getopt_long -- Looking for getopt_long - found -- Looking for mallinfo -- Looking for mallinfo - found -- Looking for strcasestr -- Looking for strcasestr - found -- Looking for strerror -- Looking for strerror - found -- Looking for strsep -- Looking for strsep - found -- Looking for sigset -- Looking for sigset - found -- Performing Test DO_SOCK_DECL -- Performing Test DO_SOCK_DECL - Failed -- Performing Test SYSLOG_INT -- Performing Test SYSLOG_INT - Failed -- Looking for include file pcap-int.h -- Looking for include file pcap-int.h - not found -- Looking for pcap_freecode -- Looking for pcap_freecode - found -- Performing Test LIBPCAP_PCAP_COMPILE_NOPCAP_HAS_ERROR_PARAMETER -- Performing Test LIBPCAP_PCAP_COMPILE_NOPCAP_HAS_ERROR_PARAMETER - Failed -- Performing Test LIBPCAP_PCAP_COMPILE_NOPCAP_NO_ERROR_PARAMETER -- Performing Test LIBPCAP_PCAP_COMPILE_NOPCAP_NO_ERROR_PARAMETER - Success -- Looking for DLT_PPP_SERIAL -- Looking for DLT_PPP_SERIAL - found -- Performing Test including_ssl_h_works -- Performing Test including_ssl_h_works - Success -- Performing Test openssl_greater_than_0_9_7 -- Performing Test openssl_greater_than_0_9_7 - Success -- Performing Test OPENSSL_D2I_X509_USES_CONST_CHAR -- Performing Test OPENSSL_D2I_X509_USES_CONST_CHAR - Success -- Performing Test OPENSSL_CORRECT_VERSION_NUMBER -- Performing Test OPENSSL_CORRECT_VERSION_NUMBER - Success -- Performing Test have_nameser_header -- Performing Test have_nameser_header - Success -- Performing Test cxx11_header_works -- Performing Test cxx11_header_works - Success -- Looking for include file pthread.h -- Looking for include file pthread.h - found -- Looking for pthread_create -- Looking for pthread_create - not found -- Looking for pthread_create in pthreads -- Looking for pthread_create in pthreads - not found -- Looking for pthread_create in pthread -- Looking for pthread_create in pthread - found -- Found Threads: TRUE -- Found SWIG: /usr/bin/swig (found version "2.0.10") -- Found PythonDev: /usr/bin/python2.7-config ===============| PySubnetTree Build Summary |================= Install dir: /opt/bro/lib/broctl Debug mode: false CC: /bin/cc CFLAGS: -Wall -Wno-unused -O2 -g -DNDEBUG CXX: /bin/c++ CXXFLAGS: -Wall -Wno-unused -std=c++11 -O2 -g -DNDEBUG CPP: /bin/c++ ================================================================ =================| capstats Build Summary |=================== Install prefix: /opt/bro Debug mode: false CXX: /bin/c++ CXXFLAGS: -Wall -Wno-unused -std=c++11 -O2 -g -DNDEBUG CPP: /bin/c++ ================================================================ =============| trace-summary Install Summary |================ Install destination: /opt/bro/bin ================================================================ -- Found SubnetTree: build from source aux/pysubnettree =================| Broctl Install Summary |=================== Install prefix: /opt/bro Bro root: /opt/bro Scripts Dir: /opt/bro/share/bro Spool Dir: /opt/bro/spool Log Dir: /opt/bro/logs Config File Dir: /opt/bro/etc ================================================================ ==================| Bro-Aux Build Summary |=================== Install prefix: /opt/bro Debug mode: false CC: /bin/cc CFLAGS: -Wall -Wno-unused -O2 -g -DNDEBUG CXX: /bin/c++ CXXFLAGS: -Wall -Wno-unused -std=c++11 -O2 -g -DNDEBUG CPP: /bin/c++ ================================================================ -- Looking for geteuid -- Looking for geteuid - found -- Looking for getpwuid -- Looking for getpwuid - found -- Check size of uint -- Check size of uint - done -- Found Broccoli: broccoli ================| PyBroccoli Build Summary |================== Install dir: /opt/bro/lib/broctl Debug mode: false CC: /bin/cc CFLAGS: -Wall -Wno-unused -O2 -g -DNDEBUG CPP: /bin/cc ================================================================ -- Not building broccoli-ruby bindings =================| Broccoli Build Summary |=================== Install prefix: /opt/bro Library prefix: /opt/bro/lib Debug mode: false Shared libs: true Static libs: true Config file: /opt/bro/etc/broccoli.conf Packet support: true CC: /bin/cc CFLAGS: -Wall -Wno-unused -O2 -g -DNDEBUG CPP: /bin/cc ================================================================ ====================| Bro Build Summary |===================== Install prefix: /opt/bro Bro Script Path: /opt/bro/share/bro Debug mode: false CC: /bin/cc CFLAGS: -Wall -Wno-unused -O2 -g -DNDEBUG CXX: /bin/c++ CXXFLAGS: -Wall -Wno-unused -std=c++11 -O2 -g -DNDEBUG CPP: /bin/c++ Broker: false Broker Python: false Broccoli: true Broctl: true Aux. Tools: true GeoIP: false gperftools found: true tcmalloc: true debugging: false jemalloc: false ================================================================ -- Configuring done -- Generating done -- Build files have been written to: /usr/src/bro-2.5/build
Not that the configuration is complete, it’s time to compile and install. Compiling and installing both will take some time.
make make install
PF_Ring Bro Plugin Compilation and Installation
Now that Bro is compiled and installed, it’s time to compile and install a few Bro plugins. The PF_Ring plugin allows Bro to natively talk to PF_RING. Another plugin takes care of permission issues that may come up when a non-root user attempts to access the NIC.
Download the Bro plugins directory. See https://github.com/bro/bro-plugins/tree/master/pf_ring for reference. Compile and run the plugin by running
cd bro-plugins-master/pf_ring/ ./configure --bro-dist=/usr/src/bro-2.5 --with-pfring=/opt/pf_ring-6.5.0 make make install
Stdout of ./configure command is as follows:
[username@hostname pf_ring]# ./configure --with-pfring=/PathTo/PF_RING Build Directory : build Bro Source Directory : /PathTo/brotest/bro-2.5 -- Bro executable : /PathTo/brotest/bro-2.5/build/src/bro -- Bro source : /PathTo/brotest/bro-2.5 -- Bro build : /PathTo/brotest/bro-2.5/build -- Bro install prefix : /opt/bro -- Bro plugin directory: /opt/bro/lib/bro/plugins -- Bro debug mode : false -- Found PF_RING: /PathTo/PF_RING/userland/lib/libpfring.so -- PF_RING prefix : /PathTo/PF_RING -- Configuring done -- Generating done -- Build files have been written to: /PathTo/brotest/bro-2.5/aux/plugins/pf_ring/build
If the plugin install directory (as shown in the ./configure output) is incorrect, use –help flag to see options to configure it appropriately.
If you run into an error while running make, it may be due to an issue finding the right files in Bro. You may need to recompile the IDS (but don’t need to reinstall) then try again.
To verify the plugin installed correctly, navigate to the bro directory (/opt/bro in this case) and run:
./bro -N Bro::PF_RING
And you should see something like:
Bro::PF_RING – Packet acquisition via PF_RING (dynamic, version 1.0)
Broctl-setcap Plugin
It’s a good idea to run Bro as a separate user instead of an admin or root account. I suggest creating a user. You will then need to adjust file permissions to give him read/write/execute privileges to the directory Bro is installed in, in this case /opt/bro.
chown user:group -r /opt/bro
Whatever user that runs Bro needs elevated privileges to read directly off of the NIC. The Setcap plugin allows you to run Bro as a non-root user. More details about the reasoning behind the plugin can be found on an email at http://mailman.icsi.berkeley.edu/pipermail/bro/2017-February/011489.html
Or if you want, to go to https://github.com/PingTrip/broctl-setcap and follow the instructions there.
This completes part two of a four part series installing and configuring the Bro IDS.
Leave a Reply