BotHunter Headless on ClearOS with TOR
- January 13th, 2011
- By كارما
- Write comment
I was inspired to play with BotHunter by this article: https://www.whataboutbob.org/public/?p=102
I’m not fond of running GUIs on firewalls (let alone virtual machines) and I’ve been writing about using TOR with ClearOS for an upcoming article so we will be building upon rstangarone’s article today. There is nothing stopping you from installing what you need to, say, tunnel X through SSH but that goes beyond the scope of this article.
You may wish to set this up in one of my pre-installed ClearOS Virtual Machines before implementing it on production systems: paravirtualized Xen, hardware emulators.
As put forward in the BotHunter documentation:
BotHunter is the first, and still the best, network-based malware infection diagnosis system out there. It tracks the two-way communication flows between your computer(s) and the Internet, comparing your network traffic against an abstract model of malware communication patterns. Its goal is to catch bots and other coordination-centric malware infesting your network, and it is exceptionally effective.
I hope their money is where their mouth is. Interestingly:
Optional: You are prompted to install Tor if it has not been installed previously. BotHunter may be configured to use Tor to interact anonymously with the BotHunter repository services.
BotHunter is based on what is described in the documentation as a heavily customized Snort implementation. I toyed for some time with the thought of unifying ClearOS’s Intrusion Prevention/Detection System implementation with it to conserve resources but ultimately decided time was better spent doing other things and swallowed the hit. You may feel differently however, if you succeed please drop me a line. The BotHunter installer will attempt to compile its Snort from source; ensure that the ClearOS build environment has been installed:
# yum install "Developer Tools"
Let’s find then install the latest version of TOR for ClearOS. You will first need libevent:
# yum install libevent
If you will be using the torify command you will need to install tsocks:
# rpm -iv ftp://ftp.univie.ac.at/systems/linux/dag/redhat/el5/en/i386/dag/RPMS/tsocks-1.8-7.beta5.2.el5.rf.i386.rpm
Now TOR (adjust for the latest version):
# rpm -iv http://deb.torproject.org/torproject.org/rpm/centos5/tor-0.2.1.28-tor.0.rh5_5.i386.rpm
Make TOR start on boot:
# chkconfig --level 2345 tor on
Tor is configured by default to listen to port 9050 on localhost. If you would like hosts on the private network to be able to route connections through this deployment you may add a second SocksListenAddress directive, set to your router’s LAN address in /etc/tor/torrc. Edit the /etc/tor/tor-tsocks.conf file on your client machines to route connections made via torify to the LAN address. Note that you should only do this for private addresses otherwise you may be opening an inadvertent public proxy.
Enable the control port by uncommenting this line in /etc/tor/torrc:
ControlPort 9051
Run this command, replacing password with the password you would like to use for the controller:
tor --hash-password password
Ignore the warning about running TOR as root; the init script has been configured by the RPM to use a non-privileged account. Uncomment and change the HashedControlPassword to the output you were provided. Start TOR:
# /etc/init.d/tor start
Before we install BotHunter we must provide ClearOS with a java environment:
# yum install java
Now let’s download the latest version of BotHunter. We’ll be following the installation instructions available at http://www.bothunter.net/doc/users_guide-UNIX.html. Go to http://www.bothunter.net/download.html and fill out the form to get your download link.
# wget {your download link}
# tar zxf {your filename}
# cd BotHunter/
Here’s the README that came with mine:
[root@router BotHunter]# cat README.txt
BotHunter(*) Internet Release
www.bothunter.net
Unix Version 1.5.0
February 25, 2010
* HARDWARE RECOMMENDATIONS
Your system should have a modern Intel Pentium-class or
Motorola PowerPC processor, at least 1 GB RAM, and at least
1 Ethernet NIC/WIC for network monitoring.
* OS AND SOFTWARE REQUIREMENTS
BotHunter is available for use on the following operating
systems:
Linux: tested on Fedora, Red Hat Enterprise Linux, Debian,
and SuSE distributions
FreeBSD: tested on Product Release 7.0
MacOS 10: tested on Tiger and Leopard, Mac OS 10.4 and 10.5
BotHunter requires a Sun-compatible Java Runtime Environment
(JRE) Release 1.5 or later.
Linux: the Linux distribution of Sun's Java JRE is available at
http://java.sun.com/javase/downloads/index.jsp
Mac OS: for Mac OS X, Xcode must be installed on your system;
it may be obtained from
http://developer.apple.com/tools/xcode/
FreeBSD: for installing a recent version of Java, we recommend
that you consult
http://www.freebsd.org/java/
* NETWORK REQUIREMENTS
Installation requires Internet connectivity for downloading the
necessary libraries, packages, and BotHunter ruleset updates.
Your target platform should have a promiscuous mode tap, such as
a span port or access to broadcast LAN traffic. Ideally, your
machine should be attached to a monitoring position on an internal
network egress point to observe successful connection flows (e.g.,
behind the firewall) between your internal hosts and external
entities.
* INSTALLATION
The following is a summary of the minimum steps necessary to install,
configure, and start BotHunter, in its default configuration for live
traffic monitoring. This installation procedure should be performed
by the root user. You will also need to know the IP address netmask
of the network you wish to protect, and the IP addresses of your
email and DNS servers.
BotHunter's installation process will NOT upgrade a previous
installation. If you have a previous installation of BotHunter, you
should remove the previous user installation or install BotHunter
into a different user account.
While installation requires root privilege, BotHunter does not
require root privilege to run. Instead, this installation creates
a nonprivileged user account that runs BotHunter.
Note: you may type '?' at any prompt for a detailed explanation of
what is expected.
1. Untar the BotHunter Unix distribution.
2. Begin the root installation procedure.
root% java -jar botHunterInstall.jar
Read the EULA and if acceptable click YES.
3. Confirm that you wish to perform this root install.
4. Optional: You are prompted to install Tor if it has not been
installed previously. BotHunter may be configured to use Tor
to interact anonymously with the BotHunter repository services.
5. Indicate the new nonprivileged user account with which you wish
to install BotHunter (default user account = cta-bh). BotHunter
will then install dependent packages. If you choose to install
BotHunter over a preexisting user account, this account must
use csh(1).
6. Enter your Trusted Network Mask: Provide a (comma separated)
local network mask list, plus the IP addresses of all external
NetBIOS shares with which your internal machines are allowed to
communicate.
example: 192.168.1.0/24,10.10.0.10/16
7. Enter the (comma separated) IP addresses of the email server(s)
used by systems inside your network.
8. Enter the (comma separated) list of DNS servers used by systems
inside your network.
9. Enter your network interface that BotHunter will use to monitor
your network.
10. Indicate whether you wish BotHunter to start automatically on
reboot.
11. Optional: As a last step, you may now set user cta-bh's password:
root% /usr/bin/passwd cta-bh
12. su to the user account that you created during the BotHunter
installation:
root% su -l cta-bh
14. To set up BotHunter in its default configuration (LIVEPIPE
mode), use the BotHunter shell alias:
cta-bh% BotHunter
* CONFIGURING AND OPERATING BOTHUNTER
You are now ready to configure and operate BotHunter. Please read
the BotHunter Unix User's Guide, available at
http://www.bothunter.net/doc/users_guide-UNIX.html
for details on how to configure and operate BotHunter.
The User Guide is also available under the doc directory of this
installation package.
* GOOD LUCK
Thank you for your interest and support.
BotHunter Developers: Phillip Porras, Martin Fong, Keith Skinner,
Steven Dawson, Vinod Yegneswaran, Guofei Gu.
----------------------------------------------------------------------
(*) BotHunter is a U.S. Registered Trademark of
SRI International, 333 Ravenswood Ave., Menlo Park, CA 94025
We’ll need to make a non-privileged user account and working directory for BotHunter to run under.
# mkdir /opt/bh # useradd -d /opt/bh -s /sbin/nologin -r bh # chown bh: /opt/bh
Now run the installer:
java -jar botHunterInstall.jar
If you chose not to start BotHunter automatically at the end of the installation procedure run:
# /etc/init.d/zzzBotHunter_bh start
Check on the status of BotHunter:
# cd /opt/bh/BotHunter/LIVEPIPE_CONFIG # sudo -u bh java -jar ../botHunterInstall.jar status
Note that the paths must be the same as used above. You will only be able to query the daemon if you connect to it as the user it is running under.
[root@router LIVEPIPE_CONFIG]# sudo -u bh java -jar ../botHunterInstall.jar status Issuing net query signal. CTA BotHunter 1.5.0 status #2 as of 2011/01/13 18:42:46 EST Process elapsed time: 0 00:08:12 Memory usage: 43880 Kbytes Input events read: 2 Input events parsed: 2 Local text BotHunter profiles: 1 NetQuery requests made: 2 NetQuery responses received: 1 Repository messages queued: 1 Messages sent to repository: 2 Sensor connected to repository: true Most recently seen author ID: *********** Most recently seen observer ID: ******** CTA BotHunter: Process is active.
Now let’s add an alias to our ~/.bashrc:
alias cwdBotHunter='sudo -u bh java -Xmx104m -jar /opt/bh/BotHunter/botHunterInstall.jar' alias BotHunter='cd /opt/bh/BotHunter/LIVEPIPE_CONFIG; cwdBotHunter'
Start a new bash instance (log out/log in or run ‘bash’). You should now be able to run
BotHunter status
as root from any location.
I want e-mail notifications so let’s open /opt/bh/BotHunter/LIVEPIPE_CONFIG/CTA_BotHunter/CTA_BotHunter.config and add these lines:
# ---------------------------------------------------------------------- # e-mail parameters mailTo=your@email.com mailHost=xxx.xxx.xxx.xxx mailFrom=bothunter@fibre.whatever.commailSubject=BotHunter Profile %m(score) %df(yyyyMMdd_HHmmssSSS) mailSubjSubs=true
Save the file then restart BotHunter to apply your changes:
# /etc/init.d/zzzBotHunter_bh restart
That’s all, folks!
