search

joanbono / Snorter

Snort + Barnyard2 + Pulledpork → The easy way!
https://joanbono.github.io/Snorter
GNU General Public License v3.0
165 stars 32 forks source link

Docker image issue #21

Closed JaanusR closed 6 years ago

JaanusR commented 7 years ago

Hi! I try to use docker image but stuck with multiple problems:

  1. In Dockerfile ENV variables are not correcty defined OINCODE and INTERFACE needs value define. In case of empty value they should be defined like that ENV INTERFACE=
  2. I have to give additional persimission to Snorter.sh file in order to be able to run it RUN chmod 755 /opt/Snorter/src/Snorter.sh
  3. docker build SnorterDock -p 80:80 -e OINKCODE=<oinkcode> -e INTERFACE=<interface> doesn't work because build command doesnt recognice -p and -e options. Build arguments should be given by using option --build-arg. So the correct build command for me is: docker build snorter --build-arg INTERFACE=eth0
  4. After running build command im going to be stuck in endless loop which starts from the line 113 in Snorter.sh file, giving me a message

[!] WARNING: Unified2 output configured. Configure another output? 1 - CSV output 2 - TCPdump output 3 - CSV and TCPdump output 4 - None

Option [1-4]: [-] ERROR: Invalid option

These are my issues and findings. Maybe i configured it wrong to get this last issue, maybe you can help me :)

joanbono commented 7 years ago

Uops!

You're right: The README file is wrong.

You have to build and then run.

Please do the following:

git clone https://github.com/joanbono/Snorter
cd Snorter/src
docker build SnorterDock/
docker run SnorterDock -p 80:80 -e OINKCODE=<oinkcode> -e INTERFACE=<interface>

So, you pass the args with the run option instead of the build option.

Test it and let me know 😄

JaanusR commented 7 years ago

I still ending up in infinite loop. Wonder why is that happening? Shouldn't there be some kind of prompt or something?

JaanusR commented 7 years ago

And at least INTERFACe ENV variable should be passed on my command line otherwise build fail because of it runs Snorter.sh with this parameter and this is mandatory field.

joanbono commented 7 years ago

I'll take an eye on this in few days.

Stay tuned 😄

JaanusR commented 7 years ago

Im getting the feeling that this shell script doesn't work on latest kali linux. Im getting a lot of "command not found" errors.

joanbono commented 7 years ago

It's possible, maybe it's better to change the base distro to debian instead ?

JaanusR commented 7 years ago

worth to try :)

JaanusR commented 7 years ago

I just paste all the command issues here:

./src/Snorter.sh: line 57: sudo: command not found
./src/Snorter.sh: line 58: sudo: command not found
./src/Snorter.sh: line 62: sudo: command not found
./src/Snorter.sh: line 63: sudo: command not found
./src/Snorter.sh: line 80: sudo: command not found
./src/Snorter.sh: line 83: sudo: command not found
./src/Snorter.sh: line 103: sudo: command not found
./src/Snorter.sh: line 107: sudo: command not found
./src/Snorter.sh: line 108: /etc/snort/rules/local.rules: No such file or directory
./src/Snorter.sh: line 111: sudo: command not found
./src/Snorter.sh: line 119: sudo: command not found
./src/Snorter.sh: line 148: sudo: command not found
./src/Snorter.sh: line 154: killall: command not found
./src/Snorter.sh: line 194: autoreconf: command not found
./src/Snorter.sh: line 201: ./configure: No such file or directory
./src/Snorter.sh: line 208: make: command not found
./src/Snorter.sh: line 209: sudo: command not found
./src/Snorter.sh: line 226: mysql: command not found
./src/Snorter.sh: line 227: mysql: command not found
./src/Snorter.sh: line 228: mysql: command not found
./src/Snorter.sh: line 230: /etc/snort/barnyard2.conf: No such file or directory
./src/Snorter.sh: line 231: sudo: command not found
./src/Snorter.sh: line 232: sudo: command not found
./src/Snorter.sh: line 234: barnyard2: command not found
./src/Snorter.sh: line 265: sudo: command not found
./src/Snorter.sh: line 279: sudo: command not found
./src/Snorter.sh: line 280: sudo: command not found
./src/Snorter.sh: line 281: sudo: command not found
./src/Snorter.sh: line 283: sudo: command not found
./src/Snorter.sh: line 299: sudo: command not found
./src/Snorter.sh: line 314: sudo: command not found
./src/Snorter.sh: line 315: sudo: command not found
./src/Snorter.sh: line 316: sudo: command not found
./src/Snorter.sh: line 317: sudo: command not found
./src/Snorter.sh: line 318: sudo: command not found
./src/Snorter.sh: line 319: sudo: command not found
./src/Snorter.sh: line 320: sudo: command not found
./src/Snorter.sh: line 322: sudo: command not found
./src/Snorter.sh: line 344: sudo: command not found
./src/Snorter.sh: line 413: sudo: command not found
./src/Snorter.sh: line 356: sudo: command not found
./src/Snorter.sh: line 454: sudo: command not found
./src/Snorter.sh: line 490: /etc/snort/snort.conf: No such file or directory
ls: cannot access '/etc/snort/rules/emerging-*.rules': No such file or directory
./src/Snorter.sh: line 494: /etc/snort/snort.conf: No such file or directory
./src/Snorter.sh: line 495: sudo: command not found
./src/Snorter.sh: line 516: sudo: command not found

I tried debian base image

joanbono commented 7 years ago

Hi @JaanusR

Please, add this line to the DOCKERFILE (the RUN sed -i "s/sudo //g" /opt/Snorter/src/Snorter.sh) as follows


#Kali docker with SNORT + BARNYARD2 + PULLEDPORK
#Version 0.1.0
From debian:latest:latest
MAINTAINER Joan Bono <@joan_bono>

ENV OINKCODE
ENV INTERFACE

RUN apt-get update && apt-get upgrade -y && apt-get install -y git curl wget
RUN git clone https://github.com/joanbono/Snorter.git /opt/Snorter
RUN sed -i "s/sudo //g" /opt/Snorter/src/Snorter.sh
RUN /opt/Snorter/src/Snorter.sh -o ${OINKCODE} -i ${INTERFACE}
USER root
WORKDIR /opt/Snorter
JaanusR commented 7 years ago

Well that doesn't work, couple of reasons:

  1. ENV INTERFACE needs value to be defined. In case of empty value you should write ENV INTERFACE=
  2. There still is no persmission to run Snorter.sh
  3. Why do you want to run Snorter here? Shouldn't that be executed inside CMD like that: CMD ./src/Snorter.sh -i ${INTERFACE} -o ${OINKCODE}
joanbono commented 7 years ago

I'm sure you know more about Docker than me, so, if you solve this, feel free to open a Pull Request.

I'll add you to the credits in the README. I use this far ago with Kali docker, but I have not tested it anymore...

Would you like to be the maintainer? I'll be really pleased :)

Cheers

JaanusR commented 7 years ago

If i have time for this then surely i would like to fix these issues :)

joanbono commented 6 years ago

This is fixed in master branch

#Kali docker with SNORT + BARNYARD2 + PULLEDPORK
#Version 0.1.0
From debian:latest
MAINTAINER Joan Bono <@joan_bono>

ENV OINKCODE
ENV INTERFACE

RUN apt-get update && apt-get upgrade -y && apt-get install -y git curl wget
RUN git clone https://github.com/joanbono/Snorter.git /opt/Snorter
RUN sed -i "s/sudo //g" /opt/Snorter/src/Snorter.sh
RUN /opt/Snorter/src/Snorter.sh -o ${OINKCODE} -i ${INTERFACE}
USER root
WORKDIR /opt/Snorter