yang123vc / s2ipt Goto Github PK

#s2ipt IDS/IPS

The Team:

• Luigi Pino (University of Sannio BN IT)
  
• Luciano Ocone (University of Sannio BN IT)
  
• Alessandro Esposito (University of Sannio BN IT)
  
• Team Leader: Ing. Antonio Pirozzi (University of Sannio BN IT)
  
• Supervisor: Prof. Aaron C. Visaggio (University of Sannio BN IT)
  

First of all, you have to run './install.sh' script to set up the environment for s2ipt, as superuser.

# ./install.sh

If your system doesn't recognize the script as executable, run 'chmod +x install.sh' and then retry.

# chmod +x install.sh

This command will also download the latest Snort community-rules files.
If the download fails for some reasons, you have to run this script again with '-d' option.

# ./install.sh -d

Now, you can run this tool just invoking 's2ipt' as superuser, with '--log', '--drop', '--reject' or '--revert' option, also specifying the interface to apply the iptables rules.

Example of usage:

# s2ipt --iface eth0 --log

When using '--log', '--drop' or '--reject', is mandatory to provide a network interface.
In order to restore the iptables backup created before 's2ipt' execution, use '--revert'.

# s2ipt --revert

You can also run 's2ipt' only specifying the interface, assuming '--log' as default.

For more information run 's2ipt --help'.

# s2ipt --help

The 's2ipt-daemon.sh' is an utility that automatically checks for most recent Snort community-rules according to the interval set in 'daemon/s2ipt-update.config' file.