| Message ID | 20191105093202.4488-5-stefan.schantl@ipfire.org |
|---|---|
| State | Accepted |
| Commit | 961a27b5e2285da9953abf00b265fbb37e744c4a |
| Headers |
Return-Path: <development-bounces@lists.ipfire.org> Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 476kvx3Fv8z43Tf for <patchwork@web04.haj.ipfire.org>; Tue, 5 Nov 2019 09:32:13 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail02.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 476kvv4jYtz6Cy; Tue, 5 Nov 2019 09:32:11 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 476kvv2TVPz2yqy; Tue, 5 Nov 2019 09:32:11 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 476kvt1gsYz2xZd for <development@lists.ipfire.org>; Tue, 5 Nov 2019 09:32:10 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 476kvs4Jj6z639; Tue, 5 Nov 2019 09:32:09 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=201909ed25519; t=1572946329; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=OuZUDGgEMTPp5dRwBIQfKwIEOqAX+j0zVtk6FgoPVrI=; b=GtlIR3y0wuXHQxUMwFe3+JwCU0RBL9F15yU0jaT8ZzGvryTN8kL0SyFX6RZF8eR4kwxwUd f+Hq06+rRTsIWaDg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201909rsa; t=1572946329; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=OuZUDGgEMTPp5dRwBIQfKwIEOqAX+j0zVtk6FgoPVrI=; b=h0WWt5BUbeaTgvhzhzGWa5MEmGK7thjfDGe3GSB6vYLnY8ny7BPzUar4oZkTx1LMeVlQ4/ f3Ez12RVrpDQ1W+JBX0uTNmuuot9daF+R0Ezjnd4BhH0jC8LjpCjcWaoV0+pyn/+JrymlY OdQtGweXld7In8ShxxMDo9V3ie2xpYQ0qBCWHg1krABfPdgOBa0yQUBpBIGNg+MVpFciKi YM2MOZsqwUrr/WQZuoMBrUTmMHg5eLn36Jyr+BFSqFVG6LvQzTmC6p6mjAuamg1+SVLhlz t8m+q3sr/l2113PDY/NDC47eSN8pbfoEUiFg062Pj7aiBaztomLeBonb6Jp8RA== From: Stefan Schantl <stefan.schantl@ipfire.org> To: development@lists.ipfire.org Subject: [PATCH 5/5] suricata: Use DNS_SERVERS declaration from external file. Date: Tue, 5 Nov 2019 10:32:02 +0100 Message-Id: <20191105093202.4488-5-stefan.schantl@ipfire.org> In-Reply-To: <20191105093202.4488-1-stefan.schantl@ipfire.org> References: <20191105093202.4488-1-stefan.schantl@ipfire.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Authentication-Results: mail01.ipfire.org; auth=pass smtp.auth=stevee smtp.mailfrom=stefan.schantl@ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk <development.lists.ipfire.org> List-Unsubscribe: <https://lists.ipfire.org/mailman/options/development>, <mailto:development-request@lists.ipfire.org?subject=unsubscribe> List-Archive: <http://lists.ipfire.org/pipermail/development/> List-Post: <mailto:development@lists.ipfire.org> List-Help: <mailto:development-request@lists.ipfire.org?subject=help> List-Subscribe: <https://lists.ipfire.org/mailman/listinfo/development>, <mailto:development-request@lists.ipfire.org?subject=subscribe> Errors-To: development-bounces@lists.ipfire.org Sender: "Development" <development-bounces@lists.ipfire.org> |
| Series |
[1/5] ids-functions.pl: Introduce generate_dns_servers_file()
|
|
Commit Message
Stefan Schantl
Nov. 5, 2019, 9:32 a.m. UTC
These settings now will be read from
/var/ipfire/suricata/suricata-dns-servers.yaml, which will be
generated by the generate_dns_servers_file() function, located in
ids-functions.pl and called by various scripts.
Fixes #12166.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
config/suricata/suricata.yaml | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
Comments
Hi, Shouldn’t HOME_NET still be in DNS_SERVERS for users who are running a DNS server behind their firewall? > On 5 Nov 2019, at 09:32, Stefan Schantl <stefan.schantl@ipfire.org> wrote: > > These settings now will be read from > /var/ipfire/suricata/suricata-dns-servers.yaml, which will be > generated by the generate_dns_servers_file() function, located in > ids-functions.pl and called by various scripts. > > Fixes #12166. > > Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org> > --- > config/suricata/suricata.yaml | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml > index e921781cf..af9cb75a9 100644 > --- a/config/suricata/suricata.yaml > +++ b/config/suricata/suricata.yaml > @@ -11,12 +11,14 @@ vars: > # Include HOME_NET declaration from external file. > include: /var/ipfire/suricata/suricata-homenet.yaml > > + # Include DNS_SERVERS declaration from external file. > + include: /var/ipfire/suricata/suricata-dns-servers.yaml > + > EXTERNAL_NET: "any" > > HTTP_SERVERS: "$HOME_NET" > SMTP_SERVERS: "$HOME_NET" > SQL_SERVERS: "$HOME_NET" > - DNS_SERVERS: "$HOME_NET" > TELNET_SERVERS: "$HOME_NET" > AIM_SERVERS: "$EXTERNAL_NET" > DC_SERVERS: "$HOME_NET" > -- > 2.20.1 >
Hello Michael, > Hi, > > Shouldn’t HOME_NET still be in DNS_SERVERS for users who are running > a DNS server behind their firewall? set HOME_NET here would result in DNS related intrusion rules which will only match if DNS requests will be sent to a internal DNS server, which was the default in the past. The current approach is to set this value to the used DNS servers, or if unbound is used in recursor mode to every external address (!HOME_NET). Best regards, -Stefan > > > On 5 Nov 2019, at 09:32, Stefan Schantl <stefan.schantl@ipfire.org> > > wrote: > > > > These settings now will be read from > > /var/ipfire/suricata/suricata-dns-servers.yaml, which will be > > generated by the generate_dns_servers_file() function, located in > > ids-functions.pl and called by various scripts. > > > > Fixes #12166. > > > > Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org> > > --- > > config/suricata/suricata.yaml | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/config/suricata/suricata.yaml > > b/config/suricata/suricata.yaml > > index e921781cf..af9cb75a9 100644 > > --- a/config/suricata/suricata.yaml > > +++ b/config/suricata/suricata.yaml > > @@ -11,12 +11,14 @@ vars: > > # Include HOME_NET declaration from external file. > > include: /var/ipfire/suricata/suricata-homenet.yaml > > > > + # Include DNS_SERVERS declaration from external file. > > + include: /var/ipfire/suricata/suricata-dns-servers.yaml > > + > > EXTERNAL_NET: "any" > > > > HTTP_SERVERS: "$HOME_NET" > > SMTP_SERVERS: "$HOME_NET" > > SQL_SERVERS: "$HOME_NET" > > - DNS_SERVERS: "$HOME_NET" > > TELNET_SERVERS: "$HOME_NET" > > AIM_SERVERS: "$EXTERNAL_NET" > > DC_SERVERS: "$HOME_NET" > > -- > > 2.20.1 > >
Hello, > On 5 Nov 2019, at 12:45, Stefan Schantl <stefan.schantl@ipfire.org> wrote: > > Hello Michael, >> Hi, >> >> Shouldn’t HOME_NET still be in DNS_SERVERS for users who are running >> a DNS server behind their firewall? > > set HOME_NET here would result in DNS related intrusion rules which > will only match if DNS requests will be sent to a internal DNS server, > which was the default in the past. > > The current approach is to set this value to the used DNS servers, or > if unbound is used in recursor mode to every external address > (!HOME_NET). Yes, I know what the patch does. I was just asking about that this patch removes that DNS traffic will be scanned when it is coming from the Internet to a local DNS server in a local subnet. That worked before and I think it should continue to work. HOME_NET should be in DNS_SERVERS, *as well as* the resolvers that unbound is using. -Michael > > Best regards, > > -Stefan >> >>> On 5 Nov 2019, at 09:32, Stefan Schantl <stefan.schantl@ipfire.org> >>> wrote: >>> >>> These settings now will be read from >>> /var/ipfire/suricata/suricata-dns-servers.yaml, which will be >>> generated by the generate_dns_servers_file() function, located in >>> ids-functions.pl and called by various scripts. >>> >>> Fixes #12166. >>> >>> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org> >>> --- >>> config/suricata/suricata.yaml | 4 +++- >>> 1 file changed, 3 insertions(+), 1 deletion(-) >>> >>> diff --git a/config/suricata/suricata.yaml >>> b/config/suricata/suricata.yaml >>> index e921781cf..af9cb75a9 100644 >>> --- a/config/suricata/suricata.yaml >>> +++ b/config/suricata/suricata.yaml >>> @@ -11,12 +11,14 @@ vars: >>> # Include HOME_NET declaration from external file. >>> include: /var/ipfire/suricata/suricata-homenet.yaml >>> >>> + # Include DNS_SERVERS declaration from external file. >>> + include: /var/ipfire/suricata/suricata-dns-servers.yaml >>> + >>> EXTERNAL_NET: "any" >>> >>> HTTP_SERVERS: "$HOME_NET" >>> SMTP_SERVERS: "$HOME_NET" >>> SQL_SERVERS: "$HOME_NET" >>> - DNS_SERVERS: "$HOME_NET" >>> TELNET_SERVERS: "$HOME_NET" >>> AIM_SERVERS: "$EXTERNAL_NET" >>> DC_SERVERS: "$HOME_NET" >>> -- >>> 2.20.1 >>> >
diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index e921781cf..af9cb75a9 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -11,12 +11,14 @@ vars: # Include HOME_NET declaration from external file. include: /var/ipfire/suricata/suricata-homenet.yaml + # Include DNS_SERVERS declaration from external file. + include: /var/ipfire/suricata/suricata-dns-servers.yaml + EXTERNAL_NET: "any" HTTP_SERVERS: "$HOME_NET" SMTP_SERVERS: "$HOME_NET" SQL_SERVERS: "$HOME_NET" - DNS_SERVERS: "$HOME_NET" TELNET_SERVERS: "$HOME_NET" AIM_SERVERS: "$EXTERNAL_NET" DC_SERVERS: "$HOME_NET"