Snare Agent for Linux

SNARE is divided into three key components:

In order to collect event log data, Snare needs to add auditing support into the operating system. You can choose to either install a binary version of the kernel, with Snare already integrated, or you can apply a 'patch' to your kernel source.

Although we try hard to make Snare as easy to install as possible, there are hundreds of different distributions and kernel versions, and it would be an immense task to build Snare for each variant. We are hoping that recent efforts towards creating a native auditing subsystem for linux will soon mean that the kernel component of the Snare for Linux agent, will no longer be required.

The Snare Audit Daemon

The Snare audit daemon acts as an interface between the Linux kernel, and the security administrator. It allow you to turn on events, filter the output, and potentially push audit log information back to a central location for collection, analysis and archival.

The Snare Micro-Web Server

The Snare Micro-Web Server, is embedded in the audit daemon, and provides a very simple configuration capability that can be managed from your web browser.

To enable the micro-web server, please add the following to your /etc/audit/snare.conf file, and restart snare (/etc/init.d/snare restart):

[Remote]
        allow=1
        listen_port=6161

We recommend that you configure a password for the remote control capability the first time you connect.

The Sourceforge development website shows support for the open source development community by providing SNARE with a home away from home, and Snare support forums.
Jonathan Abbey, of Applied Research Laboratories, University of Texas, Austin has been working hard on optimising the Snare audit daemon, and has succeeded in an order-of-magnitude speedup in audit objective matching and reporting. Jonathan's changes will be making an appearance in Snare 0.9.6. The University of Texas also greatly assist the Snare project by building and distributing binary kernel RPMs for key Redhat systems.
Aaron Laffin, of Silicon Graphics Inc. has integrated Snare into the SGI Altix series of products, and in doing so, has provided a series of additions to the Snare Kernel that have contributed significantly to performance and stability.
Eric Malkowski has contributed some great work coming up with the changes required to get Snare working on Debian Sarge, including creating kernel patches, binaries for the audit daemon, and the creation of kernel binary packages.
Mark Westerman of Westcam, Inc has been doing some great things with the in-kernel components of Snare, adding the code to make better use of kernel memory, and ferreting out SMP problems, amongst other significant improvements.

Documentation

Documentation on SNARE is incorporated within the packages above, and is also available from our Resources page.

If you would like to utilise the Snare PATCH file for development purposes, or to build your own kernel, basic instructions are available here.

Having trouble building third party modules (such as video drivers) with Snare? Try installing the kernel-devel RPM from your Redhat/Fedora CDs (Thanks to Bill Gressett of Lockheed).

Jonathan Abbey has written some fantastic guidelines on how to build a Redhat kernel, that includes Snare: Redhat Kernel building instructions

InterSect provides commercial Snare Agent support for our Snare Server customers, but we're always happy to help out via the Snare Sourceforge Forum.