Installing an Apache2 Web Server logging events to a MySQL Database

Introduction

Take Note: Winsnort has phased out support for the 32bit architecture.

During my research and development for the past 20 plus years I've found a lot of tutorials, including blogs describing the installation process for the UNIX environment, but nothing specifically detailed for setting up an intrusion detection system in a Windows environment.

These tutorials gives all the basic instructions on how to create a complete and all inclusive standalone Windows Intrusion Detection System (WinIDS), including remote sensors. This is all made possible by simply wrapping Snort, a very powerful Intrusion Detection Engine into a multitude of free open source programs. Best of all, other than the cost of the Windows operating system, it's completely free.

The goal of these tutorials was not just to create a Windows Intrusion Detection System (WinIDS) using the most advanced intrusion detection engine known as Snort, but to understand how all the parts work together and to get a deeper understanding of all the components so that troubleshooting and modifying the Windows Intrusion Detection System (WinIDS) can be completed with confidence.

If there are any doubts which tutorial should be used, there is a posted topic HERE that will provide the basics so an informed decision can be made based on which combination of software packages are best suited for the installation.

Copyright Notice

This document is Copyright © 2003-2025 Michael Steele. All rights reserved. Permission to distribute this document is hereby granted providing that distribution is electronic, in it's original form, no money is involved and this copyright notice is maintained. Other requests for distribution will be considered.

Use the information in this document at your own risk. Michael Steele disavows any potential liability of this document. Use of the concepts, examples and/or other content of this document are entirely at your own risk.

This tutorial is written in the hope that it will be useful, but without any warranty; without even the implied warranty of merchantability or fitness for a particular purpose.

All copyrights are owned by their owners, unless specifically noted otherwise. Third party trademarks or brand names are the property of their owners. Use of a term in this document should not be regarded as affecting the validity of any trademark or service mark. Naming of particular products or brands should not be seen as endorsements.

Get Support

All general support questions related to a specific tutorial MUST be directed to the specific forum for that particular tutorial. If there is any confusion just click on the 'Get Community Support' button at the top of each tutorial to get transported to the correct forum!

There is a Client Only Lounge where all advanced questions/problems should be posted not related to the general installation of any of the tutorials.

By request, there is a premium fee service available for one on one support, including remote installs.

This is a basic Windows Intrusion Detection System (WinIDS) deployment

• Microsoft's Windows operating systems are used exclusively for these tutorials.

Major support programs used in this install

• Npcap allows 3rd party applications such as Snort to capture and transmit network packets bypassing the protocol stack.
• Snort performs real-time traffic analysis and network packet logging on Internet Protocol (IP) networks data streams.
• Barnyard2 is a dedicated spooler for Snort's unified2 binary output format and on-forwarding to a MySQL database.
• Pulledpork automates the rule updating process.
• Strawberry Perl is everything needed to run perl scripts (.pl) and applications such as PulledPork.
• ADOdb allows the same code to be used when accessing a wide range of databases.
• MySQL-driven database stores processed events from Barnyard2 for analysis.
• Apache2 will drive the web based Windows Intrusion Detection Systems (WinIDS) GUI security console.
• BASE serves as the Windows Intrusion Detection Systems (WinIDS) web based GUI security console.
• NSSM is the Non-Sucking Service Manager used to start Barnyard2 as a service.

How this Hardware and Software was prepped for this Windows Intrusion Detection System (WinIDS) tutorial

• A fresh install of any version of Windows listed above is highly recommended.
• All available Service Packs and updates MUST be applied from the Microsoft Download Center.
• For this tutorial there are two disks: C:/ (Disk1 - System) with 300GB and D:/ (Disk2 - WinIDS) with 1TB.
• Installed memory should be no less than 4GB (more is always better).

Downloading and extracting the core Windows Intrusion Detection Systems (WinIDS) Software Support Pack

Download the 'WinIDS - Core Software Support Pack'.

Open File Explore and navigate to the location of the 'winids-core.zip' file, right-click the 'winids-core.zip' file, highlight and left-click 'Extract all...', in the 'Files will be extracted to this folder:' dialog box type 'd:\temp' (less the outside quotes), left-click and uncheck the 'Show extracted files when complete' radio box, left-click extract, in the 'Password:' dialog box type 'w1nsn03t.c0m' (less the outside quotes), left-click 'OK' and eXit File Explorer.

Downloading additional and required support files for this tutorial

npcap-1.86: Download and save the file to the d:\temp folder.

Snort 2.9.20: Download and save the file to the d:\temp folder.

snortrules-snapshot-29200: Download and save the file to the d:\temp folder.

Pulledpork 8.0: Download and save the file to the d:\temp folder.

Strawberry Perl 5.42.0.1: Download and save the file to the d:\temp folder.

Apache2 2.4.66 (VS18): Download and save the file to the d:\temp folder.

Apache2 FastCGI module 2.3.10 (VS18): Download and save the file to the d:\temp folder.

MySQL Database 8.0.44.0: Download and save the file to the d:\temp folder.

PHP 8.5.1 TS (VS17): Download and save the file to the d:\temp folder.

ADOdb 5.22.11: Download and save the file to the d:\temp folder.

nssm 2.24: Download and save the file to the d:\temp folder.

Installing the Modder files

The modder file preforms several tasks:

• Disables Universal Access Control (UAC)
• Installs Microsoft Visual C++ x86/x64 (VS18) 2017-2026
• Installs Notepad2
• Installs scripts and Tools
• Installs 7zip
• Inserts 'winids' hostname into hosts file
• Inserts 'IGMP and SCTP' into the protocol file for Snort rules
• Inserts 'Nodosfilewarning' into User ENV to suppress CYGWIN warning message when starting Barnyard2
• Exclude '.rules' in Defender (seen as a virus)
• Sets TCP/IPv4 as the default protocal
• Sets Show File Extensions
• Reboots system

At the Windows Desktop press Win + R to open the Run dialog box. In the Run dialog box type 'cmd' (less the outside quotes) and then press CTRL+SHIFT+ENTER to open a command window as Administrator.

At the CMD prompt type 'd:\temp\modder.bat' (less the outside quotes) and tap the 'Enter' key.

Installing Npcap

Open a CMD window and type 'd:\temp\npcap-1.86.exe' (less the outside quotes) and tap the 'Enter' key.

The 'License Agreement' window opens and left-click 'I Agree'.

The 'Installation Options' window opens, make sure the only checked select box is 'Install Npcap in WinPcap API-compatible Mode' and left-click 'Install'.

The 'Installation Complete' window opens and left-click 'Next'.

The 'Finished' window opens and left-click 'Finish'.

Installing Snort, the Traffic Detection and Inspection Engine

At the CMD prompt type 'd:\temp\Snort_2_9_20_Installer.x64.exe' (less the outside quotes) and tap the 'Enter' key.

The 'License Agreement' window opens and left-click 'I Agree'.

The 'Choose Components' window opens and left-click 'Next'.

The 'Choose Install Location' window opens, in the 'Destination Folder' dialog box, type 'd:\winids\snort' (less the outside quotes), left-click 'Next'.

The install completes with 'Completed' and left-click 'Close'.

The install finishes with 'Snort has been successfully installed.' and left-click 'OK'.

Installing Strawberry Perl

At the CMD prompt type 'd:\temp\strawberry-perl-5.42.0.1-64bit.msi' (less the outside quotes) and tap the 'Enter' key.

The 'Welcome to the Setup Wizard for Strawberry Perl...' window opens and left-click 'Next'.

The 'End-User License Agreement' window opens, left-click checking the 'I accept the terms...' check box and left-click 'Next'.

The 'Destination Folder' window opens, in the 'Install Strawberry Perl to:' dialog box type 'd:\winids\strawberry\' (less the outside quotes) and left-click 'Next'.

The 'Ready to install Strawberry Perl..' window opens, left-click 'Install'.

The 'Install Strawberry Perl..' window opens, allow the install to complete and left-click 'Next'.

The 'Completed the Strawberry Perl...' window opens, uncheck the 'Read README file.' check box and left-click 'Finish'.

At the CMD prompt type 'exit' (less the outside quotes) and tap the 'Enter' key.

Open a CMD window and type 'cpan install Sys::Syslog' (less the outside quotes) and tap the 'Enter' key.

Installing Pulledpork

At the CMD prompt type '7z x d:\temp\pulledpork-master.zip -od:\winids\' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'ren d:\winids\pulledpork-master pulledpork' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'mkdir d:\winids\pulledpork\temp' (less the outside quotes) and tap the 'Enter' key.

Installing PHP

At the CMD prompt type '7z x d:\temp\php-8.5.1-Win32-vs17-x64.zip -od:\winids\php' (less the outside quotes) and tap the 'Enter' key.

Installing the Apache2 Web-Server

At the CMD prompt type '7z x d:\temp\httpd-2.4.66-260131-Win64-VS18.zip -od:\winids' (less the outside quotes) and tap the 'Enter' key.

Installing the FastCGI ASF support module and configuration file for Apache2

At the CMD prompt type '7z e d:\temp\mod_fcgid-2.3.10-win64-VS18.zip -od:\winids\Apache24\modules *.so' (less the outside quotes) and tap the 'Enter' key.

Installing BASE, the Windows Intrusion Detection Systems (WinIDS) Security Console

At the CMD prompt type '7z x d:\temp\base.zip -od:\winids\apache24\htdocs\base' (less the outside quotes) and tap the 'Enter' key.

Installing Barnyard2

At the CMD prompt type '7z x d:\temp\barnyard2-2.1.14-b337.zip -od:\winids\barnyard2' (less the outside quotes) and tap the 'Enter' key.

Installing the MySQL Database Server

At the CMD prompt type 'd:\temp\mysql-installer-community-8.0.44.0.msi' (less the outside quotes) and tap the 'Enter' key.

The MySQL installer 'Choosing a Setup Type' window opens. Left-click selecting the 'Custom' radio button and left-click 'Next'.

The MySQL installer 'Select Products' window opens.

Under 'Available Products:' left-click expanding 'MySQL Servers', left-click expanding 'MySQL Server', left-click expanding 'MySQL Servers 8.0', left-click highlighting 'MySQL Server 8.0.44 - X64' and left click the green arrow pointing to the right moving the 'MySql Server 8.0.44 - X64' to the 'Products To Be Installed:' section.

Under 'Products To Be Installed:' left-click highlighting 'MySql Server 8.0.44 - X64'.

Just above the 'Cancel' button left-click 'Advanced Options' and the 'Advanced Options for MySQL Server 8.0.44' opens.

In the 'Install Directory:' dialog box type 'D:\winids\mysql' (less the outside quotes).

In the 'Data Directory:' dialog box type 'D:\winids\mysql' (less the outside quotes), left-click 'OK' and left-click 'Next'.

The MySQL installer 'Installation' window opens. Left-click 'Execute' allowing the MySQL to 'Complete' the install and left-click 'Next'.

The MySQL installer 'Product Configuration' window opens and left-click 'Next'.

The MySQL installer 'Type and Networking' window opens. Under 'Server Configuration Type' left-click the 'Config Type:", left-click selecting 'Server Computer' and left-click 'Next'.

The MySQL installer 'Authentication Method' window opens. To the left of 'Use Legacy Authentication Method...' left-click selecting the radio button and left-click 'Next'.

The MySQL installer 'Accounts and Roles' window opens. In the 'MySQL Root Password:' dialog box type 'd1ngd0ng' (less the outside quotes) and tap the 'Tab' key.

In the 'Repeat Password:' dialog box type 'd1ngd0ng' (less the outside quotes), tap the 'Tab' key and left-click 'Next'.

The MySQL installer 'Windows Service' window opens. In the 'Windows Service Name:' dialog box type 'MySQL' (less the outside quotes) and left-click 'Next'.

The MySQL installer 'Server File Permissions' window opens and left-click 'Next'.

The MySQL installer 'Apply Configuration' window opens. Left-click 'Execute' allowing the configuration for MySQL Server to succeed and left-click 'Finish'.

The MySQL installer 'Product Configuration' window opens and left-click 'Next'.

The MySQL installer 'Installation Complete' window opens. Left-click 'Finish' to complete the MySQL Database installation.

At the CMD prompt type 'copy d:\winids\mysql\lib\libmysql.dll c:\windows\system32' (less the outside quotes) and tap the 'Enter' key.

Installing ADODB

At the CMD prompt type '7z x d:\temp\adodb-5.22.11.zip -od:\winids\' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'ren d:\winids\adodb-5.22.11 adobd5' (less the outside quotes) and tap the 'Enter' key.

Verifying Snort is detecting Network traffic

At the CMD prompt type 'd:\winids\snort\bin\snort -W' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'd:\winids\snort\bin\snort -v -ix' (less the outside quotes) and tap the 'Enter' key.

After verifying the Index number, eXit the web-browser, activate the CMD window and press the CTRL/C keys to stop the Snort process exiting back to the CMD prompt.

Processing task dependencies pre Snort configuration

At the CMD prompt type '7z x d:\temp\snortrules-snapshot-29200.tar.gz -od:\temp' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type '7z e d:\temp\snortrules-snapshot-29200.tar -aoa -od:\winids\snort\etc etc\*.*' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'del d:\temp\snortrules-snapshot-29200.tar /Q' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'perl -pi -e "s/include \$RULE\_PATH/# include \$RULE\_PATH/" d:\winids\snort\etc\snort.conf' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'type NUL > d:\winids\snort\rules\white_list.rules' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'type NUL > d:\winids\snort\rules\black_list.rules' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'type NUL > d:\winids\snort\rules\winids.rules' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'rd d:\winids\snort\preproc_rules /S /Q' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'copy d:\winids\scripts\local.rules d:\winids\snort\rules\local.rules' (less the outside quotes) and tap the 'Enter' key.

Configuring Snort, the Heart of the Windows Intrusion Detection System (WinIDS)

At the CMD prompt type 'notepad2 d:\winids\snort\etc\snort.conf' (less the outside quotes) and tap the 'Enter' key.

Original Line(s): ipvar HOME_NET any
Change to: ipvar HOME_NET 192.168.1.0/24

Original Line(s): var RULE_PATH ../rules
Change to: var RULE_PATH d:\winids\snort\rules

Original Line(s): var SO_RULE_PATH ../so_rules
Change to: # var SO_RULE_PATH ../so_rules

Original Line(s): var PREPROC_RULE_PATH ../preproc_rules
Change to: # var PREPROC_RULE_PATH ../preproc_rules

Original Line(s): var WHITE_LIST_PATH ../rules
Change to: var WHITE_LIST_PATH d:\winids\snort\rules

Original Line(s): var BLACK_LIST_PATH ../rules
Change to: var BLACK_LIST_PATH d:\winids\snort\rules

Original Line(s): dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/
Change to: dynamicpreprocessor directory d:\winids\snort\lib\snort_dynamicpreprocessor

Original Line(s): dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so
Change to: dynamicengine d:\winids\snort\lib\snort_dynamicengine\sf_engine.dll

Original Line(s): decompress_swf { deflate lzma } \
Change to: decompress_swf { deflate } \

Original Line(s): # preprocessor sfportscan: proto { all } memcap { 10000000 } sense_level { low }
Change to: preprocessor sfportscan: proto { all } memcap { 10000000 } sense_level { low } logfile { portscan.log }

Original Line(s): # output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types
Change to: output unified2: filename merged.log, limit 128

Original Line(s): # include $RULE_PATH/local.rules
Change to: include $RULE_PATH/local.rules

include $RULE_PATH/winids.rules
include $RULE_PATH/white_list.rules
include $RULE_PATH/black_list.rules

Save the file and eXit Notepad2.

Testing the Snort configuration file

At the CMD prompt type 'd:\winids\snort\bin\snort -c d:\winids\snort\etc\snort.conf -l d:\winids\snort\log -ix -T' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'd:\winids\snort\bin\snort -A console -q -c d:\winids\snort\etc\snort.conf -l d:\winids\snort\log -ix' (less the outside quotes) and tap the 'Enter' key.

Activate the CMD window and press CTRL/C to exit back to the CMD prompt.

At the CMD prompt type 'perl -pi -e "s/include \$RULE\_PATH\/local.rules/# include \$RULE\_PATH\/local.rules/" d:\winids\snort\etc\snort.conf' (less the outside quotes) and tap the 'Enter' key.

Configuring Pulledpork

At the CMD prompt type 'notepad2 d:\winids\pulledpork\etc\pulledpork.conf' (less the outside quotes) and tap the 'Enter' key.

Original Line(s): rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|<oinkcode>
Change to: rule_url=https://www.snort.org/reg-rules/|snortrules-snapshot.tar.gz|x

Original Line(s): rule_url=https://snort.org/downloads/community/|community-rules.tar.gz|Community
Change to: # rule_url=https://snort.org/downloads/community/|community-rules.tar.gz|Community

Original Line(s): temp_path=/tmp
Change to: temp_path=d:/winids/pulledpork/temp

Original Line(s): rule_path=/usr/local/etc/snort/rules/snort.rules
Change to: rule_path=d:/winids/snort/rules/winids.rules

Original Line(s): local_rules=/usr/local/etc/snort/rules/local.rules
Change to: local_rules=d:/winids/snort/rules/local.rules

Original Line(s): sid_msg=/usr/local/etc/snort/sid-msg.map
Change to: sid_msg=d:/winids/snort/etc/sid-msg.map

Original Line(s): sid_changelog=/var/log/sid_changes.log
Change to: sid_changelog=d:/winids/snort/log/sid_changes.log

Original Line(s): block_list=/usr/local/etc/snort/rules/iplists/default.blocklist
Change to: # block_list=/usr/local/etc/snort/rules/iplists/default.blocklist

Original Line(s): IPRVersion=/usr/local/etc/snort/rules/iplists
Change to: # IPRVersion=/usr/local/etc/snort/rules/iplists

Original Line(s): snort_control=/usr/local/bin/snort_control
Change to: # snort_control=/usr/local/bin/snort_control

Original Line(s): # snort_version=2.9.0.0
Change to: snort_version=2.9.20.0

Original Line(s):

# enablesid=/usr/local/etc/snort/enablesid.conf
# dropsid=/usr/local/etc/snort/dropsid.conf
# disablesid=/usr/local/etc/snort/disablesid.conf
# modifysid=/usr/local/etc/snort/modifysid.conf

Change to:

enablesid=d:/winids/pulledpork/etc/enablesid.conf
dropsid=d:/winids/pulledpork/etc/dropsid.conf
disablesid=d:/winids/pulledpork/etc/disablesid.conf
modifysid=d:/winids/pulledpork/etc/modifysid.conf

Original Line(s): # ips_policy=security
Change to: ips_policy=security

Save the file and eXit Notepad2.

Rule activation and testing with Pulledpork

At the CMD prompt type 'perl d:\winids\pulledpork\pulledpork.pl -c d:\winids\pulledpork\etc\pulledpork.conf -T' (less the outside quotes) and tap the 'Enter' key.

Testing the Snort configuration file

At the CMD prompt type 'd:\winids\snort\bin\snort -c d:\winids\snort\etc\snort.conf -l d:\winids\snort\log -ix -T' (less the outside quotes) and tap the 'Enter' key.

Configuring PHP

At the CMD prompt type 'mkdir d:\winids\php\logs' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'copy d:\winids\php\php.ini-production d:\winids\php\php.ini' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'notepad2 d:\winids\php\php.ini' (less the outside quotes) and tap the 'Enter' key.

Original Line(s): max_execution_time = 30
Change to: max_execution_time = 60

Original Line(s): ;error_log = php_errors.log
Change to: error_log = d:\winids\php\logs\php_errors.log

Original Line(s): ;include_path = ".;c:\php\includes"
Change to: include_path = "d:\winids\php"

Original Line(s): ;extension_dir = "ext"
Change to: extension_dir = "d:\winids\php\ext"

Original Line(s): ;extension=gd
Change to: extension=gd

Original Line(s): ;extension=gmp
Change to: extension=gmp

Original Line(s): ;extension=mysqli
Change to: extension=mysqli

Original Line(s): ;date.timezone =
Change to: date.timezone = America/New_York

Original Line(s): ;session.save_path = "/tmp"
Change to: session.save_path = "c:\windows\temp"

Save the file and eXit Notepad2.

Configuring the Apache2 Web-Server

At the CMD prompt type 'notepad2 d:\winids\apache24\conf\httpd.conf' (less the outside quotes) and tap the 'Enter' key.

Original Line(s): ServerRoot "C:/Apache24-64"
Change to: ServerRoot "d:/winids/Apache24"

Original Line(s): Listen 80
Change to: Listen winids:80

Original Line(s): #ServerName www.example.com:80
Change to: ServerName winids:80

Original Line(s): DocumentRoot "C:/Apache24-64/htdocs"
Change to: DocumentRoot "d:/winids/Apache24/htdocs/base"

Original Line(s): <Directory "C:/Apache24-64/htdocs>
Change to: <Directory "d:/winids/Apache24/htdocs/base">

Original Line(s): Options Indexes FollowSymLinks
Change to: Options -Indexes

Original Line(s): DirectoryIndex index.html
Change to: DirectoryIndex index.php

Original Line(s): #ErrorDocument 500 "The server made a boo boo."
Change to: ErrorDocument 500 /base_error.php

Scroll all the way to the bottom of the file and insert the next 11 lines of code:

LoadModule fcgid_module modules/mod_fcgid.so
<IfModule fcgid_module>
   FcgidInitialEnv PHPRC "d:/winids/php"
    FcgidInitialEnv PATH "d:/winids/php;c:/Windows/system32;c:/Windows;c:/Windows/System32/Wbem;"
    FcgidIOTimeout 120
    <Files ~ "\.php$">
        Options +ExecCGI
        AddHandler fcgid-script .php
        FcgidWrapper "d:/winids/php/php-cgi.exe" .php
    </Files>
</IfModule>

Save the file and eXit Notepad2.

Testing the Apache2 configuration file

At the CMD prompt type 'd:\winids\Apache24\bin\httpd.exe -t' (less the outside quotes) and tap the 'Enter' key.

Adding Apache2 to the Windows Services Database

At the CMD prompt type 'd:\winids\apache24\bin\httpd.exe -k install' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'net start apache2.4' (less the outside quotes) and tap the 'Enter' key.

Testing Apache2 and the PHP installation

At the CMD prompt type 'copy d:\winids\scripts\test_php.php d:\winids\apache24\htdocs\base' (less the outside quotes) and tap the 'Enter' key.

Open a web-browser and type 'http://winids/test_php.php' (less the outside quotes) into the URL Address box and tap the 'Enter' key.

eXit the web-browser.

At the CMD prompt type 'del d:\winids\apache24\htdocs\base\test_php.php' (less the outside quotes) and tap the 'Enter' key.

Adding Snort to the Windows Services Database

At the CMD prompt type 'cd /d d:\winids\snort\bin' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'snort /SERVICE /INSTALL -c d:\winids\snort\etc\snort.conf -l d:\winids\snort\log -ix' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'sc config snortsvc start= auto' (less the outside quotes) and tap the 'Enter' key.

Configuring the MySQL Database Server

Open a CMD window and type 'notepad2 d:\winids\mysql\my.ini' (less the outside quotes) and tap the 'Enter' key.

character-set-server=utf8
bind-address=127.0.0.1

Save the file and eXit Notepad2.

Creating the Windows Intrusion Detection System Databases
At the CMD prompt type 'mysql -u root -pd1ngd0ng' (less the outside quotes) and tap the 'Enter' key to be dropped into the MySQL CMD prompt as Administrator.

At the mysql CMD prompt type 'create database snort;' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'create database archive;' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'show databases;' (less the outside quotes) and tap the 'Enter' key.


Creating the Windows Intrusion Detection System Database Tables
At the mysql CMD prompt type 'connect snort;' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'source d:\winids\barnyard2\schemas\create_mysql' (less the outside quotes), and tap the 'Enter' key.

At the mysql CMD prompt type 'source d:\winids\apache24\htdocs\base\sql\create_base_tbls_mysql.sql' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'show tables;' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'connect archive;' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'source d:\winids\barnyard2\schemas\create_mysql' (less the outside quotes), and tap the 'Enter' key.

At the mysql CMD prompt type 'source d:\winids\apache24\htdocs\base\sql\create_base_tbls_mysql.sql' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'show tables;' (less the outside quotes) and tap the 'Enter' key.


Creating the Windows Intrusion Detection System Database Access and Authenticated Users
At the mysql CMD prompt type 'CREATE USER 'snort' IDENTIFIED WITH mysql_native_password BY 'l0gg3r';' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'GRANT INSERT,SELECT,UPDATE ON snort.* TO 'snort';' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'CREATE USER 'base' IDENTIFIED WITH mysql_native_password BY 'an@l1st';' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'GRANT ALTER,CREATE,DELETE,INSERT,SELECT,UPDATE ON snort.* TO 'base';' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'GRANT ALTER,CREATE,DELETE,INSERT,SELECT,UPDATE ON archive.* TO 'base';' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'use mysql;' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'select user from user;' (less the outside quotes) and tap the 'Enter' key.

At the mysql CMD prompt type 'quit;' (less the outside quotes) and tap the 'Enter' key.

Confirming MySQL and Snort are operational

At the CMD prompt type 'net stop mysql & net start mysql & net start snort' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'taskmgr.exe' (less the outside quotes) and tap the 'Enter' key to start the Windows Task Manager.

Left-click the 'Processes' tab.

At the bottom, left-click 'Show processes from all users' or 'More Details' to view all running processes.

In the 'Name' or 'Image Name' column 'snort.exe' and 'mysql.exe' should be listed.

eXit the 'Task Manager'.

Configuring BASE the Windows Intrusion Detection Systems (WinIDS) Security Console

At the CMD prompt type 'copy d:\winids\apache24\htdocs\base\base_conf.php.dist d:\winids\apache24\htdocs\base\base_conf.php' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'notepad2 d:\winids\apache24\htdocs\base\base_conf.php' (less the outside quotes) and tap the 'Enter' key.

Original Line(s): $DBlib_path = '';
Change to: $DBlib_path = 'd:\winids\adodb5';

Original Line(s): $DBtype = '?????';
Change to: $DBtype = 'mysql';

Original Line(s):

$alert_dbname   = 'snort_log';
$alert_host     = 'localhost';
$alert_port     = '';
$alert_user     = 'snort';
$alert_password = 'mypassword';

Change to:

$alert_dbname   = 'snort';
$alert_host     = 'winids';
$alert_port     = '';
$alert_user     = 'base';
$alert_password = 'an@l1st';

Original Line(s):

$archive_exists   = 0; # Set this to 1 if you have an archive DB
$archive_dbname   = 'snort_archive';
$archive_host     = 'localhost';
$archive_port     = '';
$archive_user     = 'snort';
$archive_password = 'mypassword';

Change to:

$archive_exists   = 1; # Set this to 1 if you have an archive DB
$archive_dbname   = 'archive';
$archive_host     = 'winids';
$archive_port     = '';
$archive_user     = 'base';
$archive_password = 'an@l1st';

Original Line(s): $resolve_IP = 0;
Change to: $resolve_IP = 1;

Original Line(s): $show_expanded_query = 0;
Change to: $show_expanded_query = 1;

Original Line(s): $portscan_file = '';
Change to: $portscan_file = 'd:\winids\snort\log\portscan.log';

Original Line(s): $colored_alerts = 0;
Change to: $colored_alerts = 1;

Save the file and eXit Notepad2.

Configuring Barnyard2

At the CMD prompt type 'notepad2 d:\winids\barnyard2\etc\barnyard2.conf' (less the outside quotes) and tap the 'Enter' key.

Original Line(s):

config reference_file:      /etc/snort/reference.config
config classification_file: /etc/snort/classification.config
config gen_file:            /etc/snort/gen-msg.map
config sid_file:            /etc/snort/sid-msg.map

Change to:

config reference_file:      d:\winids\snort\etc\reference.config
config classification_file: d:\winids\snort\etc\classification.config
config gen_file:            d:\winids\snort\etc\gen-msg.map
config sid_file:            d:\winids\snort\etc\sid-msg.map

Original Line(s): # config event_cache_size: 4096
Change to: config event_cache_size: 32768

Original Line(s): #output database: log, mysql, user=root password=test dbname=db host=localhost
Change to: output database: log, mysql, user=snort password=l0gg3r dbname=snort host=winids sensor_name=WinIDS_Master

Save the file and eXit Notepad2.

Testing the Barnyard2 configuration file

At the CMD prompt type 'd:\winids\scripts\by2-test.bat' (less the outside quotes) and tap the 'Enter' key.

Installing the Non-Sucking Service Manager (nssm)

At the CMD prompt type '7z e d:\temp\nssm-2.24.zip nssm-2.24\win64\nssm.exe -od:\winids\tools' (less the outside quotes) and tap the 'Enter' key.

Adding Barnyard2 to the Windows Services Database using nssm

At the CMD prompt type 'd:\winids\scripts\by2-service.bat' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'sc config Barnyard2 start= delayed-auto' (less the outside quotes) and tap the 'Enter' key.

Adding the Rules Updater to the Desktop

At the CMD prompt type 'd:\winids\scripts\sc-create.bat' (less the outside quotes) and tap the 'Enter' key.

At the CMD prompt type 'shutdown /r /t 10' (less the outside quotes) and tap the 'Enter' key to reboot.

Verifying Barnyard2 and Snort is running as a process after rebooting

After the reboot Open a CMD window and type 'taskmgr.exe' (less the outside quotes) and tap the 'Enter' key to start the Windows Task Manager.

Left-click the 'Processes' tab.

At the bottom, left-click 'Show processes from all users' or 'More Details' to view all running processes.

In the 'Name' or 'Image Name' column 'snort.exe' and 'Barnyard2.exe' should both be listed.

eXit the 'Task Manager'.

At the CMD prompt type 'exit' (less the outside quotes) and tap the 'Enter' key.

Starting the Windows Intrusion Detection Systems (WinIDS) Security Console

Open a web-browser and type 'http://winids' (less the outside quotes) into the URL Address box and tap the 'Enter' key.

In Conclusion

At this point the tutorial has been successfully completed. Events should be arriving into the Database and those events should be seen in the local Windows Intrusion Detection Systems (WinIDS) Security Console.

I encourage some tweaks listed below to the post-installation to get a somewhat production-ready 'Windows Intrusion Detection System (WinIDS)'.

• Tuning your rules and preprocessors.
• Tuning Snort thresholds and limit values.
• Adding user authentication to the Windows Intrusion Detection Systems (WinIDS) Security Console.
• Securing your host (Maybe changing the default database user access, disabling unneeded services, etc.).
• Become a subscriber (fee based) on snort.org to get access to zero day rules.
• Scheduling a rules update (with the included Rules Updater).

Security Issues

Lets review what has happens so far:

• All support programs, including 'Apache2' have been installed to a separate partition, which closed a multitude of security holes.
• The Windows Intrusion Detection Systems (WinIDS) Security Console can ONLY be accessed locally.
• A desktop icon was installed to manually initiate a rules update using Pulledpork (rules updates can only be initiated every 15 minutes).

Optional Companion Documents

• How to add Event Logging to a local Syslog Server.
  This tutorial will show how to configure Snort to send events to a local Syslog Server, on an existing Windows Intrusion Detection System (WinIDS).

• How to add Event Logging to a remote Syslog Server.
  This tutorial will show how to configure Snort to send events to a remote Syslog Server from an existing Windows Intrusion Detection System (WinIDS).

• How to add Email Alerting to an existing Windows Intrusion Detection System (WinIDS)
  This tutorial will show how to email user defined priority events on an existing Windows Intrusion Detection System (WinIDS).

• How to schedule automatic rules updating
  This tutorial is a simple to understand process on how to schedule automatic rules updating.

• How to compile Barnyard2 on Windows using Cygwin
  This tutorial is a simple to understand, step-by-step guide for Compiling Barnyard2 on Windows using Cygwin (UNIX emulator).

• How to build and deploy a passive Ethernet tap
  This tutorial will show how to build and deploy a passive Ethernet tap.

Updating the Windows Intrusion Detection Systems (WinIDS) Major components

• How to update the Snort Intrusion Detection Engine
  This tutorial will show How to update the Snort Intrusion Detection Engine.

• How to update the Windows Intrusion Detection Systems rules
  This tutorial will show how to update the Windows Intrusion Detection Systems rules.

Debugging Installation errors

Check the Event Viewer as most of the support programs will throw FATAL errors into the Windows Application log or check the actual log file for the specific application.

General tutorial issues

For general problem issues that pertain to this specific tutorial, left-click the get community support button at the top of this tutorial, or manually navigate to the correct community support forum pertaining to this specific tutorial.

Feedback

I would love to get feedback on any recommendations, experiences or ideas for this tutorial. Please leave feedback HERE.

Michael E. Steele | Microsoft Certified System Engineer (MCSE)
Email Support: support@winsnort.com
Snort: Open Source Network IDS - www.snort.org