SimWitty Internship: Week 5

This week I was doing some thinking about how I want to configure my network within VirtualBox. As of right now it will be populated by two workstations and two servers. The workstations both run Windows XP pro sp2 and the Servers both run Windows Server 2008 Standard edition.

One server will be configured to run the Snort engine and the other will be the database server. The database server will also be running: Active Directory as a domain controller, IIS, DNS, probably DHCP, and probably RRAS. VirtualBox can run its own DHCP server for internal networks (which this will be) via the command line VBoxManage, but I thought having the DHCP on an actual VM might make it more controllable.

The two XP machines will be domain members. I haven't decided whether to join the Snort machine to the domain. I guess I should since it can't run in stealth mode anyway, being a Windows box.

The Matriux machine is going to be an outsider for starters and we'll go from there. With the plan being to try client side attacks against the XP machines, I'm hoping the bad connections they make (to Matriux box) will be routed out to Matriux via the Domain Controller and if all goes according to plan the Snort machine will record everything. This is a conceptual map of what I am trying to achieve:

I have also been working on getting Snort installed on its machine. All is going well, and I went by our "Snort Integration v1 (draft)" It runs and logs just fine on the local machine but I am having a hell of a time getting it to connect to the DB server. For something in such wide use, Snort is one of the most difficult and poorly documented programs ever... Especially on Windows and Especially using MS SQL.

It took me a long time to find a trustworthy version of ntwdblib.dll, an old MS SQL interface library that Snort needs. I'm not even sure that SQL Server 2008 supports being used in this way. I think this will be the most difficult thing to get working. Well, at least my final class is over now so I have more time to dedicate to getting this thing working.