Solved SNORT blocking inital Setup (Debian ISO)

[Dmnk.Rocks]

so... I was trying to setup anoter customer Instance and had trouble after inputing the Network Information on the Debian Installer. - I rememberd that the installer downloads some files, and thought maybe I missed something on my Firweall (eg allow port 80/443...)

Low and behold, my Firewall Rules are right - but IPS blocked some connections from your Servers after the initial Download.

so either my snort instance gone wild, or something is up with your google instance.

:: IPinfo.io query
Core
- IP           35.201.76.132
- Anycast      true
- Hostname     132.76.201.35.bc.googleusercontent.com
- City         Kansas City
- Region       Missouri
- Country      United States (US)
- Location     39.0997,-94.5786
- Organization AS15169 Google LLC
- Postal       64121
- Timezone     America/Chicago


::curling http://35.201.76.132
}<meta http-equiv="refresh" content="0; url=https://www.3cx.com/">


IPS/Snort Log:

2021:09:14-12:16:36 edge-fw01 snort[27594]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-OTHER Unix.Miner.Xbash variant dropped bash script" group="130" srcip="35.201.76.132" dstip="EXTERNAL-IP" proto="6" srcport="80" dstport="51240" sid="47873" class="A Network Trojan was Detected" priority="1"
generator="1" msgid="0"
2021:09:14-12:23:58 edge-fw01 snort[27594]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-OTHER Unix.Miner.Xbash variant dropped bash script" group="130" srcip="35.201.76.132" dstip="EXTERNAL-IP" proto="6" srcport="80" dstport="33312" sid="47873" class="A Network Trojan was Detected" priority="1"
generator="1" msgid="0"
2021:09:14-12:30:33 edge-fw01 snort[27594]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-OTHER Unix.Miner.Xbash variant dropped bash script" group="130" srcip="35.201.76.132" dstip="EXTERNAL-IP" proto="6" srcport="80" dstport="45972" sid="47873" class="A Network Trojan was Detected" priority="1"
generator="1" msgid="0"
2021:09:14-12:34:57 edge-fw01 snort[27594]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-OTHER Unix.Miner.Xbash variant dropped bash script" group="130" srcip="35.201.76.132" dstip="EXTERNAL-IP" proto="6" srcport="80" dstport="34434" sid="47873" class="A Network Trojan was Detected" priority="1"
generator="1" msgid="0"
2021:09:14-12:40:44 edge-fw01 snort[27594]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-OTHER Unix.Miner.Xbash variant dropped bash script" group="130" srcip="151.80.125.73" dstip="EXTERNAL-IP" proto="6" srcport="80" dstport="39906" sid="47873" class="A Network Trojan was Detected" priority="1"
generator="1" msgid="0"
2021:09:14-12:47:54 edge-fw01 snort[27594]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-OTHER Unix.Miner.Xbash variant dropped bash script" group="130" srcip="35.201.76.132" dstip="EXTERNAL-IP" proto="6" srcport="80" dstport="38760" sid="47873" class="A Network Trojan was Detected" priority="1"
generator="1" msgid="0"
2021:09:14-13:01:08 edge-fw01 snort[27594]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-OTHER Unix.Miner.Xbash variant dropped bash script" group="130" srcip="35.201.76.132" dstip="EXTERNAL-IP" proto="6" srcport="80" dstport="56480" sid="47873" class="A Network Trojan was Detected" priority="1"
generator="1" msgid="0"
2021:09:14-13:16:09 edge-fw01 snort[27594]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-OTHER Unix.Miner.Xbash variant dropped bash script" group="130" srcip="35.201.76.132" dstip="EXTERNAL-IP" proto="6" srcport="80" dstport="56482" sid="47873" class="A Network Trojan was Detected" priority="1"
generator="1" msgid="0"
2021:09:14-13:29:49 edge-fw01 snort[27594]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-OTHER Unix.Miner.Xbash variant dropped bash script" group="130" srcip="35.201.76.132" dstip="EXTERNAL-IP" proto="6" srcport="80" dstport="59472" sid="47873" class="A Network Trojan was Detected" priority="1"
generator="1" msgid="0"

 

[ChrisC_3CX]

When using the 3CX ISO to deploy 3CX, bash scripts will actually be downloaded during the installation process. Based on your IPS log it seems that the connection was very likely dropped exactly due to this reason.

We don't have a specific list of IPs that I could recommend whitelisting as a CDN is involved so you might want to temporarily bypass it until the installation completes.

 

[Dmnk.Rocks]

When using the 3CX ISO to deploy 3CX, bash scripts will actually be downloaded during the installation process. Based on your IPS log it seems that the connection was very likely dropped exactly due to this reason.

yes, I was using the Debian ISO (downloaded today from the partner area) - and I'm aware that my IPS did block that traffic.

I ran a tcpdump and captured the urls and downloaded the scripts myselfe - wich did not look sus to me, therefore I made an (temporary) exception on my firewall and was able to install it.
A scan of that VM after the installation did not show any suspicious activity or software - so I'm more or less fine with that, and don't think you have a compormised server.

But you may want to update that install process in the future, as the engine used here (snort) is widely used in a lot of IPS solutions and might cause installation Problems in the future for other people.

Especially because that connection is HTTP instead of HTTPS, what would be the desired way to go - imo (something something security and intercepted traffic).

srcip="3CX-VM-IP" dstip="35.201.76.132" dstport="80"

for the past few years I never had snort block anything on the installer, so I guess the scripts on your end have changed a bit, or snort got more aggressive.

The problem seem to be limited to the install process. Normal updates work just fine for this and all other installs we have running (all have ips enabled and configured similar to this enviroment).

 

[ChrisC_3CX]

Glad to see everything worked out in the end. We do not tend to download and run scripts often, as you said, it's mainly during the installation process and maybe for major updates such as from 3CX v16 to 3CX v18 since this also involved an OS upgrade from Debian 9 to Debian 10. We'll definitely see what we can do on our end if this turns out to be problematic for a large number of deployments.

In any case, thank you for sharing this information as it may prove useful to others having similar configurations.