系统环境:rh as3+apache+php+snort+base
所需snort相关软件包:
adodb462.tgz
base-1.2.6.tar.gz
Image_Canvas-0.3.0.tar.gz
//Image_Color-1.0.2.tar.gz
Image_Graph-0.7.2.tar.gz
libpcap-0.9.5.tar.gz
pcre-6.7.tar.gz
snort-2.6.0.tar.gz
snortrules-pr-2.4.tar.gz
所需snort相关软件包:
adodb462.tgz
base-1.2.6.tar.gz
Image_Canvas-0.3.0.tar.gz
//Image_Color-1.0.2.tar.gz
Image_Graph-0.7.2.tar.gz
libpcap-0.9.5.tar.gz
pcre-6.7.tar.gz
snort-2.6.0.tar.gz
snortrules-pr-2.4.tar.gz
下载软件:
wget http://download.sso.cn/security/ids/snort_base/adodb462.tgz
wget http://download.sso.cn/security/ids/snort_base/base-1.2.6.tar.gz
wget http://download.sso.cn/security/ids/snort_base/Image_Canvas-0.3.0.tar.gz
wget http://download.sso.cn/security/ids/snort_base/Image_Color-1.0.2.tar.gz
wget http://download.sso.cn/security/ids/snort_base/Image_Graph-0.7.2.tar.gz
wget http://download.sso.cn/security/ids/snort_base/install.txt
wget http://download.sso.cn/security/ids/snort_base/libpcap-0.9.5.tar.gz
wget http://download.sso.cn/security/ids/snort_base/pcre-6.7.tar.gz
wget http://download.sso.cn/security/ids/snort_base/snort-2.6.0.tar.gz
wget http://download.sso.cn/security/ids/snort_base/snortrules-pr-2.4.tar.gz
wget http://download.sso.cn/security/ids/snort_base/adodb462.tgz
wget http://download.sso.cn/security/ids/snort_base/base-1.2.6.tar.gz
wget http://download.sso.cn/security/ids/snort_base/Image_Canvas-0.3.0.tar.gz
wget http://download.sso.cn/security/ids/snort_base/Image_Color-1.0.2.tar.gz
wget http://download.sso.cn/security/ids/snort_base/Image_Graph-0.7.2.tar.gz
wget http://download.sso.cn/security/ids/snort_base/install.txt
wget http://download.sso.cn/security/ids/snort_base/libpcap-0.9.5.tar.gz
wget http://download.sso.cn/security/ids/snort_base/pcre-6.7.tar.gz
wget http://download.sso.cn/security/ids/snort_base/snort-2.6.0.tar.gz
wget http://download.sso.cn/security/ids/snort_base/snortrules-pr-2.4.tar.gz
软件安装路径:
snort:
/usr/local/snort
rules:
/usr/local/snort/rules
snort.conf
/usr/local/snort/conf/snort.conf
adodb:
/usr/local/snort/adodb
base:
/usr/local/snort/base
libpcap:
/usr/local/snort/libpcap
pcre
/usr/local/snort/pcre
snort:
/usr/local/snort
rules:
/usr/local/snort/rules
snort.conf
/usr/local/snort/conf/snort.conf
adodb:
/usr/local/snort/adodb
base:
/usr/local/snort/base
libpcap:
/usr/local/snort/libpcap
pcre
/usr/local/snort/pcre
1 配置apache+php+mysql环境
2 安装snort前提组件libpcap-0.9.5.tar.gz和pcre-6.7.tar.gz
tar zxvf libpcap-0.9.5.tar.gz
cd libpcap-0.9.5
./configure --prefix=/usr/local/snort/libpcap
make
make install
cd libpcap-0.9.5
./configure --prefix=/usr/local/snort/libpcap
make
make install
tar zxvf pcre-6.7.tar.gz
cd pcre-6.7
./configure --prefix=/usr/local/snort/pcre
make
make install
cd pcre-6.7
./configure --prefix=/usr/local/snort/pcre
make
make install
3 安装snort-2.6.0.tar.gz并加载plugin
groupadd snort
useradd -g snort -s /sbin/nologin
groupadd snort
useradd -g snort -s /sbin/nologin
建立日志文件目录和配置文件目录:
mkdir /var/log/snort
mkdir /usr/local/snort/conf
mkdir /var/log/snort
mkdir /usr/local/snort/conf
tar zxvf snort-2.6.0.tar.gz
cd snort-2.6.0
./configure --prefix=/usr/local/snort --with-mysql \
--with-libpcap-includes=/usr/local/snort/libpcap/include \
--with-libpcap-libraries=/usr/local/snort/libpcap/lib \
--with-libpcre-includes=/usr/local/snort/pcre/include \
--with-libpcre-libraries=/usr/local/snort/pcre/lib \
--enable-dynamicplugin
make
make install
cd snort-2.6.0
./configure --prefix=/usr/local/snort --with-mysql \
--with-libpcap-includes=/usr/local/snort/libpcap/include \
--with-libpcap-libraries=/usr/local/snort/libpcap/lib \
--with-libpcre-includes=/usr/local/snort/pcre/include \
--with-libpcre-libraries=/usr/local/snort/pcre/lib \
--enable-dynamicplugin
make
make install
4 配置snort并加载rules
cp etc/classification.config /usr/local/snort/conf
cp etc/reference.config /usr/local/snort/conf
cp etc/snort.conf /usr/local/snort/conf
cp etc/unicode.map /usr/local/snort/conf
我查看过snort.conf文件,好象只用如上几个配置文件就可以了,如果有错误,可以使用:
cp etc/* /usr/local/snort/conf
cp etc/classification.config /usr/local/snort/conf
cp etc/reference.config /usr/local/snort/conf
cp etc/snort.conf /usr/local/snort/conf
cp etc/unicode.map /usr/local/snort/conf
我查看过snort.conf文件,好象只用如上几个配置文件就可以了,如果有错误,可以使用:
cp etc/* /usr/local/snort/conf
创建snort数据库,并导入数据
mysql -uroot -prootpassword -e "create database snrot"
mysql -uroot -prootpassword -e "grant all on snort.* to snort@localhost identified by 'snort'"
mysql -usnort -psnort
mysql -uroot -prootpassword -e "create database snrot"
mysql -uroot -prootpassword -e "grant all on snort.* to snort@localhost identified by 'snort'"
mysql -usnort -psnort
tar zxvf snortrules-pr-2.4.tar.gz
mv rules /usr/local/snort/
mv rules /usr/local/snort/
启动snort
/usr/local/snort/bin/snort -c /usr/local/snort/conf/snort.conf -i eth0 -g snort -D
如果实现开机自动启动,把上面的语句添加到/etc/rc.local
/usr/local/snort/bin/snort -c /usr/local/snort/conf/snort.conf -i eth0 -g snort -D
如果实现开机自动启动,把上面的语句添加到/etc/rc.local
5 安装adodb和base
tar zxvf base-1.2.6.tar.gz
mv base-1.2.6 /usr/local/snort/base
tar zxvf base-1.2.6.tar.gz
mv base-1.2.6 /usr/local/snort/base
tar zxvf adodb462.tgz
mv adodb /usr/local/snort/
mv adodb /usr/local/snort/
6 配置base_conf.php
cd /usr/local/base
cp base_conf.php.dist base_conf.php
修改 “base_conf.php”
$BASE_urlpath = "/base";
$DBlib_path = "../adodb ";
$DBtype = "mysql";
$alert_dbname = 'snort';
$alert_host = 'localhost';
$alert_port = '';
$alert_user = 'snort';
$alert_password = 'snort';
cd /usr/local/base
cp base_conf.php.dist base_conf.php
修改 “base_conf.php”
$BASE_urlpath = "/base";
$DBlib_path = "../adodb ";
$DBtype = "mysql";
$alert_dbname = 'snort';
$alert_host = 'localhost';
$alert_port = '';
$alert_user = 'snort';
$alert_password = 'snort';
7 配置apache
在httpd.conf文件中加入如下:
Alias /base /usr/local/snort/base
这样您就可以在
http://ip/base
在httpd.conf文件中加入如下:
Alias /base /usr/local/snort/base
这样您就可以在
http://ip/base
参考文档
http://download.sso.cn/security/ids/snort_base/snort_base_SSL.pdf
http://download.sso.cn/security/ids/snort_base/snort-barnyard.pdf
http://download.sso.cn/security/ids/snort_base/Snortman.htm
http://www.snort.org/docs/faq.html
http://www.snort.org/docs/
http://download.sso.cn/security/ids/snort_base/snort_base_SSL.pdf
http://download.sso.cn/security/ids/snort_base/snort-barnyard.pdf
http://download.sso.cn/security/ids/snort_base/Snortman.htm
http://www.snort.org/docs/faq.html
http://www.snort.org/docs/
