RHEL5.1+Snort+Apache+MySql+Php+Gd with Gd & Image_Graph监控系统安装与配置

wang_bupt

赞～～！
先顶后看！

bolix

顶起来```

banevv

首先感谢你指出我的文档中错误的地方
我文档中
“preprocessor stream4_reassemble”
add a line that looks like
preprocessor stream4_reassemble: both,ports 21 23 25 53 80 110 111 139 143 445 513 1433

是开始做的时候参考别的文档，如果这么做确实会出现问题，所以我在阅读配置文档
# Stream5 is a target-based stream engine for Snort.  Its functionality
# replaces that of Stream4.  Consequently, BOTH Stream4 and Stream5
# cannot be used simultaneously.  Comment out the stream4 configurations
# above to use Stream5.
后 和你用一样的方法实现 ，就是注释掉了stream4_reassemble相关的内容，直接使用Stream5
之后一直 没有更新文档，确实是不负责任的做法！

还有你文中提到的
#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ///cgi-bin access"; flow:to_server,established; uricontent:"///cgi-bin"; nocase; rawbytes; reference:nessus,11032; classtype:attempted-recon; sid:1143; rev:7
#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /cgi-bin/// access"; flow:to_server,established; uricontent:"/cgi-bin///"; nocase; rawbytes; reference:nessus,11032; classtype:attempted-recon; sid:1144; rev:7
我也是注释掉的，也是后来没有更新文档，不好意思！

mysql> SET PASSWORD FOR snort@localhost=PASSWORD('123456');                        --源文在这里有错
你说的这个地方 ，我应该没有写错吧？

非常感谢，后头我也把自己的文档改正一下。
另外你的问题也是我关心的，希望高手指点！

jerrywjl

原来是banevv是原创，失敬失敬！

希望不要介意我的一通牢骚！

这个帖子尽管俺是原创，但是主体是在你的结构上搭建起来的。所以非常感谢！如果有solution希望大家能一起学习提高！

niao5929

顶起来.好贴呀
1111

jerrywjl

还是我关心的两个问题，等高手加入，谢谢了！

第一，在启动snort中出现的几个错误，迫使我将/etc/snort/rules/web-misc.rules 注释，否则服务起不来。具体是什么原因？
#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC ///cgi-bin access"; flow:to_server,established; uricontent:"///cgi-bin"; nocase; rawbytes; reference:nessus,11032; classtype:attempted-recon; sid:1143; rev:7
#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC /cgi-bin/// access"; flow:to_server,established; uricontent:"/cgi-bin///"; nocase; rawbytes; reference:nessus,11032; classtype:attempted-recon; sid:1144; rev:7
#alert tcp $EXTERNAL_NET any -> $HOME_NET 8090 (msg:"WEB-MISC TrackerCam ComGetLogFile.php3 directory traversal attempt"; flow:to_server,established; content:"/ComGetLogFile.php3"; distance:0; nocase; pcre:"/fn=\x2e\x2e(\x2f|\x5c)/Rmsi"; reference:bugtraq,12592; reference:cve,2005-0481; classtype:web-application-attack; sid:3544; rev:2
#alert tcp $EXTERNAL_NET any -> $HOME_NET 8090 (msg:"WEB-MISC TrackerCam ComGetLogFile.php3 log information disclosure"; flow:to_server,established; content:"/ComGetLogFile.php3"; nocase; pcre:"fn=Eye\d{4}_\d{2}.log/Rmsi"; reference:bugtraq,12592; reference:cve,2005-0481; classtype:web-application-activity; sid:3545; rev:2

出错信息：
[root@localhost ~]# tail -f /var/log/messages
Mar  5 21:34:06 localhost snort[647]:     Alert if memcap exceeded DISABLED
Mar  5 21:34:06 localhost snort[647]:  
Mar  5 21:34:06 localhost snort[647]: DNS config:  
Mar  5 21:34:06 localhost snort[647]:     DNS Client rdata txt Overflow Alert: ACTIVE
Mar  5 21:34:06 localhost snort[647]:     Obsolete DNS RR Types Alert: INACTIVE
Mar  5 21:34:06 localhost snort[647]:     Experimental DNS RR Types Alert: INACTIVE
Mar  5 21:34:06 localhost snort[647]:     Ports:
Mar  5 21:34:06 localhost snort[647]:  53
Mar  5 21:34:06 localhost snort[647]:  
Mar  5 21:34:07 localhost snort[647]: FATAL ERROR: (/etc/snort/rules/web-misc.rules)97 => Cannot use 'rawbytes' and 'http_uri' as modifiers for the same "content" nor use 'rawbytes' with "uricontent".


[root@localhost ~]# tail -f /var/log/messages
Mar  5 21:42:37 localhost snort[707]:     Alert if memcap exceeded DISABLED
Mar  5 21:42:37 localhost snort[707]:  
Mar  5 21:42:37 localhost snort[707]: DNS config:  
Mar  5 21:42:37 localhost snort[707]:     DNS Client rdata txt Overflow Alert: ACTIVE
Mar  5 21:42:37 localhost snort[707]:     Obsolete DNS RR Types Alert: INACTIVE
Mar  5 21:42:37 localhost snort[707]:     Experimental DNS RR Types Alert: INACTIVE
Mar  5 21:42:37 localhost snort[707]:     Ports:
Mar  5 21:42:37 localhost snort[707]:  53
Mar  5 21:42:37 localhost snort[707]:  
Mar  5 21:42:38 localhost snort[707]: FATAL ERROR: ERROR /etc/snort/rules/web-misc.rules Line 452 => unable to parse pcre regex "fn=Eye\d{4}_\d{2}.log/Rmsi

第二，snort这个东西具体使用方法是怎样的？

yuguo

1)不知道snort.conf包含哪些规则，包含其他http规则类似的带pcre的是否有相同的情况。
2)snort规则升级一般使用oinkmaster,在snort注册并get code做cron每天自动升级规则就可以。
规则取舍需要根据自己网络具体情况，一般把snort.conf最后一句include threshold.conf打开，不用的规则可以抑制。

jerrywjl

不是非常明白，这些规则的格式，我附件出来看能否提供一些相关的资料参考。

qditnet

发扬楼主精神，不怕错，只怕不做．

anaconda

光看LZ发的这些帖子的长度，就知道真的是花了大量时间和精力的。赞一个先！