入侵检测系统Snort+Base安装

zqli

入侵检测系统Snort+Base安装

安装一些支持库
tar -zxvf zlib-1.2.3.tar.gz
cd zlib-1.2.3
./configure
make
make install
cd ..
tar -zxvf libpcap-0.9.5.tar.gz
cd libpcap-0.9.5
./configure
make
make install
cd ..

安装MYSQL
# groupadd mysql
# useradd -g mysql -d /usr/local/mysql/data -M mysql
# tar -zxvf mysql-5.0.27.tar.gz
# cd mysql-5.0.27
./configure --prefix=/usr/local/mysql \                 指定安装目录
> --sysconfdir=/etc \                               配置文件的路径
> --localstatedir=/usr/local/mysql/data \                数据库存放的路径
> --enable-assembler \                              使用一些字符函数的汇编版本
> --with-mysqld-ldflags=-all-static \                   以纯静态方式编译服务端
> --with-charset=gb2312 \                           添加gb2312字符支持
> --with-extra-charsets=all                           添加所有字符支持
# make
# make install
# /usr/local/mysql/bin/mysql_install_db
# chown -R mysql:mysql /usr/local/mysql/data
# cp /usr/local/mysql/share/mysql/mysql.server /etc/rc.d/init.d/mysqld
# chkconfig --add mysqld
# cp /usr/local/mysql/share/mysql/my-medium.cnf /etc/my.cnf

[root@fedora snort]# /usr/local/mysql/bin/mysqladmin -u root password 'gzidc'

Linux下执行程序时发生错误: cannot restore segment prot after reloc: Permission denied
原来这是SELinux搞的鬼，解决办法有两个:
1. 使用chcon 命令 示例: chcon -t texrel_shlib_t /usr/local/rsi/idl_6.1/bin/bin.linux.x86/*.so
2. 禁止掉SELinux 更改/etc/sysconfig/selinux 文件的内容为 SELINUX=disabled
这个问题参考了以下链接 http://www.rsinc.com/services/techtip.asp?ttid=3092

安装Apache
tar -zvxf httpd-2.2.3.tar.gz
cd httpd-2.2.3
./configure --prefix=/usr/local/apache --enable-so
make
make install

安装PHP
tar zxvf php-5.2.tar.gz
cd php-5.2
./configure --prefix=/usr/local/php5 --with-apxs2=/usr/local/apache/bin/apxs --with-config-file-path=/usr/local/php5/etc --enable-sockets --with-mysql=/usr/local/mysql --with-zlib --with-gd
make
make install

cp ./php.ini-dist /usr/local/php5/etc/php.ini

修改httpd.conf
#vi /usr/local/apache/conf/httpd.conf

加载php模块，去掉注释“＃”，如没有此行，请加上。
LoadModule php5_module        modules/libphp5.so
加上此两行
AddType application/x-httpd-php .php .phtml
AddType application/x-httpd-php-source .phps
# /usr/local/apache/bin/apachctl start

安装Snort
[root@fedora src]# mkdir /usr/local/snort
[root@fedora src]# mkdir /var/log/snort
[root@fedora src]# tar -zxvf snort-2.6.1.tar.gz
[root@fedora src]# cd snort-2.6.1
./configure --prefix=/usr/local/snort --with-mysql=/usr/local/mysql/
make
make install
cd /usr/local/snort
[root@fedora snort]# tar -zxvf snortrules-snapshot-CURRENT.tar.gz
[root@fedora snort]# cp /usr/local/src/snort-2.6.1/etc/snort.conf /usr/local/snort/
[root@fedora snort]# cp /usr/local/src/snort-2.6.1/etc/*.config /usr/local/snort/
修改snort.conf
var HOME_NET 10.1.1.0/24　　
var RULE_PATH ./rules 修改为 var RULE_PATH /usr/local/snort/rules
改变记录日志数据库：
output database: log, mysql, user=root password=your_password dbname=snort host=localhost
cd /usr/local/src/snort-2.6.1/schemas
[root@fedora schemas]# /usr/local/mysql/bin/mysqladmin -u root -p create snort
[root@fedora schemas]# /usr/local/mysql/bin/mysqladmin -u root -p create snort_archive
[root@fedora schemas]# /usr/local/mysql/bin/mysql -u root -p snort < create_mysql
[root@fedora schemas]# /usr/local/mysql/bin/mysql -u root -p snort_archive < create_mysql

安装ADODB
[root@fedora schemas]# cd /usr/local/
# tar zxvf adodb493a.gz

安裝BASE
#cd /usr/local/src/snortinstall
#cp base-1.1.2.tar.gz /usr/local/apache2/htdocs/
#cd /usr/local/apache2/htdocs
#tar –xvzf base-1.1.2.tar.gz
#rm –rf base-1.1.2.tar.gz
#mv base-1.1.2 base

接下来这些步骤不必做，如果您做了，安装base时，一样必须将base_conf.php移开。不过将设定值记好，等一下用浏览器安装
base時用得着。
cp base_conf.php.dist base_conf.php
edit the “base_conf.php” file and insert the following perimeters
$BASE_urlpath = "/base";
$DBlib_path = "/usr/local/adodb ";
$DBtype = "mysql";
$alert_dbname = "snort";
$alert_host = "localhost";
$alert_port = "";
$alert_user = "root";
$alert_password = "password_of_root_mysql";
/* Archive DB connection parameters */
$archive_exists = 0; # Set this to 1 if you have an archive DBcd /var/www/html/base/

# /usr/local/php5/bin/pear install Image_Color-1.0.2.tgz
# /usr/local/php5/bin/pear install Image_Canvas-0.3.0.tgz
# /usr/local/php5/bin/pear install Numbers_Roman-1.0.1.tgz
# /usr/local/php5/bin/pear install Numbers_Words-0.15.0.tgz
# /usr/local/php5/bin/pear install Image_Graph-0.7.2.tgz


运行snort
# /usr/local/snort/bin/snort -dev -c /usr/local/snort/snort.conf

查看mysql运行的进程
mysql> show processlist;

                                                                                                     LEO
                                                                                                      2007-1-3

[ 本帖最后由 zqli 于 2007-1-3 13:22 编辑 ]

zqli

自己先顶!!!

zqli

再顶！！！!!!!

[ 本帖最后由 zqli 于 2007-5-10 11:33 编辑 ]