snort

Snort是一个网络***检测系统，它可以分析网络上的数据包，用以决定一个系统是否被远程***了。多数Linux发行版本都有Snort程序，因此通过urpmi、apt-get、yum等安装Snort是一件很轻松的事情。Snort可以将其收集的信息写到多种不同的存储位置以便于日后的分析。此外，Snort可被用作一个简单的数据包记录器、嗅探器，当然它主要是一个成熟的NDIS(网络***检测系统)。

实验环境

centos6.8_x64

snort_master    192.168.1.101

windows_slave  192.168.1.102

测试 windows_slave ping 192.168.1.101 -t 不断发ping包

实验软件

adodb519.tar.gz

base-1.4.5.tar.gz

barnyard2-1.9.tar.gz

daq-2.0.4.tar.gz

libdnet-1.12.tgz

snort-2.9.7.0.tar.gz

snortrules-snapshot-2983.tar.gz

软件安装

yum install -y httpd mysql-server

yum install -y mcrypt libmcrypt libmcrypt-devel libpcap libpcap-devel

yum install -y gcc flex bison zlib libpcap tcpdump gcc-c++ pcre* zlib* libdnet libdnet-devel

yum install -y php php-mysql php-mbstring php-mcrypt mysql-devel php-gd php-pear

sed -i.bak  "s/#ServerName www.example.com:80/ServerName *:80/g" /etc/httpd/conf/httpd.conf   sed.bak为修改备份

ll  /etc/httpd/conf/httpd.conf

httpd.conf      httpd.conf.bak  

tar zxvf libdnet-1.12.tgz

cd libdnet-1.12

./configure && make && make install

 

tar zxvf daq-2.0.4.tar.gz
cd daq-2.0.4

./configure && make && make install

 

tar zxvf barnyard2-1.9.tar.gz

service mysqld start

mysqladmin  -uroot password  mysqlroot密码

mysql -uroot -pmysqlroot密码

create database snort;

grant create,select,update,insert,delete on snort.* to snort@localhost identified by 'snort';

mysql  -usnort  -psnort

mysql>

mysql -usnort -psnort -Dsnort < /root/barnyard2-1.9/schemas/create_mysql

cd  barnyard2-1.9

./configure  --with-mysql --with-mysql-libraries=/usr/lib64/mysql/

make &&  make install

mkdir -pv /var/log/barnyard2

mkdir -pv /var/log/snort

mkdir -pv /etc/snort

touch  /var/log/snort/barnyard2.waldo

cp -pv /root/barnyard2-1.9/etc/barnyard2.conf /etc/snort/

cp -pv  /etc/snort/barnyard2.conf /etc/snort/barnyard2.conf.bak

vim  /etc/snort/barnyard2.conf

config logdir:/var/log/barnyard2

config hostname:      localhost

config interface:       eth0  监听网卡

config waldo_file:/var/log/snort/barnyard2.waldo

output database: log, mysql, user=snort password=snort dbname=snort host=localhost

tar zxvf  snort-2.9.7.0.tar.gz

cd snort-2.9.7.0

./configure  && make && make install

mkdir -pv  /etc/snort

mkdir -pv  /var/log/snort

mkdir -pv  /usr/local/lib/snort_dynamicrules

mkdir -pv  /etc/snort/rules

mkdir -pv  /etc/snort/so_rules
mkdir -pv  /etc/snort/preproc_rules

touch /etc/snort/rules/white_list.rules /etc/snort/rules/black_list.rules

cp -pv  /root/snort-2.9.7.0/etc/gen-msg.map  /etc/snort/

cp -pv  /root/snort-2.9.7.0/etc/threshold.conf /etc/snort/

cp -pv  /root/snort-2.9.7.0/etc/classification.config /etc/snort/

cp -pv  /root/snort-2.9.7.0/etc/reference.config /etc/snort/

cp -pv  /root/snort-2.9.7.0/etc/unicode.map /etc/snort/

cp -pv  /root/snort-2.9.7.0/etc/snort.conf /etc/snort/

vim /etc/snort/snort.conf       

var RULE_PATH  /etc/snort/rules/

var SO_RULE_PATH /etc/snort/so_rules

var PREPROC_RULE_PATH /etc/snort/preproc_rules

var WHITE_LIST_PATH  /etc/snort/rules

var BLACK_LIST_PATH  /etc/snort/rules

config logdir: /var/log/snort

# output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types

output unified2: filename snort.log,limit 128

tar zxvf snortrules-snapshot-2983.tar.gz  -C  /etc/snort/

cp  -pv  /etc/snort/etc/sid-msg.map  /etc/snort/

 

snort -T -i eth0  -c /etc/snort/snort.conf  &

Snort successfully validated the configuration!
Snort exiting

 

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log  -w /var/log/snort/barnyard2.waldo  &

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo -D     &

snort -c /etc/snort/snort.conf -i eth0  -D  &

killall -9 snort   

killall -9 barnyard2   杀死进程

tar zxvf adodb519.tar.gz

tar zxvf base-1.4.5.tar.gz

mv /root/adodb5 /var/www/html/adodb

mv /root/base-1.4.5 /var/www/html/base

chown -R apache:apache /var/www/html/

chmod 755 /var/www/html/adodb/

touch /var/www/html/test.html

echo welcome to server > /var/www/html/test.html   建立apache测试页

sed -i  's/#AddType application/AddType application/g' /etc/httpd/conf/httpd.conf   配置apahce/php 结合

sed -i  '765 aAddType application/x-httpd-php .php' /etc/httpd/conf/httpd.conf 

765行插入AddType application/x-httpd-php .php配置   a为插入配置内容 

netstat -tuplna | grep mysql

tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      28424/mysqld  

 

netstat -tuplna | grep httpd

tcp        0      0 :::80                       :::*                        LISTEN      28460/httpd

ps -ef | grep snort

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo -D

snort -c /etc/snort/snort.conf -i eth0 -D

service mysqld restart

service httpd restart

chkconfig --level 35 httpd on

chkconfig --level 35 mysqld on

cp -pv /etc/snort/rules/local.rules /etc/snort/rules/local.rules.bak    添加测试规则

echo "alert icmp any any -> any any (msg: "IcmP Packet detected";sid:1000001;)" >> /etc/snort/rules/local.rules

cat /etc/snort/rules/local.rules | grep alert

alert icmp any any -> any any (msg: IcmP Packet detected;sid:1000001;)

touch /var/www/html/test.php      php测试页，测试完毕最好即可删除

echo "" >  /var/www/html/test.php

curl http://localhost/index.html

welcome to server

http://serverip/test.php

http://serviceip/base/setup/index.php

cp -pv /etc/rc.d/rc.local  /etc/rc.d/rc.local.bak   设置服务开机启动

echo "snort -T -i eth0  -c /etc/snort/snort.conf  &" >> /etc/rc.d/rc.local

echo "barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log  -w /var/log/snort/barnyard2.waldo  &" >> /etc/rc.d/rc.local

echo "barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo -D &"   >> /etc/rc.d/rc.local

echo "snort -c /etc/snort/snort.conf -i eth0 -D &" >> /etc/rc.d/rc.local

cat /etc/rc.d/rc.local

snort -T -i eth0  -c /etc/snort/snort.conf  &

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log  -w /var/log/snort/barnyard2.waldo  &

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo -D &

snort -c /etc/snort/snort.conf -i eth0 -D &