Snort 安装指南

snort 安装指南

 

一. 准备

   1 ．安装 apache, mysql(我是安装在 /opt 目录下的，略)

   2 ．安装 php

1). 安装 zlib

          ./configure --prefix=/opt/zlib- --shared

          make && make install

      2). 安装 gd

          a. 安装 libpng

          b. 安装 jpeg

             ./configure --prefix=/opt/jpeg- --enable-shared

             make && make test

            (if 'make' says it can't find ./libtool, then modify LIBTOOL=./libtool to LIBTOOL=/usr/bin/libtool in Makefile)

            mkdir -p /opt/jpeg-/bin /opt/jpeg-/man/man1 \

/opt/jpeg-/include /opt/jpeg-/lib

            # 我不知道，为什么会这样：jpeg 的 make install

            # 不会自动创建上述目录。

            make install && make install-lib && make install-headers

         # export PATH=/opt/libpng-/bin:$PATH

         # CPPFLAGS=-I/opt/libpng-/include ./configure

           --prefix=/opt/gd- \

           --with-png=/opt/libpng- \

           --with-jpeg=/opt/jpeg-

      3). 安装 php

           下载并安装 MySQL-shared-community ([url]www.mysql.com[/url])

          # cp /usr/lib64/libmysqlclient_r.so* /opt/mysql/lib/mysql/

          # ./configure --prefix=/opt/php- 5.2.2 \

            --with-apxs2=/opt/apache2/bin/apxs \

            --with-mysql=/opt/mysql \

            --with-gd=/opt/gd- \

            --with-jpeg-dir=/opt/jpeg- \

            --with-png-dir=/opt/libpng- \

            --with-zlib-dir=/opt/zlib- \

            --enable-sockets \

            --enable-url-includes \

            --enable-track-vars

          添加下面两行到 httpd.conf:

         # LoadModule foo foo.so( 如果 httpd.conf 已经包含      

         # LoadModule 语句，则不需要该行)

         AddType application/x-httpd-php .php

         # make && make test && make install

         # cp php.ini-dist /opt/php-/lib/php.ini

          修改 php.ini: mysql.sock=/tmp/mysql.sock(根据 MySQL

         的安装配置设置mysql.sock)

         # echo "" > /opt/apache2/htdocs/test.php

         检查是否能够正常浏览 test.php

      4). 安装 pcre

5). 安装 libdnet

6). 安装 libnet

 

二．安装和配置 snort

1. 安装

# export PATH=/opt/libdnet-/bin:/opt/\

libnet-/bin:$PATH

# ./configure --prefix=/opt/snort- 2.6.1 .4 \

--with-mysql=/opt/mysql \

--with-libpcre-includes=/opt/pcre-/include \

--with-libpcre-libraries=/opt/pcre-/lib \

--with-dnet-includes=/opt/libdnet-/include \

--with-dnet-libraries=/opt/libdnet-/lib \

--with-libnet-includes=/opt/libnet-/include/ \

--with-libnet-libraries=/opt/libnet-/lib \

--enable-gre \

--enable-flexresp2 \

--enable-react \

--enable-dynamicplugin

      

      建立 snort 用户及相关目录

# groupadd snort

# useradd -g snort snort -s /sbin/nologin

# mkdir /etc/snort

# mkdir /etc/snort/rules

# mkdir /var/log/snort

# cd etc/

# cp * /etc/snort

     

      下载并安装 rules

# tar -zxvf snortrules-snapshot-CURRENT.tar.gz

# cd rules

# cp * /etc/snort/rules/

 

  2. 配置

  修改 /etc/snort/snort.conf

var HOME_NET

var EXTERNAL_NET !$HOME_NET

preprocessor stream4_reassemble

preprocessor stream4_reassemble: both,ports 21 23 25

53 80 110 111 139 143 445 513 1433

output database: log, mysql, user=snort password= dbname=snort host=localhost

 

     配置自动启动

# cd  /etc/init.d

# wget [url]http://internetsecurityguru.com/snortinit/snort[/url]

# chmod 755 snort

# chkconfig snort on.

 

     配置 MySQL

mysql>create database snort;

mysql>grant insert,select on root.* to snort@localhost;

mysql>set password for snort@localhost=password

('pwforsnort');

mysql>grant create,insert,select,delete,update on snort.*

to snort@localhost;

mysql>grant create,insert,select,delete,update on snort.*

to snort;

 

mysql -u admin -p < /opt/software/snort/snort-

2.6.1 .4/schemas/create_mysql snort

mysql>show databases;

mysql>use snort;

mysql>show tables;

 

三．安装 BASE

    1. 安装 PEAR 软件包

         修改 php.ini： "include_path=.:/opt/php-/lib/php"

         从 pear.php.net 下载下面的三个包: Image_Canvas Image_Color

        Image_Graph

         安装包：# pear install Image*

    2. 安装 ADODB

         从 sf.net 上下载

        # mv adodb.tgz /opt/apache2/htdocs/

        # tar -zxvf adodb.tgz

     3. 安装 BASE

         从 sf.net 上下载

    # mv base- /opt/apache2/htdocs/base

        # cp base/base_config.php.dist base/base_config.php

         修改 base_config.php

              $BASE_urlpath = "/base";

              $DBlib_path = "/var/www/adodb/ ";

              $DBtype = "mysql";

              $alert_dbname = "snort";

              $alert_host = "localhost";

              $alert_port = "";

              $alert_user = "snort";

              $alert_password = "password_from_snort_conf";

     4. 初始化 BASE

打开 [url]http://yourip/base[/url]

点击 “ setup page ” 链接，在 “ setup page ” 上

点击 “setup BASE AG ”

     5. 提示: /etc/snort/snort.conf 文件中的 /usr/local/lib... 可能会

        引起问题，如果那样，修改这些

        /usr/local/lib... 为正确的路径即可

 

四．安装 oinkmaster ( 以自动更新 rules)

    # mkdir – p /opt/oinkmaster-/etc \

          /opt/oinkmaster-/bin /etc/snort/backup

# chown -R snort:snort /etc/snort/rules /etc/snort/backup

    # cp oinkmaster-/oinkmaster.pl /opt/oinkmaster-/bin/

    # cp oinkmaster-/contrib/*.pl /opt/oinkmaster-/bin/

    # cp oinkmaster-/oinkmaster.conf /opt/oinkmaster-/etc/

    添加如下行到 oinkmaster.conf:

       url = [url]http://www.snort.org/pub-bin/oinkmaster.cgi//snortrules-snapshot-CURRENT.tar.gz

       url = [url]http://www.snort.org/pub-bin/downloads.cgi/Download/[/url]

comm_rules/Community-Rules-CURRENT.tar.gz

       url = [url]http://www.bleedingsnort.com/bleeding.rules.tar.gz[/url]

    # cd /etc

    # /opt/oinkmaster-/bin/makesidex.pl \

      /etc/snort/rules > autodisable.conf

    创建脚本 oinkdaily 并加入到 crontab

      # cat /opt/oinkmaster/bin/oinkdaily

        #!/bin/bash

        #

        /opt/oinkmaster-/bin/oinkmaster.pl \

           -C /opt/oinkmaster-/etc/oinkmaster.conf \

-C /etc/autodisable.conf -o /etc/snort/rules \

-b /etc/snort/backup 2>&1 \

| mail -s "oinkmaster" [email][email protected][/email]

      # crontab -u snort -e

        30 5 * * * /opt/ oinkmaster-/bin/oinkdaily

        修改 /etc/resolv.conf 和 iptables 以便 crontab 能够发邮件到 

        [email][email protected][/email]

 

注:对于很简单的软件安装,./configure & make & make install 就可以搞定

   的， 没有写出详细的步骤。