搭建snort+BASE入侵检测系统

1. 安装snort

1. 安装 DAQ
   2）安装snort
   3) 测试

4) 创建用户环境&配置文件目录&复制配置文件

5) 手动修改 snort.conf 配置

6) 添加本地规则

1. sudo vi /etc/snort/rules/local.rules
2. alert icmp any any -> $HOME_NET any (msg:"ICMP Test detected!!!"; classtype:icmpevent; sid:10000001; rev:001; GID:1; )
3. sudo vi /etc/snort/sid-msg.map
4. #v2
5. 1 || 10000001 || 001 || icmp-event || 0 || ICMP Test detected || url,tools.ietf.org/html/rfc792

7. 测试配置文件
   8) 测试功能
   sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i ens33
   首先查看主机 ip 地址

此时从外面 ping 网口 ens33 的 IP， snort 会记录受到攻击，信息保存在
/var/log/snort 中，文件名为 snort.log.xxx

2. 安装Barnyard2

1. 安装 mysql

1. sudo apt-get install -y mysql-server libmysqlclient-dev mysql-client autoconf libtool

2. 解压编译
   
   

2. ./configure --with-mysql --with-mysql-libraries=/usr/lib/x86_64-linux-gnu
3. ./configure --with-mysql --with-mysql-libraries=/usr/lib/i386-linux-gnu
4. sudo make && sudo make install

3. 测试
   4) 设置配置文件

5. sudo cp ~/barnyard2-2-1.13/etc/barnyard2.conf /etc/snort/
6. # the /var/log/barnyard2 folder is never used or referenced
7. # but barnyard2 will error without it existing
8. sudo mkdir /var/log/barnyard2
9. sudo chown snort.snort /var/log/barnyard2
10. sudo touch /var/log/snort/barnyard2.waldo
11. sudo chown snort.snort /var/log/snort/barnyard2.waldo

5. 配置数据库

12. ubuntu@ubuntu:~$ mysql -u root -p
13. mysql> create database snort;
14. mysql> use snort;
15. mysql> source ~/barnyard2-2-1.13/schemas/create_mysql;
16. mysql> CREATE USER 'snort'@'localhost' IDENTIFIED BY '123456';
17. mysql> grant create, insert, select, delete, update on snort.* to 'snort'@'localhost';
18. mysql> exit;

6. 添加数据库配置

1. sudo vi /etc/snort/barnyard2.conf
2. #在末尾添加数据库配置
3. output database: log, mysql, user=snort password=123456 dbname=snort host=localhost senso
r name=sensor01
4. 修改 barnyard2.conf 权限防止被修改
5. sudo chmod o-r /etc/snort/barnyard2.conf 

7. 测试

1. # 开启 snort，并向 eth1 发送 ping 数据包
2. sudo snort -q -u snort -g snort -c /etc/snort/snort.conf -i ens33
3. # 开启 barnyard2，将日志信息存入数据库
4. # 1.连续处理模式，设置 barnyard2.waldo 为书签
5. sudo barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -
w /var/log/snort/barnyard2.waldo -g snort -u snort
6. # 2.文件处理模式，处理单个日志文件
7. sudo barnyard2 -c /etc/snort/barnyard2.conf -o /var/log/snort/snort.log.xxx
8. # 查看数据库条目数量，看是否增加
9. mysql -u snort -p -D snort -e "select count(*) from event"

3. 安装 PulledPork

1. 解压并安装

1. tar xzvf pulledpork-v0.7.3.tar.gz
2. cd pulledpork-v0.7.3/
3. sudo cp pulledpork.pl /usr/local/bin
4. sudo chmod +x /usr/local/bin/pulledpork.pl
5. sudo cp etc/*.conf /etc/snort

2. 测试

6. ubuntu@ubuntu:~$ pulledpork.pl -V
7. PulledPork v0.7.3 - Making signature updates great again!

3. 配置

8. sudo vi /etc/snort/pulledpork.conf
9. #第 19 行：输入注册账户生成的 oinkcode，若没有则注释掉
10. #第 29 行：取消注释可下载针对新兴威胁的规则
11. #第 74 行：更改为：
12. rule_path = /etc/snort/rules/snort.rules
13. #第 89 行：更改为：
14. local_rules = /etc/snort/rules/local.rules
15. #第 92 行：更改为：
16. sid_msg = /etc/snort/sid-msg.map
17. #第 96 行：更改为：
18. sid_msg_version = 2
19. #第 119 行：更改为：
20. config_path = /etc/snort/snort.conf
21. #第 133 行：更改为：
22. distro = Ubuntu-12-04
23. #第 141 行：更改为：
24. black_list = /etc/snort/rules/iplists/black_list.rules
25. #第 150 行：更改为：
26. 19. IPRVersion = /etc/snort/rules/iplists
27. sudo vi /etc/snort/snort.conf
28. #第 548 行添加
29. include $RULE_PATH/snort.rules

4. 更新规则

1. sudo /usr/local/bin/pulledpork.pl -c /etc/snort/pulledpork.conf -l

5. 测试规则

 1. sudo snort -T -c /etc/snort/snort.conf -i eth0

4. 创建服务

1. 创建 Snort 服务

1. sudo vi /lib/systemd/system/snort.service
2. [Unit]
3. Description=Snort NIDS Daemon
4. After=syslog.target network.target
5. [Service]
6. Type=simple
7. Restart=always
8. ExecStart=/usr/local/bin/snort -q -u snort -g snort -c /etc/snort/snort.conf -i ens33
9. [Install]
10. WantedBy=multi-user.target
11. sudo systemctl enable snort
12. sudo systemctl start snort
13. sudo systemctl status snort

2. 创建 Barnyard2 服务

1. sudo vi /lib/systemd/system/barnyard2.service
2. [Unit]
3. Description=Barnyard2 Daemon
4. After=syslog.target network.target
5. [Service]
6. Type=simple
7. Restart=always
8. ExecStart=/usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -q -
w /var/log/snort/barnyard2.waldo -g snort -u snort -D -a /var/log/snort/archived_logs --pidpath=/var/run
9. [Install]
10. WantedBy=multi-user.target
11. sudo systemctl enable barnyard2
12. sudo systemctl start barnyard2
13. sudo systemctl status barnyard2

5. 安装 BASE

1. 解压

1. tar xzvf base-1.4.5.tar.gz
2. sudo mv base-1.4.5 /var/www/html/base/

2. 配置

3. cd /var/www/html/base
4. sudo cp base_conf.php.dist base_conf.php
3.
5. sudo vi /var/www/html/base/base_conf.php
6. $BASE_Language = 'simplified_chinese'; # line 27
7. $BASE_urlpath = '/base'; # line 50
8. $DBlib_path = '/usr/share/php/adodb/'; #line 80
$alert_dbname = 'snort'; # line 102
9. $alert_host = 'localhost';
10. $alert_port = '';
11. $alert_user = 'snort';
12. $alert_password = '123456'; # line 106
13. // $graph_font_name = "Verdana";
14. // $graph_font_name = "DejaVuSans";
15. // $graph_font_name = "Image_Graph_Font";
16. $graph_font_name = "";
17.
18. sudo chown -R www-data:www-data /var/www/html/base
19. sudo chmod o-r /var/www/html/base/base_conf.php
20.
21. sudo service apache2 restart

浏览器访问 http://localhost/base 进行访问
根据提示进行最后的配置，进入 mainpage