[置顶] 从僵尸网络追踪到入侵检测 第1章环境搭建

 

在RHEL6.4安装Honeyd

一、前期准备工作（注意：红色字）

 

1、先卸载冲突rpm包

[root@MIGUANG yum.repos.d]# yum remove libevent libevent-devel libdnet libdnet-devel

Loaded plugins: product-id, refresh-packagekit, security, subscription-manager

This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.

Setting up Remove Process

No Match for argument: libevent-devel

No Match for argument: libdnet

No Match for argument: libdnet-devel

Resolving Dependencies

--> Running transaction check

---> Package libevent.x86_64 0:1.4.13-4.el6 will be erased

--> Processing Dependency: libevent-1.4.so.2()(64bit) for package: 1:nfs-utils-1.2.3-36.el6.x86_64

--> Processing Dependency: libevent for package: 1:nfs-utils-1.2.3-36.el6.x86_64

--> Running transaction check

---> Package nfs-utils.x86_64 1:1.2.3-36.el6 will be erased

--> Processing Dependency: nfs-utils for package: ipa-client-3.0.0-25.el6.x86_64

--> Processing Dependency: nfs-utils >= 1.2.1-11 for package: nfs-utils-lib-1.1.5-6.el6.x86_64

--> Running transaction check

---> Package ipa-client.x86_64 0:3.0.0-25.el6 will be erased

---> Package nfs-utils-lib.x86_64 0:1.1.5-6.el6 will be erased

--> Finished Dependency Resolution

 

Dependencies Resolved

 

==============================================================================================

 Package    Arch   Version      Repository                                               Size

==============================================================================================

Removing:

 libevent   x86_64 1.4.13-4.el6 @anaconda-RedHatEnterpriseLinux-201301301459.x86_64/6.4 227 k

Removing for dependencies:

 ipa-client x86_64 3.0.0-25.el6 @anaconda-RedHatEnterpriseLinux-201301301459.x86_64/6.4 297 k

 nfs-utils  x86_64 1:1.2.3-36.el6

                                @anaconda-RedHatEnterpriseLinux-201301301459.x86_64/6.4 977 k

 nfs-utils-lib

            x86_64 1.1.5-6.el6  @anaconda-RedHatEnterpriseLinux-201301301459.x86_64/6.4 149 k

 

Transaction Summary

==============================================================================================

Remove        4 Package(s)

 

Installed size: 1.6 M

Is this ok [y/N]: y

Downloading Packages:

Running rpm_check_debug

Running Transaction Test

Transaction Test Succeeded

Running Transaction

Warning: RPMDB altered outside of yum.

  Erasing    : ipa-client-3.0.0-25.el6.x86_64                                             1/4 

  Erasing    : 1:nfs-utils-1.2.3-36.el6.x86_64                                            2/4 

  Erasing    : nfs-utils-lib-1.1.5-6.el6.x86_64                                           3/4 

  Erasing    : libevent-1.4.13-4.el6.x86_64                                               4/4 

  Verifying  : nfs-utils-lib-1.1.5-6.el6.x86_64                                           1/4 

  Verifying  : libevent-1.4.13-4.el6.x86_64                                               2/4 

  Verifying  : ipa-client-3.0.0-25.el6.x86_64                                             3/4 

  Verifying  : 1:nfs-utils-1.2.3-36.el6.x86_64                                            4/4 

 

Removed:

  libevent.x86_64 0:1.4.13-4.el6                                                              

 

Dependency Removed:

  ipa-client.x86_64 0:3.0.0-25.el6                nfs-utils.x86_64 1:1.2.3-36.el6             

  nfs-utils-lib.x86_64 0:1.1.5-6.el6             

 

Complete!

 

2、安装Honeyd前需要用的rpm包

[root@MIGUANG yum.repos.d]# yum install autoconf gcc python-devel

Loaded plugins: product-id, refresh-packagekit, security, subscription-manager

This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.

Setting up Install Process

Resolving Dependencies

--> Running transaction check

---> Package autoconf.noarch 0:2.63-5.1.el6 will be installed

---> Package gcc.x86_64 0:4.4.7-3.el6 will be installed

--> Processing Dependency: cpp = 4.4.7-3.el6 for package: gcc-4.4.7-3.el6.x86_64

--> Processing Dependency: glibc-devel >= 2.2.90-12 for package: gcc-4.4.7-3.el6.x86_64

--> Processing Dependency: cloog-ppl >= 0.15 for package: gcc-4.4.7-3.el6.x86_64

---> Package python-devel.x86_64 0:2.6.6-36.el6 will be installed

--> Running transaction check

---> Package cloog-ppl.x86_64 0:0.15.7-1.2.el6 will be installed

--> Processing Dependency: libppl_c.so.2()(64bit) for package: cloog-ppl-0.15.7-1.2.el6.x86_64

--> Processing Dependency: libppl.so.7()(64bit) for package: cloog-ppl-0.15.7-1.2.el6.x86_64

---> Package cpp.x86_64 0:4.4.7-3.el6 will be installed

--> Processing Dependency: libmpfr.so.1()(64bit) for package: cpp-4.4.7-3.el6.x86_64

---> Package glibc-devel.x86_64 0:2.12-1.107.el6 will be installed

--> Processing Dependency: glibc-headers = 2.12-1.107.el6 for package: glibc-devel-2.12-1.107.el6.x86_64

--> Processing Dependency: glibc-headers for package: glibc-devel-2.12-1.107.el6.x86_64

--> Running transaction check

---> Package glibc-headers.x86_64 0:2.12-1.107.el6 will be installed

--> Processing Dependency: kernel-headers >= 2.2.1 for package: glibc-headers-2.12-1.107.el6.x86_64

--> Processing Dependency: kernel-headers for package: glibc-headers-2.12-1.107.el6.x86_64

---> Package mpfr.x86_64 0:2.4.1-6.el6 will be installed

---> Package ppl.x86_64 0:0.10.2-11.el6 will be installed

--> Running transaction check

---> Package kernel-headers.x86_64 0:2.6.32-358.el6 will be installed

--> Finished Dependency Resolution

 

Dependencies Resolved

 

==============================================================================================

 Package                 Arch            Version                  Repository             Size

==============================================================================================

Installing:

 autoconf                noarch          2.63-5.1.el6             rhel-Package          781 k

 gcc                     x86_64          4.4.7-3.el6              rhel-Package           10 M

 python-devel            x86_64          2.6.6-36.el6             rhel-Package          168 k

Installing for dependencies:

 cloog-ppl               x86_64          0.15.7-1.2.el6           rhel-Package           93 k

 cpp                     x86_64          4.4.7-3.el6              rhel-Package          3.7 M

 glibc-devel             x86_64          2.12-1.107.el6           rhel-Package          974 k

 glibc-headers           x86_64          2.12-1.107.el6           rhel-Package          604 k

 kernel-headers          x86_64          2.6.32-358.el6           rhel-Package          2.3 M

 mpfr                    x86_64          2.4.1-6.el6              rhel-Package          156 k

 ppl                     x86_64          0.10.2-11.el6            rhel-Package          1.3 M

 

Transaction Summary

==============================================================================================

Install      10 Package(s)

 

Total download size: 20 M

Installed size: 41 M

Is this ok [y/N]: y

 

二、下载安装需要的源码包

1）第1个源码包

[root@MIGUANG tmp]# wget http://monkey.org/~provos/libevent-1.3a.tar.gz

--2016-01-08 14:40:28--  http://monkey.org/~provos/libevent-1.3a.tar.gz

Resolving monkey.org... 75.102.5.19

Connecting to monkey.org|75.102.5.19|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 445718 (435K) [application/x-gzip]

Saving to: “libevent-1.3a.tar.gz”

 

100%[====================================================>] 445,718     28.2K/s   in 17s     

 

2016-01-08 14:40:51 (26.3 KB/s) - “libevent-1.3a.tar.gz” saved [445718/445718]

2）第2个源码包

[root@MIGUANG tmp]# wget http://nchc.dl.sourceforge.net/project/libdnet/libdnet/libdnet-1.11/libdnet-1.11.tar.gz

--2016-01-08 14:48:33--  http://nchc.dl.sourceforge.net/project/libdnet/libdnet/libdnet-1.11/libdnet-1.11.tar.gz

Resolving nchc.dl.sourceforge.net... 211.79.60.17

Connecting to nchc.dl.sourceforge.net|211.79.60.17|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 446233 (436K) [application/x-gzip]

Saving to: “libdnet-1.11.tar.gz”

 

100%[====================================================>] 446,233      105K/s   in 4.1s    

 

2016-01-08 14:48:38 (105 KB/s) - “libdnet-1.11.tar.gz” saved [446233/446233]

3）第3个源码包

[root@MIGUANG tmp]# wget http://www.citi.umich.edu/u/provos/honeyd/arpd-0.2.tar.gz

--2016-01-08 14:52:21--  http://www.citi.umich.edu/u/provos/honeyd/arpd-0.2.tar.gz

Resolving www.citi.umich.edu... 141.212.112.111

Connecting to www.citi.umich.edu|141.212.112.111|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 49437 (48K) [application/x-gzip]

Saving to: “arpd-0.2.tar.gz”

 

100%[====================================================>] 49,437      59.6K/s   in 0.8s    

2016-01-08 14:52:28 (59.6 KB/s) - “arpd-0.2.tar.gz” saved [49437/49437]

三、安装下载好的源码包

1）安装源码包libevent-1.3a.tar.gz 

 

[root@MIGUANG tmp]# tar -zxvf libevent-1.3a.tar.gz  --解压源码包

[root@MIGUANG tmp]# cd libevent-1.3a

[root@MIGUANG libevent-1.3a]# ./configure  ---检测是否能安装通过

configure: creating ./config.status

config.status: creating Makefile

config.status: creating test/Makefile

config.status: creating sample/Makefile

config.status: creating config.h

config.status: executing depfiles commands ---检测通过

[root@MIGUANG libevent-1.3a]# make && make install   ---编译并安装

 

2）安装源码包libdnet-1.11.tar.gz

 

[root@MIGUANG tmp]# tar -zxvf libdnet-1.11.tar.gz  --解压源码包

[root@MIGUANG tmp]# cd libdnet-1.11

[root@MIGUANG libdnet-1.11]# ./configure  ---检测是否能安装通过

configure: creating ./config.status

config.status: creating Makefile

config.status: creating dnet-config

config.status: creating include/Makefile

config.status: creating include/dnet/Makefile

config.status: creating man/Makefile

config.status: creating src/Makefile

config.status: creating python/Makefile

config.status: creating python/setup.py

config.status: creating test/Makefile

config.status: creating test/check/Makefile

config.status: creating test/dnet/Makefile

config.status: creating include/config.h

config.status: executing depfiles commands

config.status: executing default commands     ---检测通过

[root@MIGUANG libdnet-1.11]# make && make install  ---编译并安装

 

3）安装源码包arpd-0.2.tar.gz

 

1、[root@MIGUANG tmp]# tar zxvf arpd-0.2.tar.gz  --解压源码包

 

2、下载gcc 4.0 版本的arpd.c文件

[root@MIGUANG tmp]# wget http://www.honeynet.ir/software/honeyd/arpd.c

--2016-01-08 15:24:14--  http://www.honeynet.ir/software/honeyd/arpd.c

Resolving www.honeynet.ir... 115.124.123.25

Connecting to www.honeynet.ir|115.124.123.25|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 11492 (11K) [text/x-c]

Saving to: “arpd.c”

 

100%[====================================================>] 11,492      --.-K/s   in 0.005s  

 

2016-01-08 15:24:35 (2.30 MB/s) - “arpd.c” saved [11492/11492]

 

3、[root@MIGUANG arpd]# mv arpd.c arpd.bak --将原有的arpd.c文件重命名

4、[root@MIGUANG arpd]# mv ../arpd.c ./arpd.c --将下载好的arpd.c文件移动arpd文件夹中

5、[root@MIGUANG arpd]# ./configure  --检测未通过，提示libpcap版本不对（因系统已经带有这个包，如要查询使用rpm -qa libpcap）

configure: error: libpcap not found    

删除原有安装的libpcap包

6、[root@MIGUANG arpd]# yum remove libpcap

7、下载libpcap源码包

[root@MIGUANG tmp]# wget http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz

--2016-01-08 15:37:22--  http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz

Resolving www.tcpdump.org... 132.213.238.6, 192.139.46.66

Connecting to www.tcpdump.org|132.213.238.6|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 581984 (568K) [application/x-gzip]

Saving to: “libpcap-1.1.1.tar.gz”

 

100%[====================================================>] 581,984     69.6K/s   in 9.9s    

 

2016-01-08 15:37:33 (57.5 KB/s) - “libpcap-1.1.1.tar.gz” saved [581984/581984]

 

8、解压libpcap源码包

[root@MIGUANG tmp]# tar -zxvf libpcap-1.1.1.tar.gz

9、编译并安装libpcap源码包

[root@MIGUANG tmp]# cd libpcap-1.1.1

[root@MIGUANG libpcap-1.1.1]# ./configure

编译提示错误缺少flex包

configure: error: Your operating system's lex is insufficient to compile

 libpcap.  flex is a lex replacement that has many advantages, including

 being able to compile libpcap.  For more information, see

 http://www.gnu.org/software/flex/flex.html .

解决办法：[root@MIGUANG libpcap-1.1.1]# yum install -y flex

在次检测

[root@MIGUANG libpcap-1.1.1]# ./configure --检测通过

config.status: creating Makefile

config.status: creating pcap-filter.manmisc

config.status: creating pcap-linktype.manmisc

config.status: creating pcap-savefile.manfile

config.status: creating pcap.3pcap

config.status: creating pcap_compile.3pcap

config.status: creating pcap_datalink.3pcap

config.status: creating pcap_dump_open.3pcap

config.status: creating pcap_list_datalinks.3pcap

config.status: creating pcap_open_dead.3pcap

config.status: creating pcap_open_offline.3pcap

config.status: creating config.h

10、使用make编译

[root@MIGUANG libpcap-1.1.1]# make

yacc -d grammar.y

make: yacc: Command not found

make: *** [grammar.c] Error 127

报错解决：[root@MIGUANG libpcap-1.1.1]# yum install -y byacc

11、使用make install 安装源码包

[root@MIGUANG libpcap-1.1.1]# make install

12、解决了arpd源码包依赖的关系继续安装arpd源码包

[root@MIGUANG arpd]# ./configure    ---检测通过

configure: creating ./config.status

config.status: creating Makefile

config.status: creating config.h

13、编译并安装

[root@MIGUANG arpd]# make && make install

14、检测安装是否成功使用arpd命令

arpd: error while loading shared libraries: libevent-1.3a.so.1: cannot open shared object file: No such file or directory

解决办法：[root@MIGUANG ~]# cd /usr/local/lib

[root@MIGUANG lib]# cp libevent-1.3a.so.1 /usr/lib64/

arpd: error while loading shared libraries: libpcap.so.1: cannot open shared object file: No such file or directory

解决办法：[root@MIGUANG ~]# cd /usr/local/lib

[root@MIGUANG lib]# cp libpcap.so.1 /usr/lib64/

15、在次运行arpd命令成功

[root@MIGUANG lib]# arpd

arpd[22459]: listening on eth0: arp  and not ether src 00:0c:29:0b:cf:2a

以上是Honeyd运行环境搭建好了。

 

4）安装Honeyd

1、下载Honeyd源码包

[root@MIGUANG tmp]# wget http://www.honeyd.org/uploads/honeyd-1.5c.tar.gz

 

2、解压Honeyd源码包

[root@MIGUANG tmp]# tar -zxvf honeyd-1.5c.tar.gz 

3、检测运行环境

[root@MIGUANG tmp]# cd honeyd-1.5c

[root@MIGUANG honeyd-1.5c]# ./configure 

configure: error: need either libedit or libreadline; install one of them

解决办法：yum install -y readline readline-devel

configure: error: zlib ismissing - you need to install it

解决办法：yum -y install zlib-devel

configure: error: Couldn't figure out how to access libc

解决办法：将configure文件中/lib/libc.so出现的地方改为/lib64/libc.so

4、在次检测运行环境

configure: creating ./config.status

config.status: creating Makefile

config.status: creating regress/Makefile

config.status: creating pypcap/Makefile

config.status: creating config.h

config.status: executing depfiles commands

5、编译并安装

[root@MIGUANG honeyd-1.5c]# make && make install

6、搭建安装环境Honeyd结束

make[2]: Leaving directory `/tmp/honeyd-1.5c'

make[1]: Leaving directory `/tmp/honeyd-1.5c'