分享
 
 
 

构建小型的入侵检测系统(RedHat9)

王朝other·作者佚名  2008-05-18
窄屏简体版  字體: |||超大  

构建小型的入侵检测系统(RedHat9)

Snort+Apache+PHP4+MySQL+Acid

[-]=========================================[-]

Snort+Apache+PHP4+MySQL+Acid

[-]=====================================[-]

原作者:Patrick S.Harper 翻译整理:ids,mapple

声明:欢迎转载.

[-]=====================================[-]

一.系统平台

Redhat9.0发行版, 安装gcc 及相关库文件,建议不要安装

Apache,PHP,MySQL,我们将用源码编译安装。基于安全方面的

考虑,可以设置一下iptables只允许SSH和WWW访问。

二.软件

MySQL4.0.12 http://mysql.secsup.org

Snort2.0.0 http://www.snort.org

Apache2.0.45 http://www.apache.org

PHP4.3.1 http://www.php.net

ADODBv3.30 http://phplens.com

Acid0.9.6b23 http://acidlab.sourceforge.net

Zlib1.1.4 http://flow.dl.sourceforge.net

JPGraph1.11 http://jpgraph.techuk.com

LibPcap0.7.2 http://www.tcpdump.org

建议到这个站点下载http://ftp.cdut.edu.cn/pub/linux/NEW/

也可以到http://www.rpmfind.com下载相关的xx.src.rpm编译安装。如若安装了rpm包,可以强行将其反安装

rpm -e -nodeps xx.xx

三.安装(建议将所有的包文件考到同一目录)

1.安装zlib1.1.4

tar -xzvf zlib-xx.tar.gz

cd zlib-xx

./configure;make test

make install

cd ..

2.安装LibPcap0.7.2

tar -xzvf libpcap.tar.gz

cd libpcap-xx

./configure

make

make install

cd ..

3.安装MySQL4.0.12

3.1创建mysql组和mysql用户

groupadd mysql

useradd -g mysql mysql

修改/root下的.bash_profile的这一行:

PATH= $PATH: $HOME/bin 为

PATH= $PATH: $HOME/bin:/usr/local/mysql/bin

3.2安装mysql

tar -xzvf mysql-xx.tar.gz

cd mysql-xx

./configure --prefix=/usr/local/mysql

make

make install

cd scripts

./mysql_install_db

chown -R root /usr/local/mysql

chown -R mysql /usr/local/mysql/var

chgrp -R mysql /usr/local/mysql

cd ../support-files/my-medium.cnf /etc/my.cnf

向/etc/ld.so.conf中加入两行:/usr/local/mysql/lib/mysql

/usr/local/lib

载入库,执行

ldconfig -v

3.3测试mysql是否工作:

cd /usr/local/mysql/bin/

./mysqld_safe --user=mysql&

#ps -ef |grep mysql

看mysql_safe是否工作

3.4设置mysql为自启动:

将mysql安装目录下的support-files目录中的

mysql.server文件拷到/etc/init.d目录

cp mysql.server /etc/init.d/mysql

chmod 755 /etc/init.d/mysql

创建硬链接:

cd /etc/rc3.d(文本方式启动)

ln -s /etc/init.d/mysql S85mysql

ln -s /etc/init.d/mysql K85mysql

cd /etc/rc5.d (图形方式启动)

ln -s /etc/init.d/mysql S85mysql

ln -s /etc/init.d/mysql K85mysql

4.安装Apache2.0.45和PHP4.3.1

tar -zxvf httpd-2.0.xx.tar.gz

cd httpd_2.xx.xx

./configure --prefix=/www --enable-so

注:apache根目录为 /www

make

make install

cd ..

tar -zxvf php-4.3.x.tar.gz

cd php-4.3.x

./configure --prefix=/www/php --with-apxs2=/www/bin/apxs --with-config- filepath=/www/php --enable-sockets --with-mysql=/usr/local/mysql --with-zlibdir=/

usr/local --with- gd

注意:这些为一行,中间不要有回车。

cp php.ini-dist /www/php/php.ini

编辑httpd.conf(/www/conf):

加入两行

LoadModule php4_module modules/libphp4.so

AddType application/x-httpd-php .php

httpd.conf中相关内容如下:

#

# LoadModule foo_module modules/mod_foo.so

LoadModule php4_module modules/libphp4.so

# AddType allows you to tweak mime.types without actually editing it, or  $

# make certain files to be certain types.

#

AddType application/x-tar .tgz

AddType image/x- icon .ico

AddType application/x-httpd-php .php

设置Apache为自启动:

cp /www/bin/apachectl /etc/init.d/httpd

cd /etc/rc3.d

ln -s /etc/init.d/httpd S85httpd

ln -s /etc/init.d/httpd K85httpd

cd /etc/rc5.d

ln -s /etc/init.d/httpd S85httpd

ln -s /etc/init.d/httpd K85httpd

测试一下 PHP:

cd /etc/init.d

./httpd start

在/www/htdocs下建立文件 test.php

cd /www/htdocs

vi test.php

加入

<?php

phpinfo();

?>

用浏览器访问http://IP_address/test.php,成功的话,出现一些

系统,apache,php信息

5.安装 Snort2.0

5.1建立snort配置文件和日志目录

mkdir /etc/snort

mkdir /var/log/snort

tar -zxvf snort-2.x.x.tar.gz

cd snort-2.x.x

./configure --with-mysql=/usr/local/mysql

make

make install

5.2安装规则和配置文件

cd rules (在snort安装目录下)

cp * /etc/snort

cd ../etc

cp snort.conf /etc/snort

cp *.config /etc/snort

5.3修改snort.conf(/etc/snort/snort.conf)

var HOME_NET 10.2.2.0/24 (修改为你的内部网网络地址,我的是

192.168.0.0/24)

var RULE_PATH ../rules 修改为 var RULE_PATH /etc/snort/

改变记录日志数据库:

output database: log, mysql, user=root password=your_password

dbname=snort host=localhost

5.4设置snort为自启动:

在snort安装目录下

cd /contrib

cp S99snort /etc/init.d/snort

vi /etc/init.d/snort

修改snort如下:

CONFIG=/etc/snort/snort.conf

#SNORT_GID=nogroup (注释掉)

 $SNORT_PATH/snort -c  $CONFIG -i  $IFACE  $OPTIONS

(去掉原文件中的 -g  $SNORT_GID )

chmod 755 /etc/init.d/snort

cd /etc/rc3.d

ln -s /etc/init.d/snort S99snort

ln -s /etc/init.d/snort K99snort

cd /etc/rc5.d

ln -s /etc/init.d/snort S99snort

ln -s /etc/init.d/snort K99snort

四.在mysql中建立数据库

/usr/local/mysql/bin/mysql

mysql>SET PASSWORD FOR root@localhost=PASSWORD('your_password');

mysql>create database snort;

mysql>grant INSERT,SELECT on root.* to snort@localhost;

mysql>quit;

进入snort安装目录:/usr/local/mysql/bin/mysql -p <./contrib/create_mysql snort

>Enter password:

安装DB表:(在contrib目录)

zcat snortdb-extra.gz | /usr/local/mysql/bin/mysql -p snort

进入mysql数据库,看看snort数据库中的表:

/usr/local/mysql/bin/mysql -p

>Enter password:

mysql>show databases;

+------------+

| Database

+------------+

| mysql

| snort

| test

+------------+

3 rows in set (0.00 sec)

mysql>use snort;

mysql>show tables; 将会有这些:

+------------------+

| Tables_in_snort |

+------------------+

| data

| detail

| encoding

| event

| flags

| icmphdr

| iphdr

| opt

| protocols

| reference

| reference_system

| schema

| sensor

| services

| sig_class

| sig_reference

| signature

| tcphdr

| udphdr

+------------------+

19 rows in set (0.00 sec)

mysql>exit

五.安装配置Web接口

安装JPGraph1.11

cp jpgraph-1.11.tar.gz /www/htdocs

cd /www/htdocs

tar -xzvf jpgraph-1.xx.tar.gz

rm -rf jpgrap-1.xx.tar.gz

cd jpgraph-1.11

rm -rf README

rm -rf QPL.txt

安装ADODB:

cp adodb330.tgz /www/htdocs/

cd /www/htdocs

tar -xzvf adodb330.tgz

rm -rf adodb330.tgz

安装配置Acid:

cp acid-0.0.6b23.tar.gz /www/htdocs

cd /www/htdocs

tar -xvzf acid-0.9.6b23.tar.gz

rm -rf acid-0.9.6b23.tar.gz

cd /www/htodcs/acid/

编辑acid_conf.php,修改相关配置如下:

 $DBlib_path = "/www/htdocs/adodb";

/* The type of underlying alert database

*

* MySQL : "mysql"

* PostgresSQL : "postgres"

* MS SQL Server : "mssql"

*/

 $DBtype = "mysql";

/* Alert DB connection parameters

* -  $alert_dbname : MySQL database name of Snort alert DB

* -  $alert_host : host on which the DB is stored

* -  $alert_port : port on which to access the DB

* -  $alert_user : login to the database with this user

* -  $alert_password : password of the DB user

*

* This information can be gleaned from the Snort database

* output plugin configuration.

*/

 $alert_dbname = "snort";

 $alert_host = "localhost";

 $alert_port = "";

 $alert_user = "root";

 $alert_password = "Your_Password";

/* Archive DB connection parameters */

 $archive_dbname = "snort";

 $archive_host = "localhost";

 $archive_port = "";

 $archive_user = "root";

 $archive_password = "Your_Password ";

And a little further down

 $ChartLib_path = "/www/htdocs/jpgraph-1.11/src";

/* File format of charts ('png', 'jpeg', 'gif') */

 $chart_file_format = "png";

进入web界面:

http://yourhost/acid/acid_main.php

点"Setup Page"链接 ->Create Acid AG

访问http://yourhost/acid将会看到ACID界面。

六.测试系统

重启系统或者直接启动相关后台程序:

/etc/init.d/mysql restart

/etc/init.d/snort start

/etc/init.d/httpd start

利用nmap,nessus,CIS或者X-scan对系统进行扫描,

产生告警纪录。

http://yourhost/acid 察看纪录。

至此,一个功能强大的IDS配置完毕。各位可以利用web界面

远程登陆,监控主机所处局域网,同时安装phpMyAdmin对mysql

数据库进行操控。

ick S.Harper 翻译整理:ids,mapple

声明:欢迎转载.

[-]=========================================[-]

一.系统平台

Redhat9.0发行版, 安装gcc 及相关库文件,建议不要安装

Apache,PHP,MySQL,我们将用源码编译安装。基于安全方面的

考虑,可以设置一下iptables只允许SSH和WWW访问。

二.软件

MySQL4.0.12 http://mysql.secsup.org

Snort2.0.0 http://www.snort.org

Apache2.0.45 http://www.apache.org

PHP4.3.1 http://www.php.net

ADODBv3.30 http://phplens.com

Acid0.9.6b23 http://acidlab.sourceforge.net

Zlib1.1.4 http://flow.dl.sourceforge.net

JPGraph1.11 http://jpgraph.techuk.com

LibPcap0.7.2 http://www.tcpdump.org

建议到这个站点下载http://ftp.cdut.edu.cn/pub/linux/NEW/

也可以到http://www.rpmfind.com下载相关的xx....若安装了rpm包,

可以强行将其反安装

rpm -e -nodeps xx.xx

三.安装(建议将所有的包文件考到同一目录)

1.安装zlib1.1.4

tar -xzvf zlib-xx.tar.gz

cd zlib-xx

./configure;make test

make install

cd ..

2.安装LibPcap0.7.2

tar -xzvf libpcap.tar.gz

cd libpcap-xx

./configure

make

make install

cd ..

3.安装MySQL4.0.12

3.1创建mysql组和mysql用户

groupadd mysql

useradd -g mysql mysql

修改/root下的.bash_profile的这一行:

PATH= $PATH: $HOME/bin 为

PATH= $PATH: $HOME/bin:/usr/local/mysql/bin

3.2安装mysql

tar -xzvf mysql-xx.tar.gz

cd mysql-xx

./configure --prefix=/usr/local/mysql

make

make install

cd scripts

./mysql_install_db

chown -R root /usr/local/mysql

chown -R mysql /usr/local/mysql/var

chgrp -R mysql /usr/local/mysql

cd ../support-files/my-medium.cnf /etc/my.cnf

向/etc/ld.so.conf中加入两行:/usr/local/mysql/lib/mysql

/usr/local/lib

载入库,执行

ldconfig -v

3.3测试mysql是否工作:

cd /usr/local/mysql/bin/

./mysqld_safe --user=mysql&

#ps -ef |grep mysql

看mysql_safe是否工作

3.4设置mysql为自启动:

将mysql安装目录下的support-files目录中的

mysql.server文件拷到/etc/init.d目录

cp mysql.server /etc/init.d/mysql

chmod 755 /etc/init.d/mysql

创建硬链接:

cd /etc/rc3.d(文本方式启动)

ln -s /etc/init.d/mysql S85mysql

ln -s /etc/init.d/mysql K85mysql

cd /etc/rc5.d (图形方式启动)

ln -s /etc/init.d/mysql S85mysql

ln -s /etc/init.d/mysql K85mysql

4.安装Apache2.0.45和PHP4.3.1

tar -zxvf httpd-2.0.xx.tar.gz

cd httpd_2.xx.xx

./configure --prefix=/www --enable-so

注:apache根目录为 /www

make

make install

cd ..

tar -zxvf php-4.3.x.tar.gz

cd php-4.3.x

./configure --prefix=/www/php --with-apxs2=/www/bin/apxs --with-config- filepath=/www/php --enable-sockets --with-mysql=/usr/local/mysql --with-zlibdir=/

usr/local --with- gd

注意:这些为一行,中间不要有回车。

cp php.ini-dist /www/php/php.ini

编辑httpd.conf(/www/conf):

加入两行

LoadModule php4_module modules/libphp4.so

AddType application/x-httpd-php .php

httpd.conf中相关内容如下:

#

# LoadModule foo_module modules/mod_foo.so

LoadModule php4_module modules/libphp4.so

# AddType allows you to tweak mime.types without actually editing it, or  $

# make certain files to be certain types.

#

AddType application/x-tar .tgz

AddType image/x- icon .ico

AddType application/x-httpd-php .php

设置Apache为自启动:

cp /www/bin/apachectl /etc/init.d/httpd

cd /etc/rc3.d

ln -s /etc/init.d/httpd S85httpd

ln -s /etc/init.d/httpd K85httpd

cd /etc/rc5.d

ln -s /etc/init.d/httpd S85httpd

ln -s /etc/init.d/httpd K85httpd

测试一下 PHP:

cd /etc/init.d

./httpd start

在/www/htdocs下建立文件 test.php

cd /www/htdocs

vi test.php

加入

<?php

phpinfo();

?>

用浏览器访问http://IP_address/test.php,成功的话,出现一些

系统,apache,php信息

5.安装 Snort2.0

5.1建立snort配置文件和日志目录

mkdir /etc/snort

mkdir /var/log/snort

tar -zxvf snort-2.x.x.tar.gz

cd snort-2.x.x

./configure --with-mysql=/usr/local/mysql

make

make install

5.2安装规则和配置文件

cd rules (在snort安装目录下)

cp * /etc/snort

cd ../etc

cp snort.conf /etc/snort

cp *.config /etc/snort

5.3修改snort.conf(/etc/snort/snort.conf)

var HOME_NET 10.2.2.0/24 (修改为你的内部网网络地址,我的是

192.168.0.0/24)

var RULE_PATH ../rules 修改为 var RULE_PATH /etc/snort/

改变记录日志数据库:

output database: log, mysql, user=root password=your_password

dbname=snort host=localhost

5.4设置snort为自启动:

在snort安装目录下

cd /contrib

cp S99snort /etc/init.d/snort

vi /etc/init.d/snort

修改snort如下:

CONFIG=/etc/snort/snort.conf

#SNORT_GID=nogroup (注释掉)

 $SNORT_PATH/snort -c  $CONFIG -i  $IFACE  $OPTIONS

(去掉原文件中的 -g  $SNORT_GID )

chmod 755 /etc/init.d/snort

cd /etc/rc3.d

ln -s /etc/init.d/snort S99snort

ln -s /etc/init.d/snort K99snort

cd /etc/rc5.d

ln -s /etc/init.d/snort S99snort

ln -s /etc/init.d/snort K99snort

四.在mysql中建立数据库

/usr/local/mysql/bin/mysql

mysql>SET PASSWORD FOR root@localhost=PASSWORD('your_password');

mysql>create database snort;

mysql>grant INSERT,SELECT on root.* to snort@localhost;

mysql>quit;

进入snort安装目录:/usr/local/mysql/bin/mysql -p <./contrib/create_mysql snort

>Enter password:

安装DB表:(在contrib目录)

zcat snortdb-extra.gz | /usr/local/mysql/bin/mysql -p snort

进入mysql数据库,看看snort数据库中的表:

/usr/local/mysql/bin/mysql -p

>Enter password:

mysql>show databases;

+------------+

| Database

+------------+

| mysql

| snort

| test

+------------+

3 rows in set (0.00 sec)

mysql>use snort;

mysql>show tables; 将会有这些:

+------------------+

| Tables_in_snort |

+------------------+

| data

| detail

| encoding

| event

| flags

| icmphdr

| iphdr

| opt

| protocols

| reference

| reference_system

| schema

| sensor

| services

| sig_class

| sig_reference

| signature

| tcphdr

| udphdr

+------------------+

19 rows in set (0.00 sec)

mysql>exit

五.安装配置Web接口

安装JPGraph1.11

cp jpgraph-1.11.tar.gz /www/htdocs

cd /www/htdocs

tar -xzvf jpgraph-1.xx.tar.gz

rm -rf jpgrap-1.xx.tar.gz

cd jpgraph-1.11

rm -rf README

rm -rf QPL.txt

安装ADODB:

cp adodb330.tgz /www/htdocs/

cd /www/htdocs

tar -xzvf adodb330.tgz

rm -rf adodb330.tgz

安装配置Acid:

cp acid-0.0.6b23.tar.gz /www/htdocs

cd /www/htdocs

tar -xvzf acid-0.9.6b23.tar.gz

rm -rf acid-0.9.6b23.tar.gz

cd /www/htodcs/acid/

编辑acid_conf.php,修改相关配置如下:

 $DBlib_path = "/www/htdocs/adodb";

/* The type of underlying alert database

*

* MySQL : "mysql"

* PostgresSQL : "postgres"

* MS SQL Server : "mssql"

*/

 $DBtype = "mysql";

/* Alert DB connection parameters

* -  $alert_dbname : MySQL database name of Snort alert DB

* -  $alert_host : host on which the DB is stored

* -  $alert_port : port on which to access the DB

* -  $alert_user : login to the database with this user

* -  $alert_password : password of the DB user

*

* This information can be gleaned from the Snort database

* output plugin configuration.

*/

 $alert_dbname = "snort";

 $alert_host = "localhost";

 $alert_port = "";

 $alert_user = "root";

 $alert_password = "Your_Password";

/* Archive DB connection parameters */

 $archive_dbname = "snort";

 $archive_host = "localhost";

 $archive_port = "";

 $archive_user = "root";

 $archive_password = "Your_Password ";

And a little further down

 $ChartLib_path = "/www/htdocs/jpgraph-1.11/src";

/* File format of charts ('png', 'jpeg', 'gif') */

 $chart_file_format = "png";

进入web界面:

http://yourhost/acid/acid_main.php

点"Setup Page"链接 ->Create Acid AG

访问http://yourhost/acid将会看到ACID界面。

六.测试系统

重启系统或者直接启动相关后台程序:

/etc/init.d/mysql restart

/etc/init.d/snort start

/etc/init.d/httpd start

利用nmap,nessus,CIS或者X-scan对系统进行扫描,

产生告警纪录。

http://yourhost/acid 察看纪录。

至此,一个功能强大的IDS配置完毕。各位可以利用web界面

远程登陆,监控主机所处局域网,同时安装phpMyAdmin对mysql

数据库进行操控。

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
2023年上半年GDP全球前十五强
 百态   2023-10-24
美众议院议长启动对拜登的弹劾调查
 百态   2023-09-13
上海、济南、武汉等多地出现不明坠落物
 探索   2023-09-06
印度或要将国名改为“巴拉特”
 百态   2023-09-06
男子为女友送行,买票不登机被捕
 百态   2023-08-20
手机地震预警功能怎么开?
 干货   2023-08-06
女子4年卖2套房花700多万做美容:不但没变美脸,面部还出现变形
 百态   2023-08-04
住户一楼被水淹 还冲来8头猪
 百态   2023-07-31
女子体内爬出大量瓜子状活虫
 百态   2023-07-25
地球连续35年收到神秘规律性信号,网友:不要回答!
 探索   2023-07-21
全球镓价格本周大涨27%
 探索   2023-07-09
钱都流向了那些不缺钱的人,苦都留给了能吃苦的人
 探索   2023-07-02
倩女手游刀客魅者强控制(强混乱强眩晕强睡眠)和对应控制抗性的关系
 百态   2020-08-20
美国5月9日最新疫情:美国确诊人数突破131万
 百态   2020-05-09
荷兰政府宣布将集体辞职
 干货   2020-04-30
倩女幽魂手游师徒任务情义春秋猜成语答案逍遥观:鹏程万里
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案神机营:射石饮羽
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案昆仑山:拔刀相助
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案天工阁:鬼斧神工
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案丝路古道:单枪匹马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:与虎谋皮
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:李代桃僵
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:指鹿为马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:小鸟依人
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:千金买邻
 干货   2019-11-12
 
推荐阅读
 
 
 
>>返回首頁<<
 
靜靜地坐在廢墟上,四周的荒凉一望無際,忽然覺得,淒涼也很美
© 2005- 王朝網路 版權所有