10.安裝 Snort2.4.4



10.1建立snort配置文件和日志目錄



#mkdir /etc/snort

#mkdir /var/log/snort

#tar -zxvf snort-2.4.4.tar.gz

#cd snort-2.4.4

#./configure --with-mysql=/usr/local/mysql

#make

#make install

注意，我在編譯snort時(shí)出現(xiàn)“ERROR! Libpcre header not found, go get it from”的錯(cuò)誤。這是因?yàn)樯侔惭b了一個(gè)lib的庫，如果誰出現(xiàn)了這樣的問題，就到ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/ 下載最新的pcre庫進(jìn)行安裝。

方法： #tar -zxvf pcre-6.7.tar.gz

#./configure

#make

#make check

#make install

10.2安裝規(guī)則和配置文件

#cd /etc/snort/

#tar ?zxvf /ruanjian/snortrules-snapshot-2.4.tar.gz

#cd /etc/snort/rules (在snort安裝目錄下)

#cp *.conf /etc/snort/.

#cp *.config /etc/snort/.

#cp *.map /etc/snort/.

10.3修改snort.conf (/etc/snort/snort.conf)

var HOME_NET 172.17.4.0/24 (修改為你的內(nèi)部網(wǎng)網(wǎng)絡(luò)地址)

var RULE_PATH ./rules 修改為 var RULE_PATH /etc/snort/



改變記錄日志數(shù)據(jù)庫:

log與alert數(shù)據(jù)庫要分別建，否則snort啟動(dòng)當(dāng)有事件發(fā)生時(shí)候要出錯(cuò)

output database: log, mysql, user=root password=your_password dbname=snort host=localhost

output database: alert, mysql, user=root password=your_password dbname=snort host=localhost






安裝DB表:(在schemas 目錄)

/usr/local/mysql/bin/mysql -u root -p <create_mysql snort //為snort建立數(shù)據(jù)表

11.安裝配置Web接口



安裝JPGraph2.1.1

#cp jpgraph-2.1.1.tar.gz /home

#cd /home

#tar -xzvf jpgraph-2.1.1.tar.gz

#mv jpgraph-2.1.1 jpgraph



安裝ADODB:

#cp adodb480.gz /home

#cd /home

#tar -xzvf adodb480.gz



安裝配置Acid:

#cp acid-0.9.6b23.tar.gz /home

#cd /home

#tar -xvzf acid-0.9.6b23.tar.gz

#cd /home/acid/



編輯acid_conf.php,修改相關(guān)配置如下:

$DBlib_path = "/home/adodb";

$DBtype = "mysql";

$alert_dbname = "snort";

$alert_host = "localhost";

$alert_port = "";

$alert_user = "root";

$alert_password = "xiangqian";

$archive_dbname = "snort";

$archive_host = "localhost";

$archive_port = "";

$archive_user = "root";

$archive_password = "xiangqian";

$ChartLib_path = "/home/jpgraph/src";



運(yùn)行snort把數(shù)據(jù)寫入mysql

# snort -c /etc/snort/snort.conf



進(jìn)入web界面:

http://yourhost/acid/acid_main.php

點(diǎn)"Setup Page"鏈接 ->Create Acid AG

訪問http://yourhost/acid將會(huì)看到ACID界面。

最新評(píng)論