ITPub博客

首页 > IT基础架构 > 网络安全 > 构建小型的入侵检测系统(RedHat9)

构建小型的入侵检测系统(RedHat9)

原创 网络安全 作者:coolwinds 时间:2005-03-21 14:45:50 0 删除 编辑
构建小型的入侵检测系统(RedHat9) Snort+Apache+PHP4+MySQL+Acid [-]=====================================[-] 原作者:Patr 构建小型的入侵检测系统(RedHat9) Snort+Apache+PHP4+MySQL+Acid [-]=====================================[-] 原作者:Patrick S.Harper 翻译整理:ids,mapple 声明:欢迎转载. [-]=====================================[-] 好东西一起分享v[@more@]构建小型的入侵检测系统(RedHat9) Snort+Apache+PHP4+MySQL+Acid [-]=========================================[-] 原作者:Patr 构建小型的入侵检测系统(RedHat9) Snort+Apache+PHP4+MySQL+Acid [-]=====================================[-] 原作者:Patrick S.Harper 翻译整理:ids,mapple 声明:欢迎转载. [-]=====================================[-] 一.系统平台 Redhat9.0发行版, 安装gcc 及相关库文件,建议不要安装 Apache,PHP,MySQL,我们将用源码编译安装。基于安全方面的 考虑,可以设置一下iptables只允许SSH和WWW访问。 二.软件 MySQL4.0.12 http://mysql.secsup.org Snort2.0.0 http://www.snort.org Apache2.0.45 http://www.apache.org PHP4.3.1 http://www.php.net ADODBv3.30 http://phplens.com Acid0.9.6b23 http://acidlab.sourceforge.net Zlib1.1.4 http://flow.dl.sourceforge.net JPGraph1.11 http://jpgraph.techuk.com LibPcap0.7.2 http://www.tcpdump.org 建议到这个站点下载http://ftp.cdut.edu.cn/pub/linux/NEW/ 也可以到http://www.rpmfind.com下载相关的xx....若安装了rpm包, 可以强行将其反安装 rpm -e -nodeps xx.xx 三.安装(建议将所有的包文件考到同一目录) 1.安装zlib1.1.4 tar -xzvf zlib-xx.tar.gz cd zlib-xx ./configure;make test make install cd .. 2.安装LibPcap0.7.2 tar -xzvf libpcap.tar.gz cd libpcap-xx ./configure make make install cd .. 3.安装MySQL4.0.12 3.1创建mysql组和mysql用户 groupadd mysql useradd -g mysql mysql 修改/root下的.bash_profile的这一行: PATH=$PATH:$HOME/bin 为 PATH=$PATH:$HOME/bin:/usr/local/mysql/bin 3.2安装mysql tar -xzvf mysql-xx.tar.gz cd mysql-xx ./configure --prefix=/usr/local/mysql make make install cd scripts ./mysql_install_db chown -R root /usr/local/mysql chown -R mysql /usr/local/mysql/var chgrp -R mysql /usr/local/mysql cd ../support-files/my-medium.cnf /etc/my.cnf 向/etc/ld.so.conf中加入两行:/usr/local/mysql/lib/mysql /usr/local/lib 载入库,执行 ldconfig -v 3.3测试mysql是否工作: cd /usr/local/mysql/bin/ ./mysqld_safe --user=mysql& #ps -ef |grep mysql 看mysql_safe是否工作 3.4设置mysql为自启动: 将mysql安装目录下的support-files目录中的 mysql.server文件拷到/etc/init.d目录 cp mysql.server /etc/init.d/mysql chmod 755 /etc/init.d/mysql 创建硬链接: cd /etc/rc3.d(文本方式启动) ln -s /etc/init.d/mysql S85mysql ln -s /etc/init.d/mysql K85mysql cd /etc/rc5.d (图形方式启动) ln -s /etc/init.d/mysql S85mysql ln -s /etc/init.d/mysql K85mysql 4.安装Apache2.0.45和PHP4.3.1 tar -zxvf httpd-2.0.xx.tar.gz cd httpd_2.xx.xx ./configure --prefix=/www --enable-so 注:apache根目录为 /www make make install cd .. tar -zxvf php-4.3.x.tar.gz cd php-4.3.x ./configure --prefix=/www/php --with-apxs2=/www/bin/apxs --with-config- filepath=/www/php --enable-sockets --with-mysql=/usr/local/mysql --with-zlibdir=/ usr/local --with- gd 注意:这些为一行,中间不要有回车。 cp php.ini-dist /www/php/php.ini 编辑httpd.conf(/www/conf): 加入两行 LoadModule php4_module modules/libphp4.so AddType application/x-httpd-php .php httpd.conf中相关内容如下: # # LoadModule foo_module modules/mod_foo.so LoadModule php4_module modules/libphp4.so # AddType allows you to tweak mime.types without actually editing it, or $ # make certain files to be certain types. # AddType application/x-tar .tgz AddType image/x- icon .ico AddType application/x-httpd-php .php 设置Apache为自启动: cp /www/bin/apachectl /etc/init.d/httpd cd /etc/rc3.d ln -s /etc/init.d/httpd S85httpd ln -s /etc/init.d/httpd K85httpd cd /etc/rc5.d ln -s /etc/init.d/httpd S85httpd ln -s /etc/init.d/httpd K85httpd 测试一下 PHP: cd /etc/init.d ./httpd start 在/www/htdocs下建立文件 test.php cd /www/htdocs vi test.php 加入 用浏览器访问http://IP_address/test.php,成功的话,出现一些 系统,apache,php信息 5.安装 Snort2.0 5.1建立snort配置文件和日志目录 mkdir /etc/snort mkdir /var/log/snort tar -zxvf snort-2.x.x.tar.gz cd snort-2.x.x ./configure --with-mysql=/usr/local/mysql make make install 5.2安装规则和配置文件 cd rules (在snort安装目录下) cp * /etc/snort cd ../etc cp snort.conf /etc/snort cp *.config /etc/snort 5.3修改snort.conf(/etc/snort/snort.conf) var HOME_NET 10.2.2.0/24 (修改为你的内部网网络地址,我的是 192.168.0.0/24) var RULE_PATH ../rules 修改为 var RULE_PATH /etc/snort/ 改变记录日志数据库: output database: log, mysql, user=root password=your_password dbname=snort host=localhost 5.4设置snort为自启动: 在snort安装目录下 cd /contrib cp S99snort /etc/init.d/snort vi /etc/init.d/snort 修改snort如下: CONFIG=/etc/snort/snort.conf #SNORT_GID=nogroup (注释掉) $SNORT_PATH/snort -c $CONFIG -i $IFACE $OPTIONS (去掉原文件中的 -g $SNORT_GID ) chmod 755 /etc/init.d/snort cd /etc/rc3.d ln -s /etc/init.d/snort S99snort ln -s /etc/init.d/snort K99snort cd /etc/rc5.d ln -s /etc/init.d/snort S99snort ln -s /etc/init.d/snort K99snort 四.在mysql中建立数据库 /usr/local/mysql/bin/mysql mysql>SET PASSWORD FOR root@localhost=PASSWORD('your_password'); mysql>create database snort; mysql>grant INSERT,SELECT on root.* to snort@localhost; mysql>quit; 进入snort安装目录:/usr/local/mysql/bin/mysql -p Enter password: 安装DB表:(在contrib目录) zcat snortdb-extra.gz | /usr/local/mysql/bin/mysql -p snort 进入mysql数据库,看看snort数据库中的表: /usr/local/mysql/bin/mysql -p >Enter password: mysql>show databases; +------------+ | Database +------------+ | mysql | snort | test +------------+ 3 rows in set (0.00 sec) mysql>use snort; mysql>show tables; 将会有这些: +------------------+ | Tables_in_snort | +------------------+ | data | detail | encoding | event | flags | icmphdr | iphdr | opt | protocols | reference | reference_system | schema | sensor | services | sig_class | sig_reference | signature | tcphdr | udphdr +------------------+ 19 rows in set (0.00 sec) mysql>exit 五.安装配置Web接口 安装JPGraph1.11 cp jpgraph-1.11.tar.gz /www/htdocs cd /www/htdocs tar -xzvf jpgraph-1.xx.tar.gz rm -rf jpgrap-1.xx.tar.gz cd jpgraph-1.11 rm -rf README rm -rf QPL.txt 安装ADODB: cp adodb330.tgz /www/htdocs/ cd /www/htdocs tar -xzvf adodb330.tgz rm -rf adodb330.tgz 安装配置Acid: cp acid-0.0.6b23.tar.gz /www/htdocs cd /www/htdocs tar -xvzf acid-0.9.6b23.tar.gz rm -rf acid-0.9.6b23.tar.gz cd /www/htodcs/acid/ 编辑acid_conf.php,修改相关配置如下: $DBlib_path = "/www/htdocs/adodb"; /* The type of underlying alert database * * MySQL : "mysql" * PostgresSQL : "postgres" * MS SQL Server : "mssql" */ $DBtype = "mysql"; /* Alert DB connection parameters * - $alert_dbname : MySQL database name of Snort alert DB * - $alert_host : host on which the DB is stored * - $alert_port : port on which to access the DB * - $alert_user : login to the database with this user * - $alert_password : password of the DB user * * This information can be gleaned from the Snort database * output plugin configuration. */ $alert_dbname = "snort"; $alert_host = "localhost"; $alert_port = ""; $alert_user = "root"; $alert_password = "Your_Password"; /* Archive DB connection parameters */ $archive_dbname = "snort"; $archive_host = "localhost"; $archive_port = ""; $archive_user = "root"; $archive_password = "Your_Password "; And a little further down $ChartLib_path = "/www/htdocs/jpgraph-1.11/src"; /* File format of charts ('png', 'jpeg', 'gif') */ $chart_file_format = "png"; 进入web界面: http://yourhost/acid/acid_main.php 点"Setup Page"链接 ->Create Acid AG 访问http://yourhost/acid将会看到ACID界面。 六.测试系统 重启系统或者直接启动相关后台程序: /etc/init.d/mysql restart /etc/init.d/snort start /etc/init.d/httpd start 利用nmap,nessus,CIS或者X-scan对系统进行扫描, 产生告警纪录。 http://yourhost/acid 察看纪录。 至此,一个功能强大的IDS配置完毕。各位可以利用web界面 远程登陆,监控主机所处局域网,同时安装phpMyAdmin对mysql 数据库进行操控。 ick S.Harper 翻译整理:ids,mapple 声明:欢迎转载. [-]=========================================[-] 一.系统平台 Redhat9.0发行版, 安装gcc 及相关库文件,建议不要安装 Apache,PHP,MySQL,我们将用源码编译安装。基于安全方面的 考虑,可以设置一下iptables只允许SSH和WWW访问。 二.软件 MySQL4.0.12 http://mysql.secsup.org Snort2.0.0 http://www.snort.org Apache2.0.45 http://www.apache.org PHP4.3.1 http://www.php.net ADODBv3.30 http://phplens.com Acid0.9.6b23 http://acidlab.sourceforge.net Zlib1.1.4 http://flow.dl.sourceforge.net JPGraph1.11 http://jpgraph.techuk.com LibPcap0.7.2 http://www.tcpdump.org 建议到这个站点下载http://ftp.cdut.edu.cn/pub/linux/NEW/ 也可以到http://www.rpmfind.com下载相关的xx....若安装了rpm包, 可以强行将其反安装 rpm -e -nodeps xx.xx 三.安装(建议将所有的包文件考到同一目录) 1.安装zlib1.1.4 tar -xzvf zlib-xx.tar.gz cd zlib-xx ./configure;make test make install cd .. 2.安装LibPcap0.7.2 tar -xzvf libpcap.tar.gz cd libpcap-xx ./configure make make install cd .. 3.安装MySQL4.0.12 3.1创建mysql组和mysql用户 groupadd mysql useradd -g mysql mysql 修改/root下的.bash_profile的这一行: PATH=$PATH:$HOME/bin 为 PATH=$PATH:$HOME/bin:/usr/local/mysql/bin 3.2安装mysql tar -xzvf mysql-xx.tar.gz cd mysql-xx ./configure --prefix=/usr/local/mysql make make install cd scripts ./mysql_install_db chown -R root /usr/local/mysql chown -R mysql /usr/local/mysql/var chgrp -R mysql /usr/local/mysql cd ../support-files/my-medium.cnf /etc/my.cnf 向/etc/ld.so.conf中加入两行:/usr/local/mysql/lib/mysql /usr/local/lib 载入库,执行 ldconfig -v 3.3测试mysql是否工作: cd /usr/local/mysql/bin/ ./mysqld_safe --user=mysql& #ps -ef |grep mysql 看mysql_safe是否工作 3.4设置mysql为自启动: 将mysql安装目录下的support-files目录中的 mysql.server文件拷到/etc/init.d目录 cp mysql.server /etc/init.d/mysql chmod 755 /etc/init.d/mysql 创建硬链接: cd /etc/rc3.d(文本方式启动) ln -s /etc/init.d/mysql S85mysql ln -s /etc/init.d/mysql K85mysql cd /etc/rc5.d (图形方式启动) ln -s /etc/init.d/mysql S85mysql ln -s /etc/init.d/mysql K85mysql 4.安装Apache2.0.45和PHP4.3.1 tar -zxvf httpd-2.0.xx.tar.gz cd httpd_2.xx.xx ./configure --prefix=/www --enable-so 注:apache根目录为 /www make make install cd .. tar -zxvf php-4.3.x.tar.gz cd php-4.3.x ./configure --prefix=/www/php --with-apxs2=/www/bin/apxs --with-config- filepath=/www/php --enable-sockets --with-mysql=/usr/local/mysql --with-zlibdir=/ usr/local --with- gd 注意:这些为一行,中间不要有回车。 cp php.ini-dist /www/php/php.ini 编辑httpd.conf(/www/conf): 加入两行 LoadModule php4_module modules/libphp4.so AddType application/x-httpd-php .php httpd.conf中相关内容如下: # # LoadModule foo_module modules/mod_foo.so LoadModule php4_module modules/libphp4.so # AddType allows you to tweak mime.types without actually editing it, or $ # make certain files to be certain types. # AddType application/x-tar .tgz AddType image/x- icon .ico AddType application/x-httpd-php .php 设置Apache为自启动: cp /www/bin/apachectl /etc/init.d/httpd cd /etc/rc3.d ln -s /etc/init.d/httpd S85httpd ln -s /etc/init.d/httpd K85httpd cd /etc/rc5.d ln -s /etc/init.d/httpd S85httpd ln -s /etc/init.d/httpd K85httpd 测试一下 PHP: cd /etc/init.d ./httpd start 在/www/htdocs下建立文件 test.php cd /www/htdocs vi test.php 加入 用浏览器访问http://IP_address/test.php,成功的话,出现一些 系统,apache,php信息 5.安装 Snort2.0 5.1建立snort配置文件和日志目录 mkdir /etc/snort mkdir /var/log/snort tar -zxvf snort-2.x.x.tar.gz cd snort-2.x.x ./configure --with-mysql=/usr/local/mysql make make install 5.2安装规则和配置文件 cd rules (在snort安装目录下) cp * /etc/snort cd ../etc cp snort.conf /etc/snort cp *.config /etc/snort 5.3修改snort.conf(/etc/snort/snort.conf) var HOME_NET 10.2.2.0/24 (修改为你的内部网网络地址,我的是 192.168.0.0/24) var RULE_PATH ../rules 修改为 var RULE_PATH /etc/snort/ 改变记录日志数据库: output database: log, mysql, user=root password=your_password dbname=snort host=localhost 5.4设置snort为自启动: 在snort安装目录下 cd /contrib cp S99snort /etc/init.d/snort vi /etc/init.d/snort 修改snort如下: CONFIG=/etc/snort/snort.conf #SNORT_GID=nogroup (注释掉) $SNORT_PATH/snort -c $CONFIG -i $IFACE $OPTIONS (去掉原文件中的 -g $SNORT_GID ) chmod 755 /etc/init.d/snort cd /etc/rc3.d ln -s /etc/init.d/snort S99snort ln -s /etc/init.d/snort K99snort cd /etc/rc5.d ln -s /etc/init.d/snort S99snort ln -s /etc/init.d/snort K99snort 四.在mysql中建立数据库 /usr/local/mysql/bin/mysql mysql>SET PASSWORD FOR root@localhost=PASSWORD('your_password'); mysql>create database snort; mysql>grant INSERT,SELECT on root.* to snort@localhost; mysql>quit; 进入snort安装目录:/usr/local/mysql/bin/mysql -p Enter password: 安装DB表:(在contrib目录) zcat snortdb-extra.gz | /usr/local/mysql/bin/mysql -p snort 进入mysql数据库,看看snort数据库中的表: /usr/local/mysql/bin/mysql -p >Enter password: mysql>show databases; +------------+ | Database +------------+ | mysql | snort | test +------------+ 3 rows in set (0.00 sec) mysql>use snort; mysql>show tables; 将会有这些: +------------------+ | Tables_in_snort | +------------------+ | data | detail | encoding | event | flags | icmphdr | iphdr | opt | protocols | reference | reference_system | schema | sensor | services | sig_class | sig_reference | signature | tcphdr | udphdr +------------------+ 19 rows in set (0.00 sec) mysql>exit 五.安装配置Web接口 安装JPGraph1.11 cp jpgraph-1.11.tar.gz /www/htdocs cd /www/htdocs tar -xzvf jpgraph-1.xx.tar.gz rm -rf jpgrap-1.xx.tar.gz cd jpgraph-1.11 rm -rf README rm -rf QPL.txt 安装ADODB: cp adodb330.tgz /www/htdocs/ cd /www/htdocs tar -xzvf adodb330.tgz rm -rf adodb330.tgz 安装配置Acid: cp acid-0.0.6b23.tar.gz /www/htdocs cd /www/htdocs tar -xvzf acid-0.9.6b23.tar.gz rm -rf acid-0.9.6b23.tar.gz cd /www/htodcs/acid/ 编辑acid_conf.php,修改相关配置如下: $DBlib_path = "/www/htdocs/adodb"; /* The type of underlying alert database * * MySQL : "mysql" * PostgresSQL : "postgres" * MS SQL Server : "mssql" */ $DBtype = "mysql"; /* Alert DB connection parameters * - $alert_dbname : MySQL database name of Snort alert DB * - $alert_host : host on which the DB is stored * - $alert_port : port on which to access the DB * - $alert_user : login to the database with this user * - $alert_password : password of the DB user * * This information can be gleaned from the Snort database * output plugin configuration. */ $alert_dbname = "snort"; $alert_host = "localhost"; $alert_port = ""; $alert_user = "root"; $alert_password = "Your_Password"; /* Archive DB connection parameters */ $archive_dbname = "snort"; $archive_host = "localhost"; $archive_port = ""; $archive_user = "root"; $archive_password = "Your_Password "; And a little further down $ChartLib_path = "/www/htdocs/jpgraph-1.11/src"; /* File format of charts ('png', 'jpeg', 'gif') */ $chart_file_format = "png"; 进入web界面: http://yourhost/acid/acid_main.php 点"Setup Page"链接 ->Create Acid AG 访问http://yourhost/acid将会看到ACID界面。 六.测试系统 重启系统或者直接启动相关后台程序: /etc/init.d/mysql restart /etc/init.d/snort start /etc/init.d/httpd start 利用nmap,nessus,CIS或者X-scan对系统进行扫描, 产生告警纪录。 http://yourhost/acid 察看纪录。 至此,一个功能强大的IDS配置完毕。各位可以利用web界面 远程登陆,监控主机所处局域网,同时安装phpMyAdmin对mysql 数据库进行操控。

来自 “ ITPUB博客 ” ,链接:http://blog.itpub.net/83980/viewspace-793609/,如需转载,请注明出处,否则将追究法律责任。

请登录后发表评论 登录
全部评论

注册时间:2012-10-23

  • 博文量
    253
  • 访问量
    947583