linux下防入侵檢測實作

實驗環境 centos-5.5

需要軟體包

zlib-1.2.3.tar.gz （zlib-1.2.3-3.i386.rpm）

libpcap-1.0.0.tar.gz （libpcap-0.9.4-14.el5.i386.rpm）

libxml2-2.6.19.tar.gz （libxml2-2.6.26-2.1.2.8.i386.rpm）

libpng-1.2.40.tar.gz （libpng-1.2.10-7.1.el5_3.2.i386.rpm）

gd-2.0.33.tar.gz （gd-2.0.33-9.4.el5_1.1.i386.rpm）

mysql-5.0.22.tar.gz

DBD-mysql-3.0008.tar.gz

httpd-2.2.14.tar.gz

php-5.2.13.tar.gz

pcre-8.00.tar.gz （pcre-6.6-2.el5_1.7.i386.rpm）

snort-2.8.3.1.tar.gz

snortrules-snapshot-2.8.tar.gz

snortrules-snapshot-CURRENT.tar.gz

jpgraph-3.0.6.tar.bz2

adodb498.tgz

acid-0.9.6b23.tar.gz

snort的一些庫檔案可以再CD光牒裡找到,也可以使用yum安裝

yum install -y zlib*  libpcap* libxml2* libpng* gd* perl-DBI*

安裝mysql

tar zxf mysql-5.0.56.tar.gz                    解壓mysql

cd mysql-5.0.56                          進入目錄mysql-5.0.56        

groupadd mysql                           增加mysql組群              

useradd -g mysql mysql                       增加mysql使用者

./configure --prefix=/usr/local/mysql      

make

make install

cd /usr/local/mysql/

/usr/local/mysql/bin/mysql_install_db --user=mysql         初始化資料庫

chmod -R root .                           改變目錄權限

chown -R mysql var

chgrp -R mysql .

背景運作MYSQL

/usr/local/mysql/bin/mysqld_safe --user=mysql &

Starting mysqld daemon with databases from /usr/local/mysql/var   背景啟動mysql成功

驗證mysql 

ps -e | grep mysqld

22157 pts/0  00:00:00 mysqld_safe

22177 pts/0  00:00:00 mysqld

netstat -tuplna | grep mysqld

tcp    0   0 0.0.0.0:3306        0.0.0.0:*          LISTEN   22177/mysqld

bin/mysqladmin -uroot password 123456                 mysql設定密碼

bin/mysql -uroot -p 123456

Enter password:

Welcome to the MySQL monitor. Commands end with ; or \g.

Your MySQL connection id is 3

Server version: 5.0.56 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>  

修改ld.so.conf檔案

vi /etc/ld.so.conf

在檔案中加入兩行：

/usr/local/mysql/lib/mysql

/usr/local/lib

修改後

include ld.so.conf.d/*.conf

使用ldconfig，使其生效

安裝DBD-mysql

tar zxf DBD-mysql-3.0002.tar.gz

cd DBD-mysql-3.0002

export LANG=C

perl Makefile.PL \

> --libs="-L/usr/local/mysql/lib/mysql -lmysqlclient -lz" \

> --cflags=-I/usr/local/mysql/include/mysql \

> --testhost=127.0.0.1 \

> --mysql_config=/usr/local/mysql/bin/mysql_conf

安裝snort

tar zxf snort-2.8.4.1.tar.gz

cd snort-2.8.4.1

snort調用mysql

./configure --with-mysql=/usr/local/mysql

make make install

mkdir /etc/snort                        建立配置檔案目錄                              

mkdir /var/log/snort                      建立日志目錄

安裝snort規則

cp snortrules-snapshot-2.8.tar.gz /usr/local/src/

tar zxf snortrules-snapshot-2860.tar.gz

mv rules/ /etc/snort

cp * /etc/snort/

ll /etc/snort

修改/etc/snort/snort.conf檔案

# var HOME_NET 10.1.1.0/24

修改為

var HOME_NET 192.168.5.0/24

找到

# such as: c:\snort\rules

var RULE_PATH ../rules

var RULE_PATH /etc/snort/rules

var PREPROC_RULE_PATH ../preproc_rules

# output database: log, mysql, user=root password=test dbname=db host=localhost

output database: log, mysql, user=root password=123456 dbname=snort host=localhost

/usr/local/mysql/bin/mysql -uroot -p                輸入密碼進入資料庫

mysql> SET PASSWORD FOR root@localhost=PASSWORD('123456');

mysql> create database snort;

mysql> connect snort;

mysql> source /usr/local/src/snort-2.8.4.1/schemas/create_mysql;

mysql>show tables;

執行下列指令:

mysql>grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort;

Query OK, 0 rows affected (0.00 sec)

mysql>grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort@localhost;

mysql> flush privileges;                          重新整理

Query OK, 0 rows affected (0.01 sec)

啟動snort

snort -c /etc/snort/snort.conf

<a href="http://blog.51cto.com/attachment/201305/094403612.png" target="_blank"></a>

如果出現這個提示，證明snort安裝成功

安裝apache

tar zxf httpd-2.2.15.tar.gz

cd httpd-2.2.15

./configure --prefix=/usr/local/apache --enable-module=ssl --enable-module=so

/usr/local/apache/bin/apachectl start

netstat -tnl

Active Internet connections (only servers)

tcp    0   0 :::80            :::*            LISTEN   tcp    0   0 :::22            :::*            LISTEN

<a href="http://blog.51cto.com/attachment/201305/100538667.png" target="_blank"></a>

安裝PHP

tar zxf php-5.2.13.tar.gz

cd php-5.2.13

./configure \

&gt;--prefix=/usr/local/php \

&gt;--with-mysql=/usr/local/mysql \

&gt;--with-apxs2=/usr/local/apache/bin/apxs \

&gt; --with-gd \

&gt;--with-zlib

cp php.ini-dist /usr/local/bin/php.ini               複制配置檔案

修改apachect,配置檔案

vi /usr/local/apache/conf/httpd.conf

#AddType application/x-gzip .tgz

AddType application/x-gzip .tgz

AddType application/x-httpd-php .php

/usr/local/apache/bin/apachectl start             重新開機Apache 服務                

cd /usr/local/apache/htdocs/                      php測試頁

touch index.php

vi /usr/local/apache/htdocs/index.php

vi index.php

寫入一些内容

&lt;?

echo "where to use PHP test page!";

mysql_connect ("localhost","root","123456"); root 為資料庫使用者 123456為資料庫密碼

mysql_query ("create database test01;");

?&gt;

<a href="http://blog.51cto.com/attachment/201305/100659150.png" target="_blank"></a>

/usr/local/mysql/bin/mysql -uroot -p

mysql&gt; show databases;

+--------------------+

| Database      |

| information_schema |

| mysql       |

| snort       |

| test        |

| test01       |

5 rows in set (0.00 sec

安裝 acid+adodb+jpgraph

tar zxf acid-0.9.6b23.tar.gz

tar zxf adodb511.tgz

tar zxf jpgraph-3.0.7.tar.gz

mv acid /usr/local/apache/htdocs/

mv adodb5 /usr/local/apache/htdocs/adodb

mv jpgraph-3.0.7 /usr/local/apache/htdocs/jpgraph    

cd /usr/local/apache/htdocs/

vi acid/acid_conf.php

$DBlib_path = "";

更改為

$DBlib_path = "/usr/local/apache/htdocs/adodb";

*/

$alert_dbname  = "snort_log";

$alert_host   = "localhost";

$alert_port   = "";

$alert_user   = "root";

$alert_password = "mypassword";

/* Archive DB connection parameters */

$archive_dbname  = "snort_archive";

$archive_host   = "localhost";

$archive_port   = "";

$archive_user   = "root";

$alert_dbname  = "snort";

$alert_password = "123456";

$archive_dbname  = "snort";

$archive_password = "123456";

$ChartLib_path = "";

$ChartLib_path = " /usr/local/apache/htdocs/jpgraph/src";

snort -d -D -c /etc/snort/snort.conf

打開浏覽器輸入http://你的ip位址/acid/acid_main.php，選擇setup page

<a href="http://blog.51cto.com/attachment/201305/102511441.png" target="_blank"></a>

<a href="http://blog.51cto.com/attachment/201305/102758756.png" target="_blank"></a>

<a href="http://blog.51cto.com/attachment/201305/102803112.png" target="_blank"></a>

<a href="http://blog.51cto.com/attachment/201305/102808156.png" target="_blank"></a>

本文轉自 mailfile 51CTO部落格，原文連結：http://blog.51cto.com/mailfile/1206533，如需轉載請自行聯系原作者