一.系统平台
Redhat9.0发行版， 安装gcc
及相关库文件，建议不要安装
Apache,PHP,MySQL,我们将用源码编译安装。基于安全方面的
考虑，可以设置一下iptables只允许SSH和WWW访问。
二.软件
MySQL4.0.12
Snort2.0.0
Apache2.0.45
PHP4.3.1
ADODBv3.30
Acid0.9.6b23
Zlib1.1.4
JPGraph1.11
LibPcap0.7.2
建议到这个站点下载
也可以到下载相关的xx....若安装了rpm包，
可以强行将其反安装
rpm
-e -nodeps xx.xx
三.安装(建议将所有的包文件考到同一目录)
1.安装zlib1.1.4
tar -xzvf zlib-xx.tar.gz
cd
zlib-xx
./configure;make test
make install
cd
..
2.安装LibPcap0.7.2
tar -xzvf libpcap.tar.gz
cd
libpcap-xx
./configure
make
make install
cd
..
3.安装MySQL4.0.12
3.1创建mysql组和mysql用户
groupadd mysql
useradd -g
mysql mysql
修改/root下的.bash_profile的这一行：
PATH=$PATH:$HOME/bin
为
PATH=$PATH:$HOME/bin:/usr/local/mysql/bin
3.2安装mysql
tar -xzvf
mysql-xx.tar.gz
cd mysql-xx
./configure
--prefix=/usr/local/mysql
make
make install
cd
scripts
./mysql_install_db
chown -R root /usr/local/mysql
chown -R
mysql /usr/local/mysql/var
chgrp -R mysql /usr/local/mysql
cd
../support-files/my-medium.cnf
/etc/my.cnf
向/etc/ld.so.conf中加入两行：/usr/local/mysql/lib/mysql
/usr/local/lib
载入库，执行
ldconfig
-v
3.3测试mysql是否工作：
cd /usr/local/mysql/bin/
./mysqld_safe
--user=mysql&
#ps -ef |grep
mysql
看mysql_safe是否工作
3.4设置mysql为自启动：
将mysql安装目录下的support-files目录中的
mysql.server文件拷到/etc/init.d目录
cp
mysql.server /etc/init.d/mysql
chmod 755 /etc/init.d/mysql
创建硬链接:
cd
/etc/rc3.d（文本方式启动)
ln -s /etc/init.d/mysql S85mysql
ln -s
/etc/init.d/mysql K85mysql
cd /etc/rc5.d (图形方式启动）
ln -s /etc/init.d/mysql
S85mysql
ln -s /etc/init.d/mysql K85mysql
4.安装Apache2.0.45和PHP4.3.1
tar -zxvf httpd-2.0.xx.tar.gz
cd
httpd_2.xx.xx
./configure --prefix=/www --enable-so
注：apache根目录为
/www
make
make install
cd ..
tar -zxvf php-4.3.x.tar.gz
cd php-4.3.x
./configure
--prefix=/www/php --with-apxs2=/www/bin/apxs --with-config- filepath=/www/php
--enable-sockets --with-mysql=/usr/local/mysql --with-zlibdir=/
usr/local
--with- gd
注意：这些为一行，中间不要有回车。
cp php.ini-dist
/www/php/php.ini
编辑httpd.conf(/www/conf):
加入两行
LoadModule php4_module
modules/libphp4.so
AddType application/x-httpd-php
.php
httpd.conf中相关内容如下：
#
# LoadModule foo_module
modules/mod_foo.so
LoadModule php4_module modules/libphp4.so
# AddType
allows you to tweak mime.types without actually editing it, or $
# make
certain files to be certain types.
#
AddType application/x-tar
.tgz
AddType image/x- icon .ico
AddType application/x-httpd-php .php
设置Apache为自启动：
cp /www/bin/apachectl /etc/init.d/httpd
cd
/etc/rc3.d
ln -s /etc/init.d/httpd S85httpd
ln -s /etc/init.d/httpd
K85httpd
cd /etc/rc5.d
ln -s /etc/init.d/httpd S85httpd
ln -s
/etc/init.d/httpd K85httpd
测试一下 PHP:
cd /etc/init.d
./httpd start
在/www/htdocs下建立文件
test.php
cd /www/htdocs
vi
test.php
加入
phpinfo();
?>
用浏览器访问,成功的话，出现一些
系统,apache,php信息
5.安装 Snort2.0
5.1建立snort配置文件和日志目录
mkdir /etc/snort
mkdir
/var/log/snort
tar -zxvf snort-2.x.x.tar.gz
cd snort-2.x.x
./configure
--with-mysql=/usr/local/mysql
make
make install
5.2安装规则和配置文件
cd
rules (在snort安装目录下）
cp * /etc/snort
cd ../etc
cp snort.conf
/etc/snort
cp *.config
/etc/snort
5.3修改snort.conf(/etc/snort/snort.conf)
var HOME_NET 10.2.2.0/24
(修改为你的内部网网络地址，我的是
192.168.0.0/24)
var RULE_PATH ../rules 修改为 var RULE_PATH
/etc/snort/
改变记录日志数据库：
output database: log, mysql, user=root
password=your_password
dbname=snort host=localhost
5.4设置snort为自启动：
在snort安装目录下
cd /contrib
cp S99snort
/etc/init.d/snort
vi
/etc/init.d/snort
修改snort如下：
CONFIG=/etc/snort/snort.conf
#SNORT_GID=nogroup
(注释掉）
$SNORT_PATH/snort -c $CONFIG -i $IFACE $OPTIONS
(去掉原文件中的 -g
$SNORT_GID )
chmod 755 /etc/init.d/snort
cd /etc/rc3.d
ln -s
/etc/init.d/snort S99snort
ln -s /etc/init.d/snort K99snort
cd
/etc/rc5.d
ln -s /etc/init.d/snort S99snort
ln -s /etc/init.d/snort
K99snort
四.在mysql中建立数据库
/usr/local/mysql/bin/mysql
mysql>SET PASSWORD FOR
);
mysql>create
database snort;
mysql>grant INSERT,SELECT on root.* to ;
mysql>quit;
进入snort安装目录：/usr/local/mysql/bin/mysql
-p <./contrib/create_mysql snort
>Enter password:
安装DB表：(在contrib目录）
zcat snortdb-extra.gz | /usr/local/mysql/bin/mysql -p
snort
进入mysql数据库，看看snort数据库中的表：
/usr/local/mysql/bin/mysql -p
>Enter
password:
mysql>show databases;
+------------+
|
Database
+------------+
| mysql
| snort
|
test
+------------+
3 rows in set (0.00 sec)
mysql>use snort;
mysql>show tables;
将会有这些：
+------------------+
| Tables_in_snort
|
+------------------+
| data
| detail
| encoding
| event
|
flags
| icmphdr
| iphdr
| opt
| protocols
| reference
|
reference_system
| schema
| sensor
| services
| sig_class
|
sig_reference
| signature
| tcphdr
|
udphdr
+------------------+
19 rows in set (0.00 sec)
mysql>exit
五.安装配置Web接口
安装JPGraph1.11
cp jpgraph-1.11.tar.gz /www/htdocs
cd
/www/htdocs
tar -xzvf jpgraph-1.xx.tar.gz
rm -rf jpgrap-1.xx.tar.gz
cd
jpgraph-1.11
rm -rf README
rm -rf QPL.txt
安装ADODB:
cp adodb330.tgz
/www/htdocs/
cd /www/htdocs
tar -xzvf adodb330.tgz
rm -rf
adodb330.tgz
安装配置Acid:
cp acid-0.0.6b23.tar.gz /www/htdocs
cd /www/htdocs
tar
-xvzf acid-0.9.6b23.tar.gz
rm -rf acid-0.9.6b23.tar.gz
cd
/www/htodcs/acid/
编辑acid_conf.php,修改相关配置如下：
$DBlib_path =
"/www/htdocs/adodb";
/* The type of underlying alert database
*
* MySQL
: "mysql"
* PostgresSQL : "postgres"
* MS SQL Server :
"mssql"
*/
$DBtype = "mysql";
/* Alert DB connection parameters
* -
$alert_dbname : MySQL database name of Snort alert DB
* - $alert_host : host
on which the DB is stored
* - $alert_port : port on which to access the
DB
* - $alert_user : login to the database with this user
* -
$alert_password : password of the DB user
*
* This information can be
gleaned from the Snort database
* output plugin
configuration.
*/
$alert_dbname = "snort";
$alert_host =
"localhost";
$alert_port = "";
$alert_user = "root";
$alert_password =
"Your_Password";
/* Archive DB connection parameters */
$archive_dbname =
"snort";
$archive_host = "localhost";
$archive_port = "";
$archive_user
= "root";
$archive_password = "Your_Password ";
And a little further
down
$ChartLib_path = "/www/htdocs/jpgraph-1.11/src";
/* File format of
charts ('png', 'jpeg', 'gif') */
$chart_file_format =
"png";
进入web界面：
点"Setup
Page"链接 ->Create Acid AG
访问将会看到ACID界面。
六.测试系统
重启系统或者直接启动相关后台程序：
/etc/init.d/mysql
restart
/etc/init.d/snort start
/etc/init.d/httpd
start
利用nmap,nessus,CIS或者X-scan对系统进行扫描，
产生告警纪录。
察看纪录。
至此，一个功能强大的IDS配置完毕。各位可以利用web界面
远程登陆，监控主机所处局域网，同时安装phpMyAdmin对mysql
数据库进行操控。
ick S.Harper
翻译整理:ids,mapple
声明：欢迎转载.
[-]=========================================[-]
一.系统平台
Redhat9.0发行版， 安装gcc
及相关库文件，建议不要安装
Apache,PHP,MySQL,我们将用源码编译安装。基于安全方面的
考虑，可以设置一下iptables只允许SSH和WWW访问。
二.软件
MySQL4.0.12
Snort2.0.0
Apache2.0.45
PHP4.3.1
ADODBv3.30
Acid0.9.6b23
Zlib1.1.4
JPGraph1.11
LibPcap0.7.2
建议到这个站点下载
也可以到下载相关的xx....若安装了rpm包，
可以强行将其反安装
rpm
-e -nodeps xx.xx
三.安装(建议将所有的包文件考到同一目录)
1.安装zlib1.1.4
tar -xzvf zlib-xx.tar.gz
cd
zlib-xx
./configure;make test
make install
cd
..
2.安装LibPcap0.7.2
tar -xzvf libpcap.tar.gz
cd
libpcap-xx
./configure
make
make install
cd
..
3.安装MySQL4.0.12
3.1创建mysql组和mysql用户
groupadd mysql
useradd -g
mysql mysql
修改/root下的.bash_profile的这一行：
PATH=$PATH:$HOME/bin
为
PATH=$PATH:$HOME/bin:/usr/local/mysql/bin
3.2安装mysql
tar -xzvf
mysql-xx.tar.gz
cd mysql-xx
./configure
--prefix=/usr/local/mysql
make
make install
cd
scripts
./mysql_install_db
chown -R root /usr/local/mysql
chown -R
mysql /usr/local/mysql/var
chgrp -R mysql /usr/local/mysql
cd
../support-files/my-medium.cnf
/etc/my.cnf
向/etc/ld.so.conf中加入两行：/usr/local/mysql/lib/mysql
/usr/local/lib
载入库，执行
ldconfig
-v
3.3测试mysql是否工作：
cd /usr/local/mysql/bin/
./mysqld_safe
--user=mysql&
#ps -ef |grep
mysql
看mysql_safe是否工作
3.4设置mysql为自启动：
将mysql安装目录下的support-files目录中的
mysql.server文件拷到/etc/init.d目录
cp
mysql.server /etc/init.d/mysql
chmod 755 /etc/init.d/mysql
创建硬链接:
cd
/etc/rc3.d（文本方式启动)
ln -s /etc/init.d/mysql S85mysql
ln -s
/etc/init.d/mysql K85mysql
cd /etc/rc5.d (图形方式启动）
ln -s /etc/init.d/mysql
S85mysql
ln -s /etc/init.d/mysql K85mysql
4.安装Apache2.0.45和PHP4.3.1
tar -zxvf httpd-2.0.xx.tar.gz
cd
httpd_2.xx.xx
./configure --prefix=/www --enable-so
注：apache根目录为
/www
make
make install
cd ..
tar -zxvf php-4.3.x.tar.gz
cd php-4.3.x
./configure
--prefix=/www/php --with-apxs2=/www/bin/apxs --with-config- filepath=/www/php
--enable-sockets --with-mysql=/usr/local/mysql --with-zlibdir=/
usr/local
--with- gd
注意：这些为一行，中间不要有回车。
cp php.ini-dist
/www/php/php.ini
编辑httpd.conf(/www/conf):
加入两行
LoadModule php4_module
modules/libphp4.so
AddType application/x-httpd-php
.php
httpd.conf中相关内容如下：
#
# LoadModule foo_module
modules/mod_foo.so
LoadModule php4_module modules/libphp4.so
# AddType
allows you to tweak mime.types without actually editing it, or $
# make
certain files to be certain types.
#
AddType application/x-tar
.tgz
AddType image/x- icon .ico
AddType application/x-httpd-php .php
设置Apache为自启动：
cp /www/bin/apachectl /etc/init.d/httpd
cd
/etc/rc3.d
ln -s /etc/init.d/httpd S85httpd
ln -s /etc/init.d/httpd
K85httpd
cd /etc/rc5.d
ln -s /etc/init.d/httpd S85httpd
ln -s
/etc/init.d/httpd K85httpd
测试一下 PHP:
cd /etc/init.d
./httpd start
在/www/htdocs下建立文件
test.php
cd /www/htdocs
vi
test.php
加入
phpinfo();
?>
用浏览器访问,成功的话，出现一些
系统,apache,php信息
5.安装 Snort2.0
5.1建立snort配置文件和日志目录
mkdir /etc/snort
mkdir
/var/log/snort
tar -zxvf snort-2.x.x.tar.gz
cd snort-2.x.x
./configure
--with-mysql=/usr/local/mysql
make
make install
5.2安装规则和配置文件
cd
rules (在snort安装目录下）
cp * /etc/snort
cd ../etc
cp snort.conf
/etc/snort
cp *.config
/etc/snort
5.3修改snort.conf(/etc/snort/snort.conf)
var HOME_NET 10.2.2.0/24
(修改为你的内部网网络地址，我的是
192.168.0.0/24)
var RULE_PATH ../rules 修改为 var RULE_PATH
/etc/snort/
改变记录日志数据库：
output database: log, mysql, user=root
password=your_password
dbname=snort host=localhost
5.4设置snort为自启动：
在snort安装目录下
cd /contrib
cp S99snort
/etc/init.d/snort
vi
/etc/init.d/snort
修改snort如下：
CONFIG=/etc/snort/snort.conf
#SNORT_GID=nogroup
(注释掉）
$SNORT_PATH/snort -c $CONFIG -i $IFACE $OPTIONS
(去掉原文件中的 -g
$SNORT_GID )
chmod 755 /etc/init.d/snort
cd /etc/rc3.d
ln -s
/etc/init.d/snort S99snort
ln -s /etc/init.d/snort K99snort
cd
/etc/rc5.d
ln -s /etc/init.d/snort S99snort
ln -s /etc/init.d/snort
K99snort
四.在mysql中建立数据库
/usr/local/mysql/bin/mysql
mysql>SET PASSWORD FOR
);
mysql>create
database snort;
mysql>grant INSERT,SELECT on root.* to ;
mysql>quit;
进入snort安装目录：/usr/local/mysql/bin/mysql
-p <./contrib/create_mysql snort
>Enter password:
安装DB表：(在contrib目录）
zcat snortdb-extra.gz | /usr/local/mysql/bin/mysql -p
snort
进入mysql数据库，看看snort数据库中的表：
/usr/local/mysql/bin/mysql -p
>Enter
password:
mysql>show databases;
+------------+
|
Database
+------------+
| mysql
| snort
|
test
+------------+
3 rows in set (0.00 sec)
mysql>use snort;
mysql>show tables;
将会有这些：
+------------------+
| Tables_in_snort
|
+------------------+
| data
| detail
| encoding
| event
|
flags
| icmphdr
| iphdr
| opt
| protocols
| reference
|
reference_system
| schema
| sensor
| services
| sig_class
|
sig_reference
| signature
| tcphdr
|
udphdr
+------------------+
19 rows in set (0.00 sec)
mysql>exit
五.安装配置Web接口
安装JPGraph1.11
cp jpgraph-1.11.tar.gz /www/htdocs
cd
/www/htdocs
tar -xzvf jpgraph-1.xx.tar.gz
rm -rf jpgrap-1.xx.tar.gz
cd
jpgraph-1.11
rm -rf README
rm -rf QPL.txt
安装ADODB:
cp adodb330.tgz
/www/htdocs/
cd /www/htdocs
tar -xzvf adodb330.tgz
rm -rf
adodb330.tgz
安装配置Acid:
cp acid-0.0.6b23.tar.gz /www/htdocs
cd /www/htdocs
tar
-xvzf acid-0.9.6b23.tar.gz
rm -rf acid-0.9.6b23.tar.gz
cd
/www/htodcs/acid/
编辑acid_conf.php,修改相关配置如下：
$DBlib_path =
"/www/htdocs/adodb";
/* The type of underlying alert database
*
* MySQL
: "mysql"
* PostgresSQL : "postgres"
* MS SQL Server :
"mssql"
*/
$DBtype = "mysql";
/* Alert DB connection parameters
* -
$alert_dbname : MySQL database name of Snort alert DB
* - $alert_host : host
on which the DB is stored
* - $alert_port : port on which to access the
DB
* - $alert_user : login to the database with this user
* -
$alert_password : password of the DB user
*
* This information can be
gleaned from the Snort database
* output plugin
configuration.
*/
$alert_dbname = "snort";
$alert_host =
"localhost";
$alert_port = "";
$alert_user = "root";
$alert_password =
"Your_Password";
/* Archive DB connection parameters */
$archive_dbname =
"snort";
$archive_host = "localhost";
$archive_port = "";
$archive_user
= "root";
$archive_password = "Your_Password ";
And a little further
down
$ChartLib_path = "/www/htdocs/jpgraph-1.11/src";
/* File format of
charts ('png', 'jpeg', 'gif') */
$chart_file_format =
"png";
进入web界面：
点"Setup
Page"链接 ->Create Acid AG
访问将会看到ACID界面。
六.测试系统
重启系统或者直接启动相关后台程序：
/etc/init.d/mysql
restart
/etc/init.d/snort start
/etc/init.d/httpd
start
利用nmap,nessus,CIS或者X-scan对系统进行扫描，
产生告警纪录。
察看纪录。
至此，一个功能强大的IDS配置完毕。各位可以利用web界面
远程登陆，监控主机所处局域网，同时安装phpMyAdmin对mysql
数据库进行操控。
