入侵檢測系統(tǒng)IDSCentOS6下基于snortbarnyard2base入侵檢測系統(tǒng)搭

1、CentOS6.6基于 snort+barnyard2+base 的入侵檢測系統(tǒng)的搭建由于網(wǎng)上對于linux下搭建基于snort的入侵檢測系統(tǒng)不是很詳細,這里我寫個文檔給本文檔主要使用的軟件已上傳至百度云：/IqWuiOcO密碼：y80f,其他軟件可以根據(jù)文檔中的命令在線下載安裝；文檔中的命令大多可以直接使用除非時間太久導致系統(tǒng)/軟彳/鏈接失去支持等,順利的話,可以在2小時內(nèi)搭建完畢；如果安裝報錯,請檢查步驟是正確,然后百度/google解決如果對文檔有疑問請加 QQ群1一、準備工作安裝CentOS6,4系統(tǒng)后面會升級到 6.6,不知道直接安裝 6,6會不會有問題；用CentOS7 后面配置b

2、ase會報錯,給系統(tǒng)設(shè)置IP和dns讓系統(tǒng)可以聯(lián)網(wǎng)1.安裝wget#yum install wget -y2,更換源#mv /etc/ /etc/#wget -O /etc/ /Centos-6.repo#yum clean all#yum makecache3,更新系統(tǒng)#yum -y update升級到了 6.64 .安裝epel源#yum install epel-release5 .下載安裝文件把網(wǎng)盤里的安裝文件下載到CentOS里備用可以利用附件中的FTPServer.exe傳輸,這里放到/root二、安裝配置LMAP1 .安裝LMAP組件#yum install d mysql-se

3、rver php php-mysql php-mbstring php-mcrypt mysql-devel2 .安裝php插件1 yum install mcrypt libmcrypt libmcrypt-devel3 .安裝pear插件#yum install php-pear#pear upgrade pear#pear channel-update#pear install mail#pear install Image_Graph-alpha Image_Canvas-alpha Image_Color Numbers_Roman#pear install mail_mime4 .

4、安裝 phpmyadmin不要隨意更換版本,可能會出現(xiàn)不支持數(shù)據(jù)庫的情況#tar zxvf phpMyAdmin- -C /var/www/html#mv /var/www/html/phpMyAdmin- /var/www/html/phpmyadmin5 .安裝 adodb#tar zxvf -C /var/www/html#mv /var/www/html/adodb5 /var/www/html/adodb6 .安裝base#tar zxvf base- -C /var/www/html#mv /var/www/html/base-1.4.5 /var/www/html/base7 .

5、設(shè)置 php.ini#vi /etc/php.ini error_reporting = E_ALL & E_NOTICE8 .酉己置 phpmyadmin#vi /var/www/html/phpmyadmin/libraries/$cfg'blowfish_secret'='' 改成 $cfg'blowfish_secret' = '123456,;注：其中的123456'為隨意的字符9,設(shè)置html目錄權(quán)限#chown -R apache:apache /var/www/html10 .設(shè)置adodb權(quán)限#chmod

6、 755 /var/www/html/adodb11 .配置 mysql解壓barnyard2 這里要用里面的文件創(chuàng) mysql表#tar zxvf barnyard2-啟動mysql#service mysqld start設(shè)置root密碼為123456#mysqladmin -u root -p password 123456以root 登陸 mysql#mysql -uroot -p創(chuàng)立名為snort的數(shù)據(jù)庫>create database snort;創(chuàng)立名為snort、密碼為123456的數(shù)據(jù)庫用戶并賦予名為snort數(shù)據(jù)庫權(quán)限>grant create,select,u

7、pdate,insert,delete on snort.* to snortlocalhost identified by '123456,;退出>exit創(chuàng)立數(shù)據(jù)庫表#mysql -usnort -p -Dsnort < /root/barnyard2-1.9/schemas/create_mysql12.酉己置base#service mysqld start啟動 mysql#service d start啟動 apache#service iptables stop關(guān)閉防火墻用瀏覽器翻開.234/base/setup/index.php (IP換成你自己的)1 .點

8、擊 Continuue - C 口 172J6-2 L1311中"仙三甲卜中后/三Basic Analysis and Security Engine (BASE) Setup ProgramThe foiiwJng pages 郵 II pnnript you for 5殘 up irrftjnnaiioFii to fintsh the insial erf BASEIf 初學 of tlw 口 面時性 Lab* AW 匕1 Hiwrv w II M 占 deLiiplllGh of . Ihd y ju nwd du 農(nóng) 廿七 tli JitSettingscoma%(1巾30

9、山：PTF Vc.TFLWi u止 Hh 網(wǎng)y siimg FARSrf2 .選擇顯示語言,設(shè)置 adodb路徑"七"I 'I* X C Dii / I .iJi-ph;Basic Analysis and Security Engine (BASE i Setup Program3,配置數(shù)據(jù)庫 f.D 172J6.21.131/baseAetup/setup2.php&三Basic Analysis and Security Engine (BASE) Setup Program4.設(shè)置admin用戶和密碼這里應(yīng)該是設(shè)置 admin的用戶和密碼,我這里跟

10、mysql的root_ 0三,十二4 4, .T-d Ai x .1,5.點擊“Createe BASE AG4 i G D 172J621J31/base/setup/setup4phpyli iBasic Analysis and Security Engine (BASE) Setup Program6.成功的話會有紅色 successfilly created字樣,如以下圖Centos7沒有,原因未知,點擊 “step 5C 二 172,16 21.131/：?ase/setup/setup4.php正 三SuccessfuSuc:essfiiSuccessfuSuc：&

11、9;sfllSuccessfuSue: es&fuMmSueSue 沔fucisntad ,creaUd , created »- ci4atBd v cieat ed'acidag' 恥記_肛曰廊 ,ecrdjp_sache, ecideveni tase_rolesV INSERTED Adirin ids,INSERTED Aurbenticated User role 卜 INSERTED Anonymous Us«r rala4 INSERTED Alen Group Ediior rale,creaud tac user'Basi

12、c Analysis and Security Engine BASE) Setup ProgramStep + of 5OpeiadonDescriptionStatusBASE tabht Adds Libhs U attend th# Snort DB to support 由白 BASE functional ttyDOME snortThe underlying Alert DB is configur&d for usage with BASE.Additional DB permissionsIn order to support Alart purging (the s

13、elective ability to permanently delete wlerls from the database) andDNSwhois lookup caching, ttia DB user '£nort'1 musl have the DELETE and UPDATE privilege cxi Iha databei導電"snor1lKaMo討Now continue7.安裝成功三、安裝酉己置 snort+barnyard21 .安裝依賴包#yum install gcc flex bison zlib libpcap tcpdum

14、p gcc-c+ pcre* zlib* libdnet libdnet-devel2 .安裝 libdnet這里必須是這個版本#tar zxvf libdnet-#cd libdnet-1.12#./configure && make && make install3 .安裝 libpcap這里必須#wget /libpcap-#tar zxvf libpcap-#cd libpcap-1.0.0#./configure && make && make install4 .安裝DAQ#tar zxvf daq-#cd daq-2

15、.0.4#./configure && make && make install5 .安裝 snort#tar zxvf snort-#cd snort-#./configure && make && make install6.配置 snort創(chuàng)立需要的文件和目錄#mkdir /etc/snort#mkdir /var/log/snort#mkdir /usr/local/lib/snort_dynamicrules#mkdir /etc/snort/rules#touch /etc/snort/rules/white_list

16、.rules /etc/snort/rules/black_list.rules#cp /root/snort- threshold.conf classification.config reference.config unicode.map snort.conf /etc/snort/編輯配置文件#vi /etc/snort/snort.conf定義路徑變量var RULE_PATH /etc/snort/rulesvar SO_RULE_PATH /etc/snort/so_rulesvar PREPROC_RULE_PATH /etc/snort/preproc_rulesvar WH

17、ITE_LIST_PATH /etc/snort/rulesvar BLACK_LIST_PATH /etc/snort/rules設(shè)置log目錄config logdir ： /var/log/snort配置輸出插件output unified2 : filename snort.log , limit 1287,配置規(guī)那么#tar zxvf snortrules-snapshot- -C /etc/snort/#cp /etc/snort/etc/sid-msg.map /etc/snort/8 .測試 snort如果最后出現(xiàn)success的字樣說明配置好了#snort -T -i eth

18、0 -c /etc/snort/snort.conf9 .安裝 barnyard2#cd /root/barnyard2-1.9#./configure -with-mysql -with-mysql-libraries=/usr/lib64/mysql/#make && make install10 .配置 barnyard2創(chuàng)立需要的文件和目錄# mkdir /var/log/barnyard2# touch /var/log/snort/barnyard2.waldo# cp /root/barnyard2-1.9/etc/barnyard2.conf /etc/snor

19、t編輯配置文件# vi /etc/snort/barnyard2.confconfig logdir:/var/log/barnyard2config hostname:localhostconfig interface:eth0config waldo_file:/var/log/snort/barnyard.waldooutput database: log, mysql, user=snort password=123456 dbname=snort host=localhost11 .測試 barnyard2#barnyard2 -c /etc/snort/barnyard2.conf

20、 -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo四、測試IDS是否正常工作1 .編寫測試規(guī)那么#vi /etc/snort/rules/local.rulesalert icmp any any -> any any (msg: "IcmP Packet detected"sid:1000001;) (這是一條檢查ping包的規(guī)那么)2 .啟動IDS#service mysqld start#service d start#service iptables stop#barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo -D#snort -c /etc/snort/snort.conf -i eth0- D3 .測