snort入侵檢測(cè)試驗(yàn)報(bào)告

實(shí)驗(yàn)：入侵檢測(cè)系統(tǒng)（Snort）的安裝與配置一、實(shí)驗(yàn)?zāi)康膶W(xué)會(huì)WINDOWS下SNORT的安裝與配置二、實(shí)驗(yàn)環(huán)境WinXP虛擬機(jī)三、實(shí)驗(yàn)步驟與結(jié)果.在“我的電腦”中C盤(pán)中建立文件夾“zhangxiaohong”.安裝WinPcap,運(yùn)行WinPcap_4_1_2.zip,默認(rèn)安裝。.在“我的電腦”中C盤(pán)中建立文件夾“zhangxiaohong”.安裝WinPcap,運(yùn)行WinPcap_4_1_2.zip,默認(rèn)安裝。V/inPcap4.0.2InstallerWelcometotheWinPcap4,0.2InstallationWizardTECHNOLOGIESThisproductisbroughttoyoubyCACENullsoftInstallSystemv2.16[_Next> |[ 匚anEPacketCapturfn9andNetworkAnnfycisSofutioncVinFcap4_0_2Setup三.安裝mysql,運(yùn)行mysql-5.0.22-win32.zip,選擇自定義安裝選擇安裝路徑C:\zhangxiaohong\mysql下，安裝時(shí)注意：端口設(shè)置為3306（以后要用到），密碼本實(shí)驗(yàn)設(shè)置成123.安裝apache.運(yùn)行apache_2.2.4—win32-x86—no_ssl.zip,安裝至Uc:\zhangxiaohong\Apache.安裝Apache,配置成功一個(gè)普通網(wǎng)站服務(wù)器.出現(xiàn)ApacheHTTPServer2.0.55的安裝向?qū)Ы缑?，點(diǎn)“Next”繼續(xù).確認(rèn)同意軟件安裝使用許可條例，選擇“Iacceptthetermsinthelicenseagreement”，點(diǎn)“Next”繼續(xù).將Apache安裝到Windows上的使用須知，請(qǐng)閱讀完畢后，按“Next”繼續(xù).選擇安裝類型，Typical為默認(rèn)安裝，Custom為用戶自定義安裝，我們這里選擇Custom,有更多可選項(xiàng)。按“Next”繼續(xù).出現(xiàn)選擇安裝選項(xiàng)界面，如圖所示，左鍵點(diǎn)選“ApacheHTTPServer2.0.55”，選擇“Thisfeature,andallsubfeatures,willbeinstalledonlocalharddrive.”.即“此部分，及下屬子部分內(nèi)容，全部安裝在本地硬盤(pán)上”。點(diǎn)選“Change...”，手動(dòng)指定安裝目錄。.我這里選擇安裝在"C:\zhangxiaohong\Apache”，各位自行選取了，一般建議不要安裝在操作系統(tǒng)所在盤(pán)，免得操作系統(tǒng)壞了之后，還原操作把Apache配置文件也清除了。選“OK”繼續(xù)。.返回剛才的界面，選“Next”繼續(xù)。.好了現(xiàn)在我們來(lái)測(cè)試一下按默認(rèn)配置運(yùn)行的網(wǎng)站界面，在IE地址欄打“”，點(diǎn)“轉(zhuǎn)到”，就可以看到如下頁(yè)面，表示Apache服務(wù)器已安裝成功。Ji--- x?+優(yōu)叼生辿3W9芥解R.￡口以方卷」勺.工卬歲11卜?甘，小W怛士i員劉3代并，越 這不是你想看電的頁(yè)面空？■之班以臺(tái).見(jiàn)式tn面，是用/月哪俎以收總門(mén)1T站點(diǎn)的皿蟒有黑河，陋昏岬推歸點(diǎn)的人同+ 即比岫點(diǎn)所瘦用的南網(wǎng) , 園笈?HT以在恬用上的網(wǎng)玷偏弱型上，自由地快用下面的圖片.再用便用好餐川--j^^pwarvribqpAF=>AUIEZ.| .安裝和配置PHP53、安裝winpcap.解壓php-5.2.5-Win32至Uc:\zhangxiaohong\php.添加gd圖形庫(kù)支持復(fù)制c:\zhangxiaohong\php\php5ts.dll和c:\zhangxiaohong\php\libmysql.dll文件至UC:\Windows\system32復(fù)制c:\zhangxiaohong\php\php.ini-dist到C:\Windows文件夾并重命名為php.ini,修改php.ini,分別去掉“extension=php_gd2.dll”和“extension=php_mysql.dll”前的分號(hào)，.并指定extension_dir="c:\zhangxiaohong\php\ext",.同時(shí)復(fù)制c:\zhangxiaohong\php\ext下的php_gd2.dll與php_mysql.dll至UC:\Windows\system32在C:\zhangxiaohong\apache\conf\httpd.conf中添加口LoadModulephp5_modulec:/zhangxiaohong/php/php5apache2.dllAddTypeapplication/x-httpd-php.phpAddTypeapplication/x-httpd-php-source.phpsAddTypeapplication/x-httpd-php.htmlAddTypeapplication/x-httpd-php.htm.重啟Apache服務(wù)在C:\zhangxiaohong\apache\htdocs目錄下新建webinf.php(文件內(nèi)容為：<?phpinfo();?>)并使用/webinf.php訪問(wèn)測(cè)試是否能夠顯示當(dāng)前Apache服務(wù)器的信息，如果能夠顯示表明Apache和php工作基本正常六.安裝snort.運(yùn)行Snort2905Installer.exe安裝在C:\zhangxiaohong\Snort下即可，運(yùn)行C:\zhangxiaohong\Snort\bin\snort.exe或者在DOS中找到該位置，如果安裝Snort成功會(huì)出現(xiàn)一個(gè)可愛(ài)的小豬.并按照以下修改C:\zhangxiaohong\Snort\etc\snort.conf文件.打開(kāi)snort.conf文件.在文檔中作相應(yīng)的修改.varRULE_PATHc:\zhangxiaohong\snort\rulesincludeclassification.configincludereference.config修改為絕對(duì)路徑：includec:\zhangxiaohong\snort\etc\classification.configincludec:\zhangxiaohong\snort\etc\reference.config在該文件的最后加入下面語(yǔ)句：outputdatabase:alert,mysql,host=localhostuser=rootpassword=123dbname=snortencoding=hexdetail=full.創(chuàng)建snort數(shù)據(jù)庫(kù)的表復(fù)制c:\zhangxiaohong\snort\schames文件夾下的create_mysql文件至UC:\zhangxiaohong\mysql\bin文件夾下七.安裝和設(shè)置mysql打開(kāi)mysql的的客戶端執(zhí)行如下命令Createdatabasesnort;Createdatabasesnort_archive;Usesnort;Sourcecreate_mysql;Usesnort_archive;Sourcecreate_mysql;Grantallon*.*to“root”@”localhost”;加入php對(duì)mysql的支持：得到修改c:\windows\php.ini文件去掉extension=php_mysql.dll前的分號(hào)。復(fù)制c:\zhangxiaohong\php\ext文件夾下的php_mysql.dll文件到c:\windows文件夾。復(fù)制c:\zhangxiaohong\php\libmysql.dll文件至Uc:\windows\system32下八.安裝adodb解壓縮adodb到c:\zhangxiaohong\php\adodb文件夾下。九.安裝jpgrapg庫(kù)解壓縮jpgraph到c:\zhangxiaohong\php\jpgraph文件夾下十.安裝acid解壓縮acid到c\zhangxiaohong\apache\apache2\htdocs\acid文件夾下修改acid_conf.php文件為以下內(nèi)容$DBlib_path="c:\zhangxiaohong\php\adodb";$DBtype="mysql";$alert_dbname="snort";$alert_host="localhost";$alert_port="3306";$alert_user="root";$alert_password="123";$archive_dbname="snort_archive";$archive_host="localhost";$archive_port="3306";$archive_user="root";$archive_password="123";$ChartLib_path="c:\zhangxiaohong\php\jpgraph\src";十一.重啟apache、mysql服務(wù)十二..在瀏覽器中初始化acid數(shù)據(jù)庫(kù)：http://localhost/acid/acid_db_setup.php單擊CRETEACIDAG按鈕，AddstablestoextendtheSnortDBtosupporttheACIDfunctionality安裝成功，測(cè)試一下：?jiǎn)?dòng)Apache和mysql服務(wù)運(yùn)行ACID：打開(kāi)瀏覽器，地址為/acid。則表示ACID安裝成功。十三.解壓縮snort規(guī)則包把壓縮包內(nèi)的所有文件解壓縮到c:\zhangxiaohong\snort\下十四.啟動(dòng)snortC:\zhangxiaohong\snort\bin\snort.exe-c“c:\zhangxiaohong\snort\etc\snort.conf”-l"c:\zhangxiaohong\snort\log”—d—e-X如果出現(xiàn)錯(cuò)誤修改snort配置文件c:\zhangxiaohong\snort\etc\snort.conf修改內(nèi)容如下：將dynamicpreprocessordirectory/usr/local/lib/snort_dynamicpreprocessor/修改為：dynamicpreprocessordirectoryC:/zhangxiaohong/snort/lib/snort_dynamicpreprocessor/dynamicpreprocessorfileC:/zhangxiaohong/snort/lib/snort_dynamicpreprocessor/sf_ssl.dll將dynamicpreprocessorfile〈fullpathtolibsf_dcerpc_preproc.so〉修改為：dynamicpreprocessorfileC:\zhangxiaohong\Snort\lib\snort_dynamicpreprocessor\sf_dcerpc.dll參考上一條在相應(yīng)位置修改為下面內(nèi)容：dynamicpreprocessorfileC:\zhangxiaohong\Snort\lib\snort_dynamicpreprocessor\sf_dns.dlldynamicpreprocessorfileC:\zhangxiaohong\Snort\lib\snort_dynamicpreprocessor\sf_ftptelnet.dlldynamicpreprocessorfileC:\zhangxiaohong\Snort\lib\snort_dynamicpreprocessor\sf_smtp.dlldynamicpreprocessorfileC:\

zhangxiaohong\Snort\lib\snort_dynamicpreprocessor\sf_ssh.dlldynamicengineC:/zhangxiaohong/Snort/lib/snort_dynamicengine/sf_engine.dlloutputdatabase:alert,mysql,user二rootpassword=123dbname:snorthost=localhostencoding:hexdetail二fullincludec:\zhangxiaohong\snort\etc\classification.configincludec:\zhangxiaohong\snort\etc\reference.