在RedHat9上構建入侵檢測系統

2019-11-04 12:14:21

字體：大中小

來源：轉載

供稿：網友

　　所需軟件工具：Snort+Apache+php4+MySQL+Acid

一.系統平臺

　　Redhat9.0發行版，安裝gcc 及相關庫文件，建議不要安裝Apache,PHP,MySQL,我們將用源碼編譯安裝。基于安全方面的考慮，可以設置一下iptables只答應SSH和WWW訪問。

二.軟件

　　MySQL4.0.12 http://mysql.secsup.org

　　Snort2.0.0 http://www.snort.org

　　Apache2.0.45 http://www.apache.org

　　PHP4.3.1 http://www.php.net

　　ADODBv3.30 http://phplens.com

　　Acid0.9.6b23　http://acidlab.sourceforge.net

　　Zlib1.1.4 http://flow.dl.sourceforge.net

　　JPGraph1.11 http://jpgraph.techuk.com

　　LibPcap0.7.2 http://www.tcpdump.org

　　建議到這個站點下載http://FTP.cdut.edu.cn/pub/linux/NEW/

　　也可以到http://www.rpmfind.com下載相關的xx.src.rpm編譯安裝。如若安裝了rpm包，可以強行將其反安裝 rpm -e -nodeps xx.xx

三.安裝(建議將所有的包文件考到同一目錄)

1.安裝zlib1.1.4

tar -xzvf zlib-xx.tar.gz

cd zlib-xx

./configure;make test

make install

cd ..

2.安裝LibPcap0.7.2

tar -xzvf libpcap.tar.gz

cd libpcap-xx

./configure

make

make install

cd ..

3.安裝MySQL4.0.12

　　3.1創建mysql組和mysql用戶

groupadd mysql

useradd -g mysql mysql

　　修改/root下的.bash_PRofile的這一行：

PATH= $PATH: $HOME/bin 為

PATH= $PATH: $HOME/bin:/usr/local/mysql/bin

　　3.2安裝mysql

tar -xzvf mysql-xx.tar.gz

cd mysql-xx

./configure --prefix=/usr/local/mysql

make

make install

cd scripts

./mysql_install_db

chown -R root /usr/local/mysql

chown -R mysql /usr/local/mysql/var

chgrp -R mysql /usr/local/mysql

cd ../support-files/my-medium.cnf /etc/my.cnf

　　向/etc/ld.so.conf中加入兩行：

/usr/local/mysql/lib/mysql

/usr/local/lib

　　載入庫，執行

ldconfig -v

　　3.3測試mysql是否工作：

cd /usr/local/mysql/bin/

./mysqld_safe --user=mysql&

#ps -ef grep mysql

　　看mysql_safe是否工作

　　3.4設置mysql為自啟動：

　　將mysql安裝目錄下的support-files目錄中的

　　mysql.server文件拷到/etc/init.d目錄

cp mysql.server /etc/init.d/mysql

chmod 755 /etc/init.d/mysql

　　創建硬鏈接:

　　cd /etc/rc3.d（文本方式啟動)

ln -s /etc/init.d/mysql S85mysql

ln -s /etc/init.d/mysql K85mysql

cd /etc/rc5.d (圖形方式啟動）

ln -s /etc/init.d/mysql S85mysql

ln -s /etc/init.d/mysql K85mysql

4.安裝Apache2.0.45和PHP4.3.1

tar -zxvf httpd-2.0.xx.tar.gz

cd httpd_2.xx.xx

./configure --prefix=/www --enable-so

注：apache根目錄為 /www

make

make install

cd ..

tar -zxvf php-4.3.x.tar.gz

cd php-4.3.x

./configure --prefix=/www/php --with-apxs2=/www/bin/apxs --with-config- filepath=/www/php --enable-sockets --with-mysql=/usr/local/mysql --with-zlibdir=/

usr/local --with- gd

注重：這些為一行，中間不要有回車。

cp php.ini-dist /www/php/php.ini

　　編輯httpd.conf(/www/conf):

　　加入兩行

LoadModule php4_module modules/libphp4.so

AddType application/x-httpd-php .php

　　httpd.conf中相關內容如下：

#

# LoadModule foo_module modules/mod_foo.so

LoadModule php4_module modules/libphp4.so

# AddType allows you to tweak mime.types without actually editing it, or $

# make certain files to be certain types.

#

AddType application/x-tar .tgz

AddType image/x- icon .ico

AddType application/x-httpd-php .php

　　設置Apache為自啟動：

cp /www/bin/apachectl /etc/init.d/httpd

cd /etc/rc3.d

ln -s /etc/init.d/httpd S85httpd

ln -s /etc/init.d/httpd K85httpd

cd /etc/rc5.d

ln -s /etc/init.d/httpd S85httpd

ln -s /etc/init.d/httpd K85httpd

　　測試一下 PHP:

cd /etc/init.d

./httpd start

　　在/www/htdocs下建立文件 test.php

cd /www/htdocs

vi test.php

　　加入

lt;?php

hpinfo();

?>

　　用瀏覽器訪問http://IP_address/test.php,成功的話，出現一些系統,apache,php信息

5.安裝 Snort2.0

5.1建立snort配置文件和日志目錄

mkdir /etc/snort

mkdir /var/log/snort

tar -zxvf snort-2.x.x.tar.gz

cd snort-2.x.x

./configure --with-mysql=/usr/local/mysql

make

make install

5.2安裝規則和配置文件

cd rules (在snort安裝目錄下）

cp * /etc/snort

cd ../etc

cp snort.conf /etc/snort

cp *.config /etc/snort

5.3修改snort.conf(/etc/snort/snort.conf)

　　var HOME_NET 10.2.2.0/24 (修改為你的內部網網絡地址，我的是 192.168.0.0/24)

　　var RULE_PATH ../rules 修改為 var RULE_PATH /etc/snort/

　　改變記錄日志數據庫：

output database: log, mysql, user=root passWord=your_password

dbname=snort host=localhost

5.4設置snort為自啟動：

　　在snort安裝目錄下

cd /contrib

cp S99snort /etc/init.d/snort

vi /etc/init.d/snort

　　修改snort如下：

CONFIG=/etc/snort/snort.conf

#SNORT_GID=nogroup (注釋掉）

#8194;$SNORT_PATH/snort -c $CONFIG -i $IFACE $OPTIONS

(去掉原文件中的 -g $SNORT_GID )

chmod 755 /etc/init.d/snort

cd /etc/rc3.d

ln -s /etc/init.d/snort S99snort

ln -s /etc/init.d/snort K99snort

cd /etc/rc5.d

ln -s /etc/init.d/snort S99snort

ln -s /etc/init.d/snort K99snort

四.在mysql中建立數據庫

/usr/local/mysql/bin/mysql

mysql>SET PASSWORD FOR root@localhost=PASSWORD('your_password');

mysql>create database snort;

mysql>grant INSERT,SELECT on root.* to snort@localhost;

mysql>quit;

　　進入snort安裝目錄：

/usr/local/mysql/bin/mysql -p <./contrib/create_mysql snort

gt;Enter password:

　　安裝DB表：(在contrib目錄）

zcat snortdb-extra.gz /usr/local/mysql/bin/mysql -p snort

　　進入mysql數據庫，看看snort數據庫中的表：

/usr/local/mysql/bin/mysql -p

gt;Enter password:

mysql>show databases;

+------------+

Database

+------------+

mysql

snort

test

+------------+

3 rows in set (0.00 sec)

mysql>use snort;

mysql>show tables;

　　將會有這些：

+------------------+

Tables_in_snort

+------------------+

data

detail

encoding

event

flags

icmphdr

iphdr

opt

protocols

reference

reference_system

schema

sensor

services

sig_class

sig_reference

signature

tcphdr

udphdr

+------------------+

19 rows in set (0.00 sec)

mysql>exit

五.安裝配置Web接口

　　安裝JPGraph1.11

cp jpgraph-1.11.tar.gz /www/htdocs

cd /www/htdocs

tar -xzvf jpgraph-1.xx.tar.gz

rm -rf jpgrap-1.xx.tar.gz

cd jpgraph-1.11

rm -rf README

rm -rf QPL.txt

　　安裝ADODB:

cp adodb330.tgz /www/htdocs/

cd /www/htdocs

tar -xzvf adodb330.tgz

rm -rf adodb330.tgz

　　安裝配置Acid:

cp acid-0.0.6b23.tar.gz /www/htdocs

cd /www/htdocs

tar -xvzf acid-0.9.6b23.tar.gz

rm -rf acid-0.9.6b23.tar.gz

cd /www/htodcs/acid/

　　編輯acid_conf.php,修改相關配置如下：

#8194;$DBlib_path = "/www/htdocs/adodb";

/* The type of underlying alert database

*

* MySQL : "mysql"

* PostgresSQL : "postgres"

* MS SQL Server : "MSSQL"

*/

#8194;$DBType = "mysql";

/* Alert DB connection parameters

* - $alert_dbname : MySQL database name of Snort alert DB

* - $alert_host : host on which the DB is stored

* - $alert_port : port on which to access the DB

* - $alert_user : login to the database with this user

* - $alert_password : password of the DB user

*

* This information can be gleaned from the Snort database

* output plugin configuration.

*/

#8194;$alert_dbname = "snort";

#8194;$alert_host = "localhost";

#8194;$alert_port = "";

#8194;$alert_user = "root";

#8194;$alert_password = "Your_Password";

/* Archive DB connection parameters */

#8194;$archive_dbname = "snort";

#8194;$archive_host = "localhost";

#8194;$archive_port = "";

#8194;$archive_user = "root";

#8194;$archive_password = "Your_Password ";

And a little further down

#8194;$ChartLib_path = "/www/htdocs/jpgraph-1.11/src";

/* File format of charts ('png', 'jpeg', 'gif') */

#8194;$chart_file_format = "png";