內容包括如下：
打造FC3下的snort＋BASE中文入侵檢測系統
數據庫安全：如何安全的配置和應用MySQL數據庫？
DNS配置全過程
Proxy Server
Linux下架設代理服務器
IPTABLES指南
Linux策略性路由應用及深入分析
PC SERVER的選型
LIDS入侵檢測和防御系統安裝與研究 (轉貼）
Linux的用戶和用戶組管理
[轉帖]打造FC3下的snort＋BASE中文入侵檢測系統
所需軟件包:snort2-3.0.tar.gz
下載地址:http://www.snort.org
apache.xxx.tar.gz
php-4.x.x.tar.gz
mysql-4.x.x.tar.gz
pcre5.0.tar.gz
下載地址:http://sourceforge.net/project/showfiles.p...?group_id=10194
ADODB
http://sourceforge.net/project/showfiles.p...?group_id=42718
JPGraph
http://fresh.t-systems-sfr.com/unix/src/ww...aph-1.17.tar.gz
BASE
http://sourceforge.net/project/showfiles.p...ckage_id=128846
apache+php+mysql的安裝就不介紹了,多的是
注意的是編譯php要加上GD參數
我的安裝方法:
mysql:
./configure --prefix=/usr/local/mysql
make
make install
apache:
./configure --enable-so
make
make install
php:
#./configure --with-mysql --with-apxs2=/usr/local/apache2/bin/apxs --with-mysql --with-zlib --with-jpeg --with-gd --with-png
--enable-track-vars --enable-sockets --disable-debug ; make ; make install
安裝完后在www目錄用下面的test.php檢測:
<? phpinfo();?>
看看有沒有gd,mysql支持.
開始安裝snort:
1.先安裝pcre:
tar –xvzf pcre-5.0.tar.gz
cd pcre-5.0
./configure
make
make install
2.安裝 snort-2.3.0.tar.gz
tar -xvzf snort-2.3.0.tar.gz
cd snort-2.3.0
./configure --with-mysql
make
make install
groupadd snort //建立snort用戶組
useradd -g snort snort //增加snort用戶,并加入snort組
mkdir /etc/snort //在etc下建立snort目錄
mkdir /etc/snort/rules //在etc下建立snort規則目錄
mkdir /var/log/snort //建立snort日志目錄
cd rules
cp * /etc/snort/rules //拷貝規則到etc下
cd ../etc
cp * /etc/snort //拷貝配置文件到etc下
編輯/etc/snort.conf:
更改var HOME_NET 10.2.2.0/24 //為你工作的網段
更改“var RULE_PATH ../rules” to “var RULE_PATH /etc/snort/rules”
把下面一行前面的#去掉,并改為下面的樣式:
output database: log, mysql, user=snort password=snort dbname=snort host=localhost //將snort日志寫入mysql的數據庫snort,用戶
名和密碼是snort,稍后在建立這些
保存退出
增加一行到 /etc/rc.local 下次可以自動啟動snort
“/usr/local/bin/snort -c /etc/snort/snort.conf -i eth0 -g snort”
新建一個數據庫snort,并建立用戶名和密碼snort:
mysql
mysql> SET PASSWORD FOR root@localhost=PASSWORD('xxx'); //改root密碼
>Query OK, 0 rows affected (0.25 sec)
mysql> create database snort;
>Query OK, 1 row affected (0.01 sec)
mysql> grant INSERT,SELECT on root.* to snort@localhost;
>Query OK, 0 rows affected (0.02 sec)
mysql> SET PASSWORD FOR snort@localhost=PASSWORD('snort');
>Query OK, 0 rows affected (0.25 sec)
mysql> grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort@localhost;
>Query OK, 0 rows affected (0.02 sec)
mysql> grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort;
>Query OK, 0 rows affected (0.02 sec)
mysql> exit
>Bye
執行下面的命令:
mysql -u root -p < ~/snortinstall/snort-2.3.0/schemas/create_mysql snort //為snort建立數據表
Enter password: //輸入root的密碼
檢查數據庫和數據結構:
mysql -p
>Enter password:
mysql> SHOW DATABASES;
(You should see the following)
+------------+
| Database
+------------+
| mysql
| Snort
| test
+------------+
3 rows in set (0.00 sec)
mysql> use snort
>Database changed
mysql> SHOW TABLES;
+------------------+
| Tables_in_snort
+------------------+
| data
| detail
| encoding
| event
| icmphdr
| iphdr
| opt
| reference
| reference_system
| schema
| sensor
| sig_class
| sig_reference
| signature
| tcphdr
| udphdr
+------------------+
16 rows in set (0.00 sec)
exit;
看到上面的表就成功了.
安裝BASE部分:
1.先安裝JPGraph:
cp jpgraph-1.17.tar.gz /var/www/html //拷貝到你的www目錄
cd /var/www/html
tar –xvzf jpgraph-1.17.tar.gz
rm –rf jpgraph-1.17.tar.gz
cd jpgraph-1.17
rm -rf README
rm -rf QPL.txt
2.安裝ADODB:
cp adodb460.tgz /var/www/html/
cd /var/www/html
tar -xvzf adodb460.tgz
rm –rf adodb460.tgz
3.安裝 BASE:
cp base-1.0.2.tar.gz /var/www/html/ //拷貝到你的www目錄
cd /var/www/html
tar –xvzf base-1.0.2.tar.gz
rm –rf base-1.0.2.tar.gz
mv base-1.0.2 base //目錄改個名字
cd /var/www/html/base/
cp base_conf.php.dist base_conf.php
4.啟動你的apache
登陸
http://localhost/base/
第一次進入時需要輸入一些相關參數,如mysql的一些連接參數,要輸入剛剛建立的snort,密碼snort
還可以選擇預言,最后修改數據庫接口,成功.
建議現將/var/www/html/base改成可寫,因為稍后base要把你輸入的一些信息寫入base_conf.php
查看的時候,需要現運行snort把數據寫入mysql:
snort -c /etc/snort/snort.conf -g snort
然后在看base就可以看到我那個畫面了,應該會有數據了.
have fun...
 javascript:window.open(this.src);" style="CURSOR: pointer" onload="return imgzoom(this,550)"> screen.width-300)this.width = (screen.width-300)}" border="0" /> |
17:42 | 評論 (0)
延伸閱讀
文章來源于領測軟件測試網 http://www.kjueaiud.com/
