电脑技术学习

Linux 9系统下构建小型入侵检测系统

dn001

  一、系统平台

  Redhat9.0发行版, 安装gcc 及相关库文件,建议不要安装Apache,PHP,MySQL,我们将用源码编译安装。基于安全方面的考虑,可以设置一下iptables只允许SSH和WWW访问。

  二、软件

  MySQL4.0.12 http://mysql.secsup.org

  Snort2.0.0 http://www.snort.org

  Apache2.0.45 http://www.apache.org

  PHP4.3.1 http://www.php.net

  ADODBv3.30 http://phplens.com

  Acid0.9.6b23 http://acidlab.sourceforge.net

  Zlib1.1.4 http://flow.dl.sourceforge.net

  JPGraph1.11 http://jpgraph.techuk.com

  LibPcap0.7.2 http://www.tcpdump.org

  建议到这个站点下载http://ftp.cdut.edu.cn/pub/linux/NEW/

  也可以到http://www.rpmfind.com下载相关的xx.src.rpm编译安装。如若安装了rpm包,可以强行将其反安装rpm -e -nodeps xx.xx

  三、安装(建议将所有的包文件考到同一目录)

  1.安装zlib1.1.4

  tar -xzvf zlib-xx.tar.gz

  cd zlib-xx

  /configure;make test

  make install

  cd ..

  2.安装LibPcap0.7.2

  tar -xzvf libpcap.tar.gz

  cd libpcap-xx

  /configure

  make

  make install

  cd ..

  3.安装MySQL4.0.12

  3.1创建mysql组和mysql用户

  groupadd mysql

  useradd -g mysql mysql

  修改/root下的.bash_profile的这一行:

  PATH=?$PATH:?$HOME/bin 为

  PATH=?$PATH:?$HOME/bin:/usr/local/mysql/bin

  3.2安装mysql

  tar -xzvf mysql-xx.tar.gz

  cd mysql-xx

  /configure --prefix=/usr/local/mysql

  make

  make install

  cd scripts

  /mysql_install_db

  chown -R root /usr/local/mysql

  chown -R mysql /usr/local/mysql/var

  chgrp -R mysql /usr/local/mysql

  cd ./support-files/my-medium.cnf /etc/my.cnf

  向/etc/ld.so.conf中加入两行:/usr/local/mysql/lib/mysql

  /usr/local/lib

  载入库,执行

  ldconfig -v

  3.3测试mysql是否工作:

  cd /usr/local/mysql/bin/

  /mysqld_safe --user=mysql&

  #ps -ef |grep mysql

  看mysql_safe是否工作

  3.4设置mysql为自启动:

  将mysql安装目录下的support-files目录中的

  mysql.server文件拷到/etc/init.d目录

  cp mysql.server /etc/init.d/mysql

  chmod 755 /etc/init.d/mysql

  创建硬链接:

  cd /etc/rc3.d(文本方式启动)

  ln -s /etc/init.d/mysql S85mysql

  ln -s /etc/init.d/mysql K85mysql

  cd /etc/rc5.d (图形方式启动)

  ln -s /etc/init.d/mysql S85mysql

  ln -s /etc/init.d/mysql K85mysql

  4.安装Apache2.0.45和PHP4.3.1

  tar -zxvf httpd-2.0.xx.tar.gz

  cd httpd_2.xx.xx

  /configure --prefix=/www --enable-so

  注:apache根目录为 /www

  make

  make install

  cd ..

  tar -zxvf php-4.3.x.tar.gz

  cd php-4.3.x

  /configure --prefix=/www/php --with-apxs2=/www/bin/apxs --with-config- filepath=/www/php --enable-sockets --with-mysql=/usr/local/mysql --with-zlibdir=/

  usr/local --with- gd

  注意:这些为一行,中间不要有回车。

  cp php.ini-dist /www/php/php.ini

  编辑httpd.conf(/www/conf):

  加入两行

  LoadModule php4_module modules/libphp4.so

  AddType application/x-httpd-php .php

  httpd.conf中相关内容如下:

  #

  # LoadModule foo_module modules/mod_foo.so

  LoadModule php4_module modules/libphp4.so

  # AddType allows you to tweak mime.types without actually editing it, or ?$

  # make certain files to be certain types.

  #

  AddType application/x-tar .tgz

  AddType image/x- icon .ico

  AddType application/x-httpd-php .php

  设置Apache为自启动:

  cp /www/bin/apachectl /etc/init.d/httpd

  cd /etc/rc3.d

  ln -s /etc/init.d/httpd S85httpd

  ln -s /etc/init.d/httpd K85httpd

  cd /etc/rc5.d

  ln -s /etc/init.d/httpd S85httpd

  ln -s /etc/init.d/httpd K85httpd

  测试一下 PHP:

  cd /etc/init.d

  /httpd start

  在/www/htdocs下建立文件 test.php

  cd /www/htdocs

  vi test.php

  加入

  lt;?php

  hpinfo();

  ?>

  用浏览器访问http://IP_address/test.php,成功的话,出现一些

  系统,apache,php信息

  5.安装 Snort2.0

  5.1建立snort配置文件和日志目录

  mkdir /etc/snort

  mkdir /var/log/snort

  tar -zxvf snort-2.x.x.tar.gz

  cd snort-2.x.x

  /configure --with-mysql=/usr/local/mysql

  make

  make install

  5.2安装规则和配置文件

  cd rules (在snort安装目录下)

  cp * /etc/snort

  cd ./etc

  cp snort.conf /etc/snort

  cp *.config /etc/snort

  5.3修改snort.conf(/etc/snort/snort.conf)

  var HOME_NET 10.2.2.0/24 (修改为你的内部网网络地址,我的是

  192.168.0.0/24)

  var RULE_PATH ./rules 修改为 var RULE_PATH /etc/snort/

  改变记录日志数据库:

  output database: log, mysql, user=root password=your_password

  dbname=snort host=localhost

  5.4设置snort为自启动:

  在snort安装目录下

  cd /contrib

  cp S99snort /etc/init.d/snort

  vi /etc/init.d/snort

  修改snort如下:

  CONFIG=/etc/snort/snort.conf

  #SNORT_GID=nogroup (注释掉)

  #8194;$SNORT_PATH/snort -c ?$CONFIG -i ?$IFACE ?$OPTIONS

  (去掉原文件中的 -g ?$SNORT_GID )

  chmod 755 /etc/init.d/snort

  cd /etc/rc3.d

  ln -s /etc/init.d/snort S99snort

  ln -s /etc/init.d/snort K99snort

  cd /etc/rc5.d

  ln -s /etc/init.d/snort S99snort

  ln -s /etc/init.d/snort K99snort

  四.在mysql中建立数据库

  /usr/local/mysql/bin/mysql

  mysql>SET PASSWORD FOR root@localhost=PASSWORD('your_password');

  mysql>create database snort;

  mysql>grant INSERT,SELECT on root.* to snort@localhost

  mysql>quit;

  进入snort安装目录:/usr/local/mysql/bin/mysql -p

  gt;Enter password:

  安装DB表:(在contrib目录)

  zcat snortdb-extra.gz | /usr/local/mysql/bin/mysql -p snort

  进入mysql数据库,看看snort数据库中的表:

  /usr/local/mysql/bin/mysql -p

  gt;Enter password:

  mysql>show databases;

  +------------+

  | Database

  +------------+

  | mysql

  | snort

  | test

  +------------+

  3 rows in set (0.00 sec)

  mysql>use snort;

  mysql>show tables; 将会有这些:

  +------------------+

  | Tables_in_snort |

  +------------------+

  | data

  | detail

  | encoding

  | event

  | flags

  | icmphdr

  | iphdr

  | opt

  | protocols

  | reference

  | reference_system

  | schema

  | sensor

  | services

  | sig_class

  | sig_reference

  | signature

  | tcphdr

  | udphdr

  +------------------+

  19 rows in set (0.00 sec)

  mysql>exit

  五.安装配置Web接口

  安装JPGraph1.11

  cp jpgraph-1.11.tar.gz /www/htdocs

  cd /www/htdocs

  tar -xzvf jpgraph-1.xx.tar.gz

  rm -rf jpgrap-1.xx.tar.gz

  cd jpgraph-1.11

  rm -rf README

  rm -rf QPL.txt

  安装ADODB:

  cp adodb330.tgz /www/htdocs/

  cd /www/htdocs

  tar -xzvf adodb330.tgz

  rm -rf adodb330.tgz

  安装配置Acid:

  cp acid-0.0.6b23.tar.gz /www/htdocs

  cd /www/htdocs

  tar -xvzf acid-0.9.6b23.tar.gz

  rm -rf acid-0.9.6b23.tar.gz

  cd /www/htodcs/acid/

  编辑acid_conf.php,修改相关配置如下:

  #8194;$DBlib_path = "/www/htdocs/adodb";

  /* The type of underlying alert database

  *

  * MySQL : "mysql"

  * PostgresSQL : "postgres"

  * MS SQL Server : "mssql"

  */

  #8194;$DBtype = "mysql";

  /* Alert DB connection parameters

  * - ?$alert_dbname : MySQL database name of Snort alert DB

  * - ?$alert_host : host on which the DB is stored

  * - ?$alert_port : port on which to access the DB

  * - ?$alert_user : login to the database with this user

  * - ?$alert_password : password of the DB user

  *

  * This information can be gleaned from the Snort database

  * output plugin configuration.

  */

  #8194;$alert_dbname = "snort";

  #8194;$alert_host = "localhost";

  #8194;$alert_port = "";

  #8194;$alert_user = "root";

  #8194;$alert_password = "Your_Password";

  /* Archive DB connection parameters */

  #8194;$archive_dbname = "snort";

  #8194;$archive_host = "localhost";

  #8194;$archive_port = "";

  #8194;$archive_user = "root";

  #8194;$archive_password = "Your_Password ";

  And a little further down

  #8194;$ChartLib_path = "/www/htdocs/jpgraph-1.11/src";

  /* File format of charts ('png', 'jpeg', 'gif') */

  #8194;$chart_file_format = "png";

  进入web界面:

  http://yourhost/acid/acid_main.php

  点"Setup Page"链接 ->Create Acid AG

  访问http://yourhost/acid将会看到ACID界面。

  六.测试系统

  重启系统或者直接启动相关后台程序:

  /etc/init.d/mysql restart

  /etc/init.d/snort start

  /etc/init.d/httpd start

  利用nmap,nessus,CIS或者X-scan对系统进行扫描,产生告警纪录。

  http://yourhost/acid 察看纪录。

  至此,一个功能强大的IDS配置完毕。各位可以利用web界面远程登陆,监控主机所处局域网,同时安装phpMyAdmin对mysql数据库进行操控。

标签: linux