snort安装过程中遇到的问题及解决方案

本文详细介绍Snort入侵检测系统的安装与配置流程,包括解决编译错误、配置数据库及Web界面等关键步骤。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

While installing snort 2.9.* is possible you will receive an error in the compiling of daq 0.6, that says it cannot find a specific version of libpcap library. The error looks like this:

--------------------------------

checking for libpcap version >= "1.0.0"… no ERROR! Libpcap library version >= 1.0.0 not found. Get it from http://www.tcpdump.org 
-----------------------------
  
In this case you need to install libpcap-1.0.0 or later:
 
------------------------
wget http://www.tcpdump.org/release/libpcap-1.0.0.tar.gz tar xvfz libpcap-1.0.0.tar.gz cd libpcap-1.0.0/ ./configure make make install
------------------------
  

If you still have problems, try to check this link: libpcap not found <----------->I copied the new one over the old one and daq compiled and installed without issue:root@xxxx:# cp /usr/local/lib/libpcap.a /usr/lib/

 

10.1建立snort配置文件和日志目录

 

  #mkdir /etc/snort

  #mkdir /var/log/snort

  #tar -zxvf snort-2.4.4.tar.gz

  #cd snort-2.4.4

  #./configure --with-mysql=/usr/local/mysql

  #make

#make install

注意,我在编译snort时出现“ERROR!  Libpcre header not found, go get it from”的错误。这是因为少安装了一个lib的库,如果谁出现了这样的问题,就到ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/ 下载最新的pcre库进行安装。

方法: #tar -zxvf pcre-6.7.tar.gz

       #./configure

       #make

       #make check

       #make install

  10.2安装规则和配置文件

#cd /etc/snort/

    #tar ?zxvf /ruanjian/snortrules-snapshot-2.4.tar.gz

  #cd /etc/snort/rules (在snort安装目录下)

  #cp *.conf /etc/snort/.          

  #cp *.config /etc/snort/.                

#cp *.map /etc/snort/.            

10.3修改snort.conf   (/etc/snort/snort.conf)

  var HOME_NET 172.17.4.0/24 (修改为你的内部网网络地址)

    var RULE_PATH ./rules 修改为 var RULE_PATH /etc/snort/

 

  改变记录日志数据库:

log与alert数据库要分别建,否则snort启动当有事件发生时候要出错

  output database: log, mysql, user=root password=your_password dbname=snort host=localhost

    output database: alert, mysql, user=root password=your_password dbname=snort host=localhost

 


 

安装DB表:(在schemas 目录)

/usr/local/mysql/bin/mysql -u root -p <create_mysql snort //为snort建立数据表

11.安装配置Web接口

 

  安装JPGraph2.1.1

  #cp jpgraph-2.1.1.tar.gz /home

    #cd /home

  #tar -xzvf jpgraph-2.1.1.tar.gz

    #mv jpgraph-2.1.1 jpgraph

  

  安装ADODB:

  #cp adodb480.gz /home

    #cd /home

    #tar -xzvf adodb480.gz

 

  安装配置Acid:

  #cp acid-0.9.6b23.tar.gz /home

    #cd /home

    #tar -xvzf acid-0.9.6b23.tar.gz

    #cd /home/acid/

 

  编辑acid_conf.php,修改相关配置如下:

$DBlib_path = "/home/adodb";

$DBtype = "mysql";

$alert_dbname = "snort";

$alert_host = "localhost";

$alert_port = "";

$alert_user = "root";

$alert_password = "xiangqian";

$archive_dbname = "snort";

$archive_host = "localhost";

$archive_port = "";

$archive_user = "root";

$archive_password = "xiangqian";

$ChartLib_path = "/home/jpgraph/src";

 

运行snort把数据写入mysql

# snort -c /etc/snort/snort.conf

 

进入web界面:

http://yourhost/acid/acid_main.php

  点"Setup Page"链接 ->Create Acid AG

  访问http://yourhost/acid将会看到ACID界面。

 

 

 

 

 

 

 

 


 

http://www.snort.org
http://www.snort.org/docs
http://www.snort.org/snort-downloads/rhel5(download  Libpcap snort)
centos5.5安装
安装时将apache 和mysql服务安装上
yum -y install mysql-bench mysql-devel php-mysql gcc pcre-devel php-gd gd glib2-devel gcc-c++ libpcap-devel
cd /root
mkdir  snort
cd snort
wget http://www.snort.org/downloads/867(snort-2.9.0.5.tar.gz)
wget http://www.snort.org/downloads/860(daq-0.5.tar.gz)
tar -xzvf snort-2.9.0.5.tar.gz
cd snort-2.9.0.5
./configure --with-mysql --enable-dynamicplugin
(if buliding for CentOs64 bit use the following instead ->./configure --with-mysql-libraries=/usr/lib64/mysql/ --enable-dynamicplugin)
###########################################################################################################################
ERROR!  dnet header not found, go get it from http://code.google.com/p/libdnet/ or use the --with-dnet-* options, if you have it installed in an unusual place
wget http://libdnet.googlecode.com/files/libdnet-1.12.tgz 
tar -xzvf libdnet-1.12.tgz 
cd libdnet-1.12.tgz 
./configure
make
make install
ERROR!  daq_static library not found, go get it from  http://www.snort.org/.
cd /root/snort/ 
tar -xzvf daq-0.5.tar.gz 
cd daq-0.5.tar  ./configure 
make 
make install
如果出现报错ERROR! Libpcap library version >= 1.0.0 not found. Get it from http://www.tcpdump.org
yum erase  libpcap-old
###################################################################################################################################
make
make install
groupadd snort
useradd -g snort snort -s /sbin/nologin
mkdir /etc/snort
mkdir /etc/snort/rules
mkdir /etc/snort/so_rules
mkdir /var/log/snort
chown snort:snort /var/log/snort
cd etc(make sure you do not cd to /etc)
cp * /etc/snort
tar -xzvf snortrules-snapshot-2902.tar.gz
cd ./rules
cp *  /etc/snort/rules
cp  ../so_rules/precompiled/Centos-5-4/i386/2.9.0.2/*  /etc/snort/so_rules
wget https://www.snort.org/downloads/893
vi /etc/snort/snort.conf
修改如下
RULE_PATH ../rules     /etc/snort/rules
SO_RULE_PATH ../so_rules        /etc/snort/so_rules
在output部分添加如下
output unified2:filename snort.log,limit 128

配置数据库
echo "set password for root@localhost=password('123456');"|mysql -uroot -p
echo "create database snort;"|mysql -u root -p
mysql -u root -p -D snort <./schemas/create_mysql
echo "grant create,insert on root.* to snort@localhost;"|mysql -uroot -p
echo "set password for snort@localhost=password('123456');"| mysql -uroot -p
echo "grant create,insert,select,delete,update on snort.* to snort@localhost"|mysql -uroot -p

install and configure base(basic analysis and security engine and adodb)
use the following commmand to install php_pear and some additional supporting files to allow for
graphing within base to function properly:
#yum -y install php-pear_number_roman php-pear_numbers_words php-pear_image_color php-pear_canvas
php-pear_image_graph
wget http://pear.php.net/go-pear.phar
php go-pear.phar
http://pear.php.net/manual/en/installation.php
pear install Numbers_Roman
pear install Numbers_Words
pear install Image_Color
pear install Image_Canvas
pear install Image_Canvas
pear install Image_Graph
wget http://sourceforge.net/projects/adodb/files/adodb-php5-only/adodb-511-for-php5/adodb511.zip/download
wget http://sourceforge.net/projects/secureideas/files/BASE/base-1.4.5/base-1.4.5.tar.gz/download
install adodb
cd /var/www
tar -xzvf  adodb511.tgz
mv   adodb5 adodb
install   and config base
cd /var/www/html/
tar -xzvf base-1.4.5.tar.gz
cd base-1.4.5
cp base_conf.php.dist  base_conf.ph
chown pigg.games base_conf.php
edit "base_config.php" and insert the following parameters
$BASE_urlpath='/base';
$DBlib_path='/var/www/adodb';
$DBtype='mysql';
$alert_dbname='snort';
$alert_host='localhost';
$alert_port='';
$alert_user='snort';
$alert_password='password created in mysql section above for snort user';
/*archive db connnection parameters */
$archive_exists=0;#set this to 1 if you have an archive db
/* access your sensor at the following address: */
https://<ip address of sensor>/base
click on "setup page" then click on "create base ag".
securing the base directory:
mkdir /var/www/passwords
htpasswd -c /var/www/passwords/passwords base
password:123456
edit the httpd.conf
<Directory "/var/www/html/base">
            AuthType Basic
            AuthName "SnortIDS"
            AuthUserFile /var/www/passwords/passwords
            Require user  base
</Directory>

Installing  Barnyard2
barnyard2 improves the efficicency of snort by reducing the load on the main detection engine by allowing
barnyard2 to handle the inserting of events into the mysql database.
wget https://download.github.com/firnsy-barnyard2-v2-1.9-12-g01f5581.tar.gz
tar -xzvf firnsy-barnyard2-v2-1.9-12-g01f5581.tar.gz
cd firnsy-barnyard2-01f5581
./configure --with-mysql
(if building for centos 64 bit use the following instead -> ./configure --with-mysql-libraries=/usr/lib64/mysql/)
make
make install
cp etc/barnyard2.conf /etc/snort/      
mkdir /var/log/barnyard2
chmod 666  /var/log/barnyard2
touch  /var/log/snort/barnyard2.waldo
chown snort:snort /var/log/snort/barnyard2.waldo
Edit /etc/snort/barnyard2.conf and modify the following lines.
#config hostname:thor
#config interface:eth0
#output database:log,mysql,user=root password=test dbname=db host=localhost
Remove the#sign from the lines above and change to the below:
config hostname:localhost
config interface:eth0(if using multiple interfaces this should be eth1)
output database:log,mysql,user=snort password='password created in mysql section above for snort user' dbname=snort host=localhost
testing snort:
you can lauch snort from the commmand line to make sure that it loads properly. Enter the following command:
/usr/local/bin/snort -u snort -g snort -c /etc/snort/snort.conf -i eth0
(如果出现报错:/usr/local/bin/snort: error while loading shared libraries: libdnet.1: cannot open shared object file: No such file or directory
ln -s   /usr/local/lib/libdnet.1  /usr/lib/libdnet.1)
/usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo -D
setting up snort $barnyard2 to start automatically:
edit /etc/rc.loacl
#ifconfig eth0 up
/usr/local/bin/snort -u snort -g snort -c /etc/snort/snort.conf -i eth0
/usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard2.waldo -D
/etc/rc.local start

 

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值