snort 集成式安裝

集成環境

Nginx0.8

PHP5.3

snort2.9

Mysql

ADODB

ACID

 

安裝前的準備

PHP，nginx或apache，phpmyadmin，mysql，ACID，ADODB，[Barnyard2]

libpcap，libnet，libdnet，daq，snort，[BASE]  ，

 {mcrypt  libmcrypt  libcrypt}phpmyadmin支持)

PHP 支持庫

[jpgraph] 、gd、freetype、zlib、libxml二、libpng

*libpcap包須要1.0以上版本

*如編譯安裝則libpcap、libnet、libdnet須安裝devel版

拷貝php配置文件

Php5.2

cp php.ini-dist /usr/local/lib/php.ini

php5.3

cp php.ini-production /usr/local/php/php.ini

 

安裝路線

Nginx-----PHP+支持庫-----Mysql------phpMyAdmin------snort+支持庫-----Adodb-----ACID----jpgrapg

 

 

1.nginx的修改

groupadd www

useradd   -g www www

 

---------------

user:www

group：www

 

server

     {

         listen          8090;

         server_name        phpMyAdmin.vspace.tk;

         root           /ext/web/phpMyAdmin;

         index           index.php;

 

 

         location ~ \.php$

         {

             fastcgi_pass       127.0.0.1:9000;

             fastcgi_index       index.php;

             fastcgi_param       SCRIPT_FILENAME /ext/web/phpMyAdmin$fastcgi_script_name;

             include          fastcgi_params;

         }

     }

 

   server

     {

         listen          9090;

         server_name        snort.vspace.tk;

         root           /ext/web/snort;

         index           index.php;

 

 

         location ~ \.php$

         {

             fastcgi_pass       127.0.0.1:9000;

             fastcgi_index       index.php;

             fastcgi_param       SCRIPT_FILENAME /ext/web/snort$fastcgi_script_name;

             include          fastcgi_params;

         }

 

     }

 

----------------

chown -R /ext/web

 

2.PHP configure

./configure --prefix=/usr/local/php 

 --with-gb 

--with-jpeg

--with-zlib 

--with-png 

--with-freetype  

--with-mysql=/usr/local/mysql 

--enbale-fpm 

--with-mcrypt

 

*PHP5.3.3之後原生支持fpm，不須要另外打補丁包

 

3. php.ini安全性修改

cp php.ini-disk /usr/local/lib/php.ini

 

open_basedir=/ext/web  #

magic_quotes_goc = Off

file_upload = Off

 

4.關閉Selinux

vim /etc/selinux/config

SELINUX = disableed

 

5.PHP test

<?php

phpinfo()

?>

 

6.mysql

groupadd mysql

useradd -g mysql mysql

chown -R mysql /usr/local/mysql/var

chgrp -R mysql /usr/local/mysql

 

mysql -u root

mysql>delete from mysql.user where User = '';

mysql>flush Privileges;

 

mysqladmin -u root -p password [新密碼]

或

mysql -u root

mysql>set password foe 'root'@'localhost' =password('新密碼')；

7.mysql配置

mysql>create database snortdb;

mysql>create database snort_archivedb;

mysql>set password for 'snort'@'localhost'=password('');

mysql>grant create,insert,select,delete,update on snortdb. * to snort@localhost;

mysql>grant create,inset,select,delete,update on snort_archivedb. * to snort@localhost;

 

*也可使用phpmyadmin來進行以上操做

 

8.修改snort.conf

最後添加

output database:log,mysql,user=root password = 1111 dbname=snort host=localhost

 

9.adodb和ACID配置

cp adodb ACID /ext/web/snort

 

adodb.inc.php

$ADODB_DIR = dirname('/ext/web/snort/adodb5');

 

acid

chmod 755 /ext/web/snort/acid

chmod 644 /ext/web/snort/acid/*

 

acid_conf.php

$alert_dbname   = "snortdb";

$alert_host    = "localhost";

$alert_port    = "";

$alert_user    = "snort";

$alert_password = "snort";

 

/* Archive DB connection parameters */

$archive_dbname   = "snort_archivedb";

$archive_host    = "localhost";

$archive_port    = "";

$archive_user    = "snort";

$archive_password = "snort";

 

?  mysql>set password for "acid"@"localhost"=OLD_PASSWORD("111111");

 

測試：http://localhost:9090/acid/acid_db_setup.php