snort base daq ids

約定:未提示下載地址的 均能在sourceforge下載到

 1、配置lamp環境

yum install pcre pcre-devel php php-common php-gd php-cli php-mysql mysql mysql-devel mysql-bench mysql-server  kernel-devel libxml2-devel vim-enhanced
service httpd start
service mysqld start
chkconfig --add httpd
chkconfig --add mysqld
chkconfig httpd on
chkconfig mysqld on

2、配置libpcap

 

[root@onlinepay src]# tar -xf ~/libpcap-1.0.0.tar.gz
[root@onlinepay src]# ls
libpcap-1.0.0  snort-2.9.4
[root@onlinepay src]# cd libpcap-1.0.0/
[root@onlinepay libpcap-1.0.0]# ./configure --prefix=/usr/local/libpcap
[root@onlinepay libpcap-1.0.0]#mkdir -p /usr/local/libpcap/bin/
[root@onlinepay libpcap-1.0.0]#make && make test && make install

3、配置libdnet

 

[root@onlinepay src]# tar -xf ~/libdnet-1.12.tgz
[root@onlinepay src]# cd libdnet-1.12/
[root@onlinepay libdnet-1.12]# ./configure --prefix=/usr/local/libdnet
[root@onlinepay libdnet-1.12]# make && make install

4、配置daq

daq下載地址 http://www.snort.org/downloads/2103

[root@onlinepay daq-2.0.0]# ./configure  --prefix=/usr/local/daq \
--with-libpcap-libraries=/usr/local/libpcap/lib/ \
--with-libpcap-includes=/usr/local/libpcap/include
[root@onlinepay daq-2.0.0]# make && make install

5、編譯snort

 

[root@onlinepay snort-2.9.4]# ls
aclocal.m4    config.sub    COPYING  install-sh  Makefile.am    preproc_rules  snort.pc.in  verstuff.pl
ChangeLog     configure     depcomp  LICENSE     Makefile.in    RELEASE.NOTES  src          ylwrap
config.guess  configure.in  doc      ltmain.sh   missing        rpm            templates
config.h.in   contrib       etc      m4          mkinstalldirs  snort.8        tools
./configure --prefix=/usr/local/snort --with-mysql\
--with-libpcap-libraries=/usr/local/libpcap/lib\
--with-libpcap-includes=/usr/local/libpcap/include\
--with-dnet-libraries=/usr/local/libdnet/lib\
--with-dnet-includes=/usr/local/libdnet/include\
--with-daq-includes=/usr/local/daq/include\
--with-daq-libraries=/usr/local/daq/lib/daq --enable-zlib

 若是出現./configure: line 21270: daq-modules-config: command not found 請檢查是否將daq-modules-config加入path,以及是否有可執行權限.

 

configure: WARNING: unrecognized options: --with-mysql
[root@onlinepay snort-2.9.4]# make && make install

此處報錯 能夠忽略 

 

六.配置snort

 

[root@onlinepay snort-2.9.4]# mkdir /etc/snort
[root@onlinepay snort-2.9.4]# mkdir -p /var/log/snort
[root@onlinepay snort-2.9.4]# pwd
/usr/local/src/snort-2.9.4
[root@onlinepay snort-2.9.4]# cp etc/* /etc/snort/
[root@onlinepay snort-2.9.4]#

7、裝載規則文件

下載解壓規則文件snortrules-snapshot-2.8.tar.gz  http://vdisk.weibo.com/s/lB1gI

[root@onlinepay src]# tar -xvf ~/snortrules-snapshot-2.8.tar.gz
[root@onlinepay src]# cp -R so_rules/ /etc/snort/

8、測試snort 安裝

 

[root@onlinepay src]# /usr/local/snort/bin/snort -V

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.4 GRE (Build 40)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
           Copyright (C) 1998-2012 Sourcefire, Inc., et al.
           Using libpcap version 1.0.0
           Using PCRE version: 6.6 06-Feb-2006
           Using ZLIB version: 1.2.3

出現如上提示就說明能夠用了

9、數據庫設置

 未完待續