Fedora8：Snort+Apache+Php+Mysql+Acid+Webmin(安装学习笔记)

[align=left]一、运行环境

1.平台：

Fedora 8 (IP Address: 192.168.221.133)

2.所需软件：

报警+数据库：
snort-2.8.3.2tar.gz [/align][align=left]snortrules-snapshot-2.6.tar.gz[/align][align=left]mysql-5.0.77-linux-i686-icc-glibc23.tar.gz
create_mysql(script)

客户端显示：
apache_2.2.11.tar.gz
mod_ssl-2.8.16-1.3.29.tar.gz
php-5.2.0.tar.gz
acid-0.9.6b23.tar.gz
adodb507.tgz
jpgraph-2.3.4tar.gz

辅助管理工具：
webmin-1.220-1.noarch.rpm
Net_SSLeay.pm-1.30.tar.gz
snort-1.0.wbm(snort's webmin plugin)

3.软件下载地址

snort-2.8.3.2tar.gz(http://www.snort.org)
snortrules-snapshot-2.6.tar.gz(http://www.snort.org)
mysql-5.0.77-linux-i686-icc-glibc23.tar.gz (http://www.mysql.com)
create_mysql script (http://cvs.sourceforge.net/viewcvs.py/snort/snort/contrib/)

apache2.2.11.tar.gz(http://www.apache.org)
php-5.2.0.tar.gz(http://www.php.net)
acid-0.9.6b23.tar.gz(http://acidlab.sourceforge.net)
adodb507.tgz(http://adodb.sourceforge.net/)
jpgraph-2.3.4tar.gz(http://www.aditus.nu/jpgraph/index.php)

webmin-1.220-1.noarch.rpm(http://www.webmin.com/)
Net_SSLeay.pm-1.30.tar.gz(http://symlabs.com/Net_SSLeay/)
snort-1.0.wbm (http://www.snort.org/dl/contrib/front_ends/webmin_plugin/) [/align][align=left]二、安装

1.准备

ssh root登录Fedora8，将上述所需文件拷贝至/home/wd/snort相关

2.安装mysql [/align][align=left]
# groupadd mysql[/align][align=left]# useradd -g mysql -d /usr/local/mysql/data -M mysql[/align][align=left]# tar -zxvf mysql-5.0.27.tar.gz[/align][align=left]# cd mysql-5.0.27[/align][align=left]./configure --prefix=/usr/local/mysql \ 指定安装目录 [/align][align=left]> --sysconfdir=/etc \ 配置文件的路径[/align][align=left]> --localstatedir=/usr/local/mysql/data \ 数据库存放的路径[/align][align=left]> --enable-assembler \ 使用一些字符函数的汇编版本[/align][align=left]> --with-mysqld-ldflags=-all-static \ 以纯静态方式编译服务端[/align][align=left]> --with-charset=gb2312 \ 添加gb2312字符支持[/align][align=left]> --with-extra-charsets=all 添加所有字符支持
# cd /usr/local/mysql
# chown -R root .
# chown -R mysql data
# chgrp -R mysql .
# scripts/mysql_install_db --user=mysql
# /usr/local/mysql/support-files/mysql.server start

3.创建snort数据库

# /usr/local/mysql/bin/mysql
mysql>;
mysql>;set password for 'root'@'localhost'=password('123456');
mysql>;create database snort;

# /usr/local/mysql/bin/mysql -u root -p
mysql>;connect snort;
mysql>;source /usr/local/snort/schemas/create_mysql; //指定create_mysql脚本的路径
mysql>;grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort;
mysql>;grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort@localhost;
mysql>;connect mysql;
mysql>;set password for 'snort'@'localhost'=password('123456');
mysql>;set password for 'snort'@'%'=password('123456');
mysql>;flush privileges;
（别忘了以逗号结束）[/align][align=left]mysql>; show tables; 将会有这些： [/align][align=left]+------------------+ [/align][align=left]| Tables_in_snort | [/align][align=left]+------------------+ [/align][align=left]| data [/align][align=left]| detail [/align][align=left]| encoding [/align][align=left]| event [/align][align=left]| flags [/align][align=left]| icmphdr [/align][align=left]| iphdr [/align][align=left]| opt [/align][align=left]| protocols [/align][align=left]| reference [/align][align=left]| reference_system [/align][align=left]| schema [/align][align=left]| sensor [/align][align=left]| services [/align][align=left]| sig_class [/align][align=left]| sig_reference [/align][align=left]| signature [/align][align=left]| tcphdr [/align][align=left]| udphdr [/align][align=left]+------------------+ [/align][align=left]19 rows in set (0.00 sec) [/align][align=left]mysql>;exit

4.安装并启动snort

# cd/home/wd/snort相关
# tar -vxzf snort-2.8.3.2 tar.gz
# mv snort-2.8.3.2 /usr/local/snort
# cd /usr/local/snort
# ./configure --with-mysql=/usr/local/mysql
# make
# make install

# mkdir /var/snort
# mkdir /var/log/snort (存放snort日志)
# mkdir /etc/snort(存放rules)

# cd /home/wd/snort相关
# tar -vxzf snortrules-pr-2.6.tar.gz
# mv rules /etc/snort
# mv doc /etc/snort

修改/etc/snort/rules/snort.conf:
(1)将var RULE_PATH ../rules一行注释掉
(2)增加output database: log, mysql, user=snort password=123456 dbname=snort host=localhost
(3)修改include部分
include $RULE_PATH/bad-traffic.rules ->; include bad-traffic.rules
(and so on...)

启动snort(example):
# snort -d -D -c /etc/snort/rules/snort.conf
补充：在安装snort的时候，会出现libpcap/libpcre header not found的问题下载libpcap，libpcre，libnet安装，如果出现其他的问题根据提示，google，baidu一般都可以找到。
5.安装apache

# cd /home/wd/snort/相关[/align][align=left]#tar -zvxf httpd-2.2.11.tar.gz[/align][align=left]#cd httpd-2.2.11[/align][align=left]#./configure --prefix=/usr/local/apache --enable-so[/align][align=left]#make[/align][align=left]#make install [/align][align=left]安装完之后可以用命令/usr/local/apache/bin/apachectl start 启动一下apache[/align][align=left]在网页地址栏输入127.0.0.1如果安装成功可以看到It works字样。

6.安装PHP

# cd /home/wd/snort相关
# tar -vxzf php-5.2.tar.gz
# cd php-5.2.0
# ./configure \
--prefix=/usr/local/php \
--with-mysql=/usr/local/mysql \
--with-apxs=/usr/local/apache/bin/apxs \
--with-gd
--with-zlib
--enable-sockets
# make
# make install [/align][align=left]#cp ./php.ini-dist /usr/local/php5/etc/php.ini[/align][align=left]我在安装php时出现cannot restorte segment prot...after reloc :Permission denied[/align][align=left]goole后，修改了/etc/sysconfig文件和/etc/sysconfig[/align][align=left]并用chcon -t texrel_shlib_t 上面没有权限的文件.so 把问题解决了。[/align][align=left]7.安装acid+adodb+jpgraph [/align][align=left]# 把acid-0.9.6b23.tar.gz、adodb507.tgz、jpgraph-2.3.4tar.gz放到网页根目录，我这里是默认的。 [/align][align=left]# cp a*.* /usr/local/apache/htdocs [/align][align=left]# cp jpgraph-1.11.tar.gz /usr/local/apache/htdocs [/align][align=left]# tar zxvf adodb330.tgz [/align][align=left]# tar zxvf jpgraph-1.11.tar.gz [/align][align=left]# mv jpgraph-1.11 jpgraph [/align][align=left]# tar zxvf acid-0.9.6b23.tar.gz [/align][align=left]# cd acid [/align][align=left]# vi acid_conf.php [/align][align=left]# 把“$DBlib_path = "";” 改成“$DBlib_path = "/usr/local/apache/htdocs/adodb"” [/align][align=left]# $alert_dbname = "snort_log"; //改成snort [/align][align=left] $alert_host = "localhost"; [/align][align=left] $alert_port = ""; [/align][align=left] $alert_user = "root"; [/align][align=left] $alert_password = "123456"; //改成你的数据库密码 [/align][align=left] /* Archive DB connection parameters */ [/align][align=left] $archive_dbname = "snort_archive"; //改成snort [/align][align=left] $archive_host = "localhost"; [/align][align=left] $archive_port = ""; [/align][align=left] $archive_user = "root"; [/align][align=left] $archive_password = "123456";” //改成你的数据库密码 [/align][align=left]# 把“$ChartLib_path = "";” 改成“$ChartLib_path = "/usr/local/apache/htdocs/jpgraph/src";” [/align][align=left]# 修改完毕后，保存退出。 [/align][align=left]写一个snort规则 [/align][align=left]# cd /usr/local/ [/align][align=left]# vi snort.sh [/align][align=left]#!/bin/sh [/align][align=left]snort -d -h 192.168.0.0/24 -l /var/log/snort -c /etc/snort/snort.conf -i eth0 -A full [/align][align=left]# 保存退出。 [/align][align=left]# chmod 755 snort.sh [/align][align=left]启动服务 [/align][align=left] # /usr/local/mysql/support-files/mysql.server start [/align][align=left]# cd /usr/local/mysql/ [/align][align=left]# vi mysql_start.sh （编写启动脚本）[/align][align=left]#!/bin/sh [/align][align=left]/usr/local/mysql/bin/mysqld_safe --user=mysql & [/align][align=left]# 保存退出。 [/align][align=left]# chmod 755 mysql_start.sh [/align][align=left]# cp mysql_start.sh /usr/sbin/ [/align][align=left]# ./mysql_start.sh （启动mysql）[/align][align=left]# /usr/local/snort/bin/snort start(启动snort)[/align][align=left] [/align][align=left]
8.修改selinux配置及apache配置

# vi /etc/selinux/config

SELINUX=disabled
(否则会导致libphp4.so segment fault)

注：不要忘记配置firewall允许https.

9.配置自启动并重启计算机

# vi /etc/rc.d/rc.local

#start mysqld
/usr/local/mysql/support-files/mysql.server start
#start httpd
/usr/local/apache/bin/apachectl startssl
#start snort
/usr/local/bin/snort -d -D -c /etc/snort/rules/snort.conf

# reboot

10.测试连接acid和初始化

https://127.0.0.1/acid
Click "Setup page" to "Create ACID AG" [/align][align=left]有时由于操作系统的版本的不同软件安装的默认路径不同，会产生文件不存在或是权限不够的问题，找到文件修改文件位置，改变文件位置，不能的话就创建链接，我安装时出现这些问题就是goole，然后用这些方法解决的。

到现在为止,Snort+mysql+Apachephp+ACID已经可以正常工作了。

11.辅助管理工具(图形界面管理snort):

(1) 安装Net_SSL(Redhat9 is broken)

# cd /home
# tar -vxzf Net_SSLeay.pm-1.21.tar.gz
# cd Net_SSLeay.pm-1.21
# ./Makefile.PL
# make install

(2)安装webmin

# cd /home
# rpm -ivh webmin-1.30.noarch.rpm

(3)测试连接，并安装snort module
https://127.0.0.1:10000,使用root+密码登录
Webmin Configuration ->; SSL Encryption ->; 生成新的SSL key
Webmin Configuration ->; Webmin Modules ->; 安装snort-1.0.wbm
Servers ->; Snort IDS Admin ->; 进行配置：
Full path to snort executable ->;
/usr/local/snort/bin/snort -d -D -c /etc/snort/rules/snort.conf

Full path to snort configuration file ->;
/etc/snort/rules/snort.conf

Full path to snort rule files directory ->;
/etc/snort/rules

Full path to snort PID file ->;
/var/run/snort_eth0.pid

(4)save之后就可以打开snort的配置界面。

12.限定apache只允许https连接

修改/usr/local/apache/conf/httpd.conf如下

<IfDefine SSL>;
#Listen 80
Listen 443
</IfDefine>;

13.给Apache加简单的访问控制

(1)创建一个授权用户并设置密码
# /usr/local/apache/bin/htpasswd -c /usr/local/apache/conf/auth.users linghood
New password: ******
Re-type new password: ******
Adding password for user linghood

(2)修改/usr/local/apache/conf/httpd.conf文件如下

<Directory />;
# Options FollowSymLinks
# AllowOverride None
AuthType Basic
AuthName "IDS"
AuthUserFile /usr/local/apache/conf/auth.users
Require valid-user
</Directory>;

<Directory "/var/www/html">;
# Options Indexes FollowSymLinks MultiViews
# AllowOverride None
# Order allow,deny
# Allow from all
AuthType Basic
AuthName "IDS"
AuthUserFile /usr/local/apache/conf/auth.users
Require valid-user
</Directory>;
两天总算没有浪费，查了很多资料，软件总算安上了，环境可以用了，虽然还有很多地方不够完善。[/align]