RedHat linux 9 系统下构建小型入侵检测系统

一、系统平台

    Redhat9.0发行版，安装gcc 及相关库文件，建议不要安装Apache,PHP,MySQL,我们将用源码编译安装。基于安全方面的考虑，可以设置一下iptables只允许SSH和WWW访问。

    二、软件

    MySQL4.0.12 http://mysql.secsup.org

    Snort2.0.0 http://www.snort.org

    Apache2.0.45 http://www.apache.org

    PHP4.3.1 http://www.php.net

    ADODBv3.30 http://phplens.com

    Acid0.9.6b23 http://acidlab.sourceforge.net

    Zlib1.1.4 http://flow.dl.sourceforge.net

    JPGraph1.11 http://jpgraph.techuk.com

    LibPcap0.7.2 http://www.tcpdump.org

    建议到这个站点下载http://ftp.cdut.edu.cn/pub/linux/NEW/

    也可以到http://www.rpmfind.com下载相关的xx.src.rpm编译安装。如若安装了rpm包，可以强行将其反安装

    rpm -e -nodeps xx.xx

    三、安装（建议将所有的包文件考到同一目录）

    1.安装zlib1.1.4

    tar -xzvf zlib-xx.tar.gz

    cd zlib-xx

    /configure;make test

    make install

    cd ..

    2.安装LibPcap0.7.2

    tar -xzvf libpcap.tar.gz

    cd libpcap-xx

    /configure

    make

    make install

    cd ..

    3.安装MySQL4.0.12

    3.1创建mysql组和mysql用户

    groupadd mysql

    useradd -g mysql mysql

    修改/root下的.bash_profile的这一行：

    PATH=?$PATH:?$HOME/bin 为

    PATH=?$PATH:?$HOME/bin:/usr/local/mysql/bin

    3.2安装mysql

    tar -xzvf mysql-xx.tar.gz

    cd mysql-xx

    /configure --prefix=/usr/local/mysql

    make

    make install

    cd scripts

    /mysql_install_db

    chown -R root /usr/local/mysql

    chown -R mysql /usr/local/mysql/var

    chgrp -R mysql /usr/local/mysql

    cd ./support-files/my-medium.cnf /etc/my.cnf

    向/etc/ld.so.conf中加入两行：/usr/local/mysql/lib/mysql

    /usr/local/lib

    载入库，执行

    ldconfig -v

    3.3测试mysql是否工作：

    cd /usr/local/mysql/bin/

    /mysqld_safe --user=mysql&

    #ps -ef |grep mysql

    看mysql_safe是否工作

    3.4设置mysql为自启动：

    将mysql安装目录下的support-files目录中的

    mysql.server文件拷到/etc/init.d目录

    cp mysql.server /etc/init.d/mysql

    chmod 755 /etc/init.d/mysql

    创建硬链接:

    cd /etc/rc3.d（文本方式启动)

    ln -s /etc/init.d/mysql S85mysql

    ln -s /etc/init.d/mysql K85mysql

    cd /etc/rc5.d (图形方式启动）

    ln -s /etc/init.d/mysql S85mysql

    ln -s /etc/init.d/mysql K85mysql

    4.安装Apache2.0.45和PHP4.3.1

    tar -zxvf httpd-2.0.xx.tar.gz

    cd httpd_2.xx.xx

    /configure --prefix=/www --enable-so

    注：apache根目录为 /www

    make

    make install

    cd ..

    tar -zxvf php-4.3.x.tar.gz

    cd php-4.3.x

    /configure --prefix=/www/php --with-apxs2=/www/bin/apxs --with-config- filepath=/www/php --enable-sockets --with-mysql=/usr/local/mysql --with-zlibdir=/

    usr/local --with- gd

    注意：这些为一行，中间不要有回车。

    cp php.ini-dist /www/php/php.ini

    编辑httpd.conf(/www/conf):

    加入两行

    LoadModule php4_module modules/libphp4.so

    AddType application/x-httpd-php .php

    httpd.conf中相关内容如下：

    #
    # LoadModule foo_module modules/mod_foo.so
    LoadModule php4_module modules/libphp4.so
    # AddType allows you to tweak mime.types without actually editing it, or ?$
    # make certain files to be certain types.
    #

    AddType application/x-tar .tgz

    AddType image/x- icon .ico

    AddType application/x-httpd-php .php

    设置Apache为自启动：

    cp /www/bin/apachectl /etc/init.d/httpd

    cd /etc/rc3.d

    ln -s /etc/init.d/httpd S85httpd

    ln -s /etc/init.d/httpd K85httpd

    cd /etc/rc5.d

    ln -s /etc/init.d/httpd S85httpd

    ln -s /etc/init.d/httpd K85httpd

    测试一下 PHP:

    cd /etc/init.d

    /httpd start

    在/www/htdocs下建立文件 test.php

    cd /www/htdocs

    vi test.php

    加入

    lt;?php

    hpinfo();

    ?〉

    用浏览器访问http://IP_address/test.php,成功的话，出现一些

    系统,apache,php信息

    5.安装 Snort2.0

    5.1建立snort配置文件和日志目录

    mkdir /etc/snort

    mkdir /var/log/snort

    tar -zxvf snort-2.x.x.tar.gz

    cd snort-2.x.x

    /configure --with-mysql=/usr/local/mysql

    make

    make install

    5.2安装规则和配置文件

    cd rules (在snort安装目录下）

    cp * /etc/snort

    cd ./etc

    cp snort.conf /etc/snort

    cp *.config /etc/snort

    5.3修改snort.conf(/etc/snort/snort.conf)

    var HOME_NET 10.2.2.0/24 (修改为你的内部网网络地址，我的是

    192.168.0.0/24)

    var RULE_PATH ./rules 修改为 var RULE_PATH /etc/snort/

    改变记录日志数据库：

    output database: log, mysql, user=root password=your_password

    dbname=snort host=localhost

    5.4设置snort为自启动：

    在snort安装目录下

    cd /contrib

    cp S99snort /etc/init.d/snort

    vi /etc/init.d/snort

    修改snort如下：

    CONFIG=/etc/snort/snort.conf

    #SNORT_GID=nogroup (注释掉）

    #8194;$SNORT_PATH/snort -c ?$CONFIG -i ?$IFACE ?$OPTIONS

    (去掉原文件中的 -g ?$SNORT_GID )

    chmod 755 /etc/init.d/snort

    cd /etc/rc3.d

    ln -s /etc/init.d/snort S99snort

    ln -s /etc/init.d/snort K99snort

    cd /etc/rc5.d

    ln -s /etc/init.d/snort S99snort

    ln -s /etc/init.d/snort K99snort

    四.在mysql中建立数据库

    /usr/local/mysql/bin/mysql

    mysql〉SET PASSWORD FOR root@localhost=PASSWORD(’your_password’);

    mysql〉create database snort;

    mysql〉grant INSERT,SELECT on root.* to snort@localhost;

    mysql〉quit;

    进入snort安装目录：/usr/local/mysql/bin/mysql -p
    gt;Enter password:

    安装DB表：(在contrib目录）

    zcat snortdb-extra.gz | /usr/local/mysql/bin/mysql -p snort

    进入mysql数据库，看看snort数据库中的表：

    /usr/local/mysql/bin/mysql -p

    gt;Enter password:

    mysql〉show databases;

    +------------+

    | Database

    +------------+

    | mysql

    | snort

    | test

    +------------+

    3 rows in set (0.00 sec)

    mysql〉use snort;

    mysql〉show tables; 将会有这些：

    +------------------+

    | Tables_in_snort |

    +------------------+

    | data

    | detail

    | encoding

    | event

    | flags

    | icmphdr

    | iphdr

    | opt

    | protocols

    | reference

    | reference_system

    | schema

    | sensor

    | services

    | sig_class

    | sig_reference

    | signature

    | tcphdr

    | udphdr

    +------------------+

    19 rows in set (0.00 sec)

    mysql〉exit

    五.安装配置Web接口

    安装JPGraph1.11

    cp jpgraph-1.11.tar.gz /www/htdocs

    cd /www/htdocs

    tar -xzvf jpgraph-1.xx.tar.gz

    rm -rf jpgrap-1.xx.tar.gz

    cd jpgraph-1.11

    rm -rf README

    rm -rf QPL.txt

    安装ADODB:

    cp adodb330.tgz /www/htdocs/

    cd /www/htdocs

    tar -xzvf adodb330.tgz

    rm -rf adodb330.tgz

    安装配置Acid:

    cp acid-0.0.6b23.tar.gz /www/htdocs

    cd /www/htdocs

    tar -xvzf acid-0.9.6b23.tar.gz

    rm -rf acid-0.9.6b23.tar.gz

    cd /www/htodcs/acid/

    编辑acid_conf.php,修改相关配置如下：

    #8194;$DBlib_path = “/www/htdocs/adodb“;

    /* The type of underlying alert database

    *

    * MySQL : “mysql“

    * PostgresSQL : “postgres“

    * MS SQL Server : “mssql“

    */

    #8194;$DBtype = “mysql“;

    /* Alert DB connection parameters

    * - ?$alert_dbname : MySQL database name of Snort alert DB

    * - ?$alert_host : host on which the DB is stored

    * - ?$alert_port : port on which to access the DB

    * - ?$alert_user : login to the database with this user

    * - ?$alert_password : password of the DB user

    *

    * This information can be gleaned from the Snort database

    * output plugin configuration.

    */

    #8194;$alert_dbname = “snort“;

    #8194;$alert_host = “localhost“;

    #8194;$alert_port = ““;

    #8194;$alert_user = “root“;

    #8194;$alert_password = “Your_Password“;

    /* Archive DB connection parameters */

    #8194;$archive_dbname = “snort“;

    #8194;$archive_host = “localhost“;

    #8194;$archive_port = ““;

    #8194;$archive_user = “root“;

    #8194;$archive_password = “Your_Password “;

    And a little further down

    #8194;$ChartLib_path = “/www/htdocs/jpgraph-1.11/src“;

    /* File format of charts (’png’, ’jpeg’, ’gif’) */

    #8194;$chart_file_format = “png“;

    进入web界面：

    http://yourhost/acid/acid_main.php

    点“Setup Page“链接 -〉Create Acid AG

    访问http://yourhost/acid将会看到ACID界面。

    六.测试系统

    重启系统或者直接启动相关后台程序：

    /etc/init.d/mysql restart

    /etc/init.d/snort start

    /etc/init.d/httpd start

    利用nmap,nessus,CIS或者X-scan对系统进行扫描，

    产生告警纪录。

    http://yourhost/acid 察看纪录。

    至此，一个功能强大的IDS配置完毕。各位可以利用web界面远程登陆，监控主机所处局域网，同时安装phpMyAdmin对mysql数据库进行操控。