SNORT invasion examination system 2

Add date: 08/20/2008 Publishing date: 08/20/2008 Hits: 28

Total 2 pages, Current page:1, Jump to page:

10. installs Snort2.4.4

¡¡¡¡10.1 establish the snort configuration files and the diary catalog

¡¡¡¡#mkdir /etc/snort

¡¡¡¡#mkdir /var/log/snort

¡¡¡¡#tar - zxvf snort-2.4.4.tar.gz

¡¡¡¡#cd snort-2.4.4

¡¡¡¡#. /configure --with-mysql=/usr/local/mysql

¡¡¡¡#make

#make install

The attention, I when translates snort present “ERROR! Libpcre header not found, go get it from” mistake. This is because has little installed a lib storehouse, if who had such problem, arrives at ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/ to download the newest pcre storehouse to carry on the installment.

Method: #tar - zxvf pcre-6.7.tar.gz

#. /configure

#make

#make check

#make install

¡¡¡¡10.2 the mounting plan and the configuration files

#cd /etc/snort/

#tar? zxvf /ruanjian/snortrules-snapshot-2.4.tar.gz

¡¡¡¡#cd /etc/snort/rules (, in snort installs under table of contents)

¡¡¡¡#cp *.conf /etc/snort/.

¡¡¡¡#cp *.config /etc/snort/.

#cp *.map /etc/snort/.

10.3 revise snort.conf (/etc/snort/snort.conf)

¡¡¡¡var HOME_NET 172.17.4.0 /24 (revision for yours intranet network address)

var the RULE_PATH ./rules revises is var the RULE_PATH /etc/snort/

¡¡¡¡Changes the record diary database:

log and the alert database must construct separately, otherwise snort starts, when time has the event to occur must make a mistake

¡¡¡¡output database: log, mysql, user=root password=your_password dbname=snort host=localhost

output database: alert, mysql, user=root password=your_password dbname=snort host=localhost

Installs the DB table: (in the schemas table of contents)

/usr/local/mysql/bin/mysql - u root - p <create_mysql the snort // is the snort establishment data sheet

11. the installment disposes the Web connection

¡¡¡¡Installs JPGraph2.1.1

¡¡¡¡#cp jpgraph-2.1.1.tar.gz /home

#cd /home

¡¡¡¡#tar - xzvf jpgraph-2.1.1.tar.gz

#mv jpgraph-2.1.1 jpgraph

¡¡¡¡

¡¡¡¡Installs ADODB:

¡¡¡¡#cp adodb480.gz /home

#cd /home

#tar - xzvf adodb480.gz

¡¡¡¡The installment disposes Acid:

¡¡¡¡#cp acid-0.9.6b23.tar.gz /home

#cd /home

#tar - xvzf acid-0.9.6b23.tar.gz

#cd /home/acid/

¡¡¡¡Edits acid_conf.php, the revision related disposition is as follows:

$DBlib_path = “/home/adodb”;

$DBtype = “mysql”;

$alert_dbname = “snort”;

$alert_host = “localhost”;

$alert_port = "";

$alert_user = “root”;

Other pages: : 1 * 2 * Next>>

Prev:SNORT invasion examination system 1

Next:The SNORT invasion examines 3

Comment:

Category: Home > hacker invade