环境:CentOS5.5
1.下载libevent-1.4.14b-stable.tar.gz
解压 tar -zxvf libevent-1.4.14b-stable.tar.gz
进入目录 cd libevent-1.4.14b-stable
./configure
make
make install
2.下载libdnet-1.11.tar.gz
解压 tar -zxvf libdnet-1.11.tar.gz
进入目录 cd libdnet-1.11
./configure
错误configure: error: C++ preprocessor "/lib/cpp" fails sanity check
需要安装gcc-c++
依赖包:libstdc++和libsc++-devel
可以通过手动下载合适版本的上述包安装,但在安装libstdc++时出现冲突:
file /usr/lib/libstdc++.so.6.0.8 from install of libstdc++-4.1.2-52.el5.i386 conflicts with file from package libstdc++-4.1.2-48.el5.i386(我安装的是ibstdc++-4.1.2-52.el5.i386,其他版本也试过也是同样的问题,但查找发现libstdc++-4.1.2-48.el5.i386并没有安装,不知道是我没找到还是什么原因)
最好yum自动安装,这首先要更新一下yum源,最好找最新的源更新。当然,如果有些包yum找不到源只能手动下载安装了。注意各安装和相应依赖包版本要一直,i386还是x86_64也好一致。
make
make install
3.下载libpcap-1.1.1.tar.gz(有的CentOS系统pcap可能是自带的,这步可以省去。)
解压 tar -zxvf libpcap-1.1.1.tar.gz
cd libpcap-1.1.1
./configure
出现错误:configure: error: Your operating system's lex is insufficient to compile
libpcap. flex is a lex replacement that has many advantages, including
being able to compile libpcap. For more information, see
http://www.gnu.org/software/flex/flex.html .
这需要安装flex,可以在http://flex.sourceforge.net/ 下载或yum安装。
make
出现错误:./runlex.sh lex -oscanner.c scanner.l
yacc -d grammar.y
make: yacc:命令未找到
make: *** [grammar.c] 错误 127
这个网上有很多介绍,方法:yum install -y byacc
make install
4.下载honeyd-1.5c.tar.gz
解压:tar -zxvf honeyd-1.5c.tar.gz
cd honeyd-1.5c
./configure
错误:configure: error: need either libedit or libreadline; install one of them
这个网上也有解决,方法:yum install -y readline readline-devel
错误:configure: error: zlib ismissing - you need to install it
解决方法:yum -y install zlib-devel
错误:checking if we can access libc without dlopen... no
checking if we can access libc with libc.so... no
checking if we can access libc with /usr/lib/libc.so*... no
checking if we can access libc with /lib/libc.so.6... no
configure: error: Couldn't figure out how to access libc
这可能是和64位兼容性有关吧,也有人说是交叉编译的问题,不是很了解,网上找了很多终于有个英文论坛上有人也出现这这样的问题,解决方法是将configure文件中/lib/libc.so出现的地方改为/lib64/libc.so
make
在centOS下是成功了的,但几个以前在Redhat上装的时候出现类似exit()方法缺少参数的问题,解决方法将某个文件中的exit()改为exit(0)。
make install
5.安装arpd
下载:arpd-0.2.tar.gz
解压:tar -zxvf arpd-0.2.tar.gz
cd arpd-0.2
./configure
make
出现错误:gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/local/include -I/usr/local/include -I/usr/local/include -I/usr/local/include -c arpd.c
arpd.c: In function ‘arpd_send’:
arpd.c:268: 错误:expected ‘)’ before string constant
arpd.c: In function ‘arpd_lookup’:
arpd.c:285: 错误:expected ‘)’ before string constant
arpd.c:294: 错误:expected ‘)’ before string constant
arpd.c:297: 错误:expected ‘)’ before string constant
arpd.c: In function ‘arpd_recv_cb’:
arpd.c:426: 错误:expected ‘)’ before string constant
make: *** [arpd.o] 错误 1
这个网上有很多介绍,解决方法:在arpd/arpd.c文件中添加 #define __FUNCTION__ ""
make install
6.运行arpd:
如:./arpd 192.168.16.111
无法启动,出现:arpd: error while loading shared libraries: libpcap.so.1: cannot open shared object file: No such file or directory
网上有一些方法如直接将文件从/uar/local/lib中拷贝到/usr/lib中或做链接,但我做了之后还是有错,采用网上另一种方法:把libdnet.so.1所在lib位置加入到/etc/ld.so.conf中在/etc/ld.so.conf中加入一行/usr/local/lib即可保存后,执行ldconfig。可以。
出现arpd[28816]: listening on eth0: arp and (dst 192.168.16.112) and not ether src 00:0c:29:f2:e5:ae说明正常启动
7.运行honeyd
执行honeyd[28818]: started with -d -f honeyd.conf -l /var/log/honeyd/honeyd.log -s /var/log/honeyd/service.log 192.168.16.112
其中honeyd.conf是我的配置文件,honeyd.log和service.log是我的日志文件。
出现
Warning: Impossible SI range in Class fingerprint "IBM OS/400 V4R2M0"
Warning: Impossible SI range in Class fingerprint "Microsoft Windows NT 4.0 SP3"
honeyd[28818]: listening promiscuously on eth0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip and (host 192.168.16.112))) and not ether src 00:0c:29:f2:e5:ae
honeyd[28818]: Demoting process privileges to uid 99, gid 99
honeyd[28818]: update_check: failed to resolve host.(这个好像有点问题,不过不影响使用,没有研究)
说明正常启动。
在外部主机(ip192.168.16.64)上ping 192.168.16.112
显示:honeyd[28818]: Sending ICMP Echo Reply: 192.168.16.112 -> 192.168.16.64
honeyd[28818]: Sending ICMP Echo Reply: 192.168.16.112 -> 192.168.16.64
honeyd[28818]: Sending ICMP Echo Reply: 192.168.16.112 -> 192.168.16.64
查看日志文件/var/log/honeyd/honeyd.log
有记录:
2012-03-14-21:20:19.2906 honeyd log started ------
2012-03-14-21:20:35.5265 icmp(1) - 192.168.16.64 192.168.16.112: 8(0): 60
2012-03-14-21:20:36.5349 icmp(1) - 192.168.16.64 192.168.16.112: 8(0): 60
2012-03-14-21:20:37.5364 icmp(1) - 192.168.16.64 192.168.16.112: 8(0): 60
8.有的网帖上介绍还要安装Libdnsres,我以前在Redhat5和kylin上安装honeyd时也下载安装了libdnsres-0.1a.tar.gz。但此次在CentOS上安装时在make阶段出现错误:/usr/bin/ld: strlcpy.o: relocation R_X86_64_32 against `a local symbol' can not be used when making a shared object; recompile with -fPIC
strlcpy.o: could not read symbols: Bad value
未能结局,后发现不影响honeyd的安装,没有研究其中究竟。