搭建snort+BASE入侵检测系统
1. 安装snort
- 安装 DAQ
2)安装snort
3) 测试
4) 创建用户环境&配置文件目录&复制配置文件
5) 手动修改 snort.conf 配置
6) 添加本地规则
1. sudo vi /etc/snort/rules/local.rules
2. alert icmp any any -> $HOME_NET any (msg:"ICMP Test detected!!!"; classtype:icmpevent; sid:10000001; rev:001; GID:1; )
3. sudo vi /etc/snort/sid-msg.map
4. #v2
5. 1 || 10000001 || 001 || icmp-event || 0 || ICMP Test detected || url,tools.ietf.org/html/rfc792
- 测试配置文件
8) 测试功能
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i ens33
首先查看主机 ip 地址
此时从外面 ping 网口 ens33 的 IP, snort 会记录受到攻击,信息保存在
/var/log/snort 中,文件名为 snort.log.xxx
2. 安装Barnyard2
- 安装 mysql
1. sudo apt-get install -y mysql-server libmysqlclient-dev mysql-client autoconf libtool
- 解压编译
2. ./configure --with-mysql --with-mysql-libraries=/usr/lib/x86_64-linux-gnu
3. ./configure --with-mysql --with-mysql-libraries=/usr/lib/i386-linux-gnu
4. sudo make && sudo make install
- 测试
4) 设置配置文件
5. sudo cp ~/barnyard2-2-1.13/etc/barnyard2.conf /etc/snort/
6. # the /var/log/barnyard2 folder is never used or referenced
7. # but barnyard2 will error without it existing
8. sudo mkdir /var/log/barnyard2
9. sudo chown snort.snort /var/log/barnyard2
10. sudo touch /var/log/snort/barnyard2.waldo
11. sudo chown snort.snort /var/log/snort/barnyard2.waldo
- 配置数据库
12. ubuntu@ubuntu:~$ mysql -u root -p
13. mysql> create database snort;
14. mysql> use snort;
15. mysql> source ~/barnyard2-2-1.13/schemas/create_mysql;
16. mysql> CREATE USER 'snort'@'localhost' IDENTIFIED BY '123456';
17. mysql> grant create, insert, select, delete, update on snort.* to 'snort'@'localhost';
18. mysql> exit;
- 添加数据库配置
1. sudo vi /etc/snort/barnyard2.conf
2. #在末尾添加数据库配置
3. output database: log, mysql, user=snort password=123456 dbname=snort host=localhost senso
r name=sensor01
4. 修改 barnyard2.conf 权限防止被修改
5. sudo chmod o-r /etc/snort/barnyard2.conf
- 测试
1. # 开启 snort,并向 eth1 发送 ping 数据包
2. sudo snort -q -u snort -g snort -c /etc/snort/snort.conf -i ens33
3. # 开启 barnyard2,将日志信息存入数据库
4. # 1.连续处理模式,设置 barnyard2.waldo 为书签
5. sudo barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -
w /var/log/snort/barnyard2.waldo -g snort -u snort
6. # 2.文件处理模式,处理单个日志文件
7. sudo barnyard2 -c /etc/snort/barnyard2.conf -o /var/log/snort/snort.log.xxx
8. # 查看数据库条目数量,看是否增加
9. mysql -u snort -p -D snort -e "select count(*) from event"
3. 安装 PulledPork
- 解压并安装
1. tar xzvf pulledpork-v0.7.3.tar.gz
2. cd pulledpork-v0.7.3/
3. sudo cp pulledpork.pl /usr/local/bin
4. sudo chmod +x /usr/local/bin/pulledpork.pl
5. sudo cp etc/*.conf /etc/snort
- 测试
6. ubuntu@ubuntu:~$ pulledpork.pl -V
7. PulledPork v0.7.3 - Making signature updates great again!
- 配置
8. sudo vi /etc/snort/pulledpork.conf
9. #第 19 行:输入注册账户生成的 oinkcode,若没有则注释掉
10. #第 29 行:取消注释可下载针对新兴威胁的规则
11. #第 74 行:更改为:
12. rule_path = /etc/snort/rules/snort.rules
13. #第 89 行:更改为:
14. local_rules = /etc/snort/rules/local.rules
15. #第 92 行:更改为:
16. sid_msg = /etc/snort/sid-msg.map
17. #第 96 行:更改为:
18. sid_msg_version = 2
19. #第 119 行:更改为:
20. config_path = /etc/snort/snort.conf
21. #第 133 行:更改为:
22. distro = Ubuntu-12-04
23. #第 141 行:更改为:
24. black_list = /etc/snort/rules/iplists/black_list.rules
25. #第 150 行:更改为:
26. 19. IPRVersion = /etc/snort/rules/iplists
27. sudo vi /etc/snort/snort.conf
28. #第 548 行添加
29. include $RULE_PATH/snort.rules
- 更新规则
1. sudo /usr/local/bin/pulledpork.pl -c /etc/snort/pulledpork.conf -l
- 测试规则
1. sudo snort -T -c /etc/snort/snort.conf -i eth0
4. 创建服务
- 创建 Snort 服务
1. sudo vi /lib/systemd/system/snort.service
2. [Unit]
3. Description=Snort NIDS Daemon
4. After=syslog.target network.target
5. [Service]
6. Type=simple
7. Restart=always
8. ExecStart=/usr/local/bin/snort -q -u snort -g snort -c /etc/snort/snort.conf -i ens33
9. [Install]
10. WantedBy=multi-user.target
11. sudo systemctl enable snort
12. sudo systemctl start snort
13. sudo systemctl status snort
- 创建 Barnyard2 服务
1. sudo vi /lib/systemd/system/barnyard2.service
2. [Unit]
3. Description=Barnyard2 Daemon
4. After=syslog.target network.target
5. [Service]
6. Type=simple
7. Restart=always
8. ExecStart=/usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -q -
w /var/log/snort/barnyard2.waldo -g snort -u snort -D -a /var/log/snort/archived_logs --pidpath=/var/run
9. [Install]
10. WantedBy=multi-user.target
11. sudo systemctl enable barnyard2
12. sudo systemctl start barnyard2
13. sudo systemctl status barnyard2
5. 安装 BASE
- 解压
1. tar xzvf base-1.4.5.tar.gz
2. sudo mv base-1.4.5 /var/www/html/base/
- 配置
3. cd /var/www/html/base
4. sudo cp base_conf.php.dist base_conf.php
3.
5. sudo vi /var/www/html/base/base_conf.php
6. $BASE_Language = 'simplified_chinese'; # line 27
7. $BASE_urlpath = '/base'; # line 50
8. $DBlib_path = '/usr/share/php/adodb/'; #line 80
$alert_dbname = 'snort'; # line 102
9. $alert_host = 'localhost';
10. $alert_port = '';
11. $alert_user = 'snort';
12. $alert_password = '123456'; # line 106
13. // $graph_font_name = "Verdana";
14. // $graph_font_name = "DejaVuSans";
15. // $graph_font_name = "Image_Graph_Font";
16. $graph_font_name = "";
17.
18. sudo chown -R www-data:www-data /var/www/html/base
19. sudo chmod o-r /var/www/html/base/base_conf.php
20.
21. sudo service apache2 restart
浏览器访问 http://localhost/base 进行访问
根据提示进行最后的配置,进入 mainpage