snort base daq ids

约定:未提示下载地址的 均能在sourceforge下载到

 1、配置lamp环境

yum install pcre pcre-devel php php-common php-gd php-cli php-mysql mysql mysql-devel mysql-bench mysql-server  kernel-devel libxml2-devel vim-enhanced
service httpd start
service mysqld start
chkconfig --add httpd
chkconfig --add mysqld
chkconfig httpd on
chkconfig mysqld on

2、配置libpcap

 

[root@onlinepay src]# tar -xf ~/libpcap-1.0.0.tar.gz
[root@onlinepay src]# ls
libpcap-1.0.0  snort-2.9.4
[root@onlinepay src]# cd libpcap-1.0.0/
[root@onlinepay libpcap-1.0.0]# ./configure --prefix=/usr/local/libpcap
[root@onlinepay libpcap-1.0.0]#mkdir -p /usr/local/libpcap/bin/
[root@onlinepay libpcap-1.0.0]#make && make test && make install

3、配置libdnet

 

[root@onlinepay src]# tar -xf ~/libdnet-1.12.tgz
[root@onlinepay src]# cd libdnet-1.12/
[root@onlinepay libdnet-1.12]# ./configure --prefix=/usr/local/libdnet
[root@onlinepay libdnet-1.12]# make && make install

4、配置daq

daq下载地址 http://www.snort.org/downloads/2103

[root@onlinepay daq-2.0.0]# ./configure  --prefix=/usr/local/daq \
--with-libpcap-libraries=/usr/local/libpcap/lib/ \
--with-libpcap-includes=/usr/local/libpcap/include
[root@onlinepay daq-2.0.0]# make && make install

5、编译snort

 

[root@onlinepay snort-2.9.4]# ls
aclocal.m4    config.sub    COPYING  install-sh  Makefile.am    preproc_rules  snort.pc.in  verstuff.pl
ChangeLog     configure     depcomp  LICENSE     Makefile.in    RELEASE.NOTES  src          ylwrap
config.guess  configure.in  doc      ltmain.sh   missing        rpm            templates
config.h.in   contrib       etc      m4          mkinstalldirs  snort.8        tools
./configure --prefix=/usr/local/snort --with-mysql\
--with-libpcap-libraries=/usr/local/libpcap/lib\
--with-libpcap-includes=/usr/local/libpcap/include\
--with-dnet-libraries=/usr/local/libdnet/lib\
--with-dnet-includes=/usr/local/libdnet/include\
--with-daq-includes=/usr/local/daq/include\
--with-daq-libraries=/usr/local/daq/lib/daq --enable-zlib

 若是出现./configure: line 21270: daq-modules-config: command not found 请检查是否将daq-modules-config加入path,以及是否有可执行权限.

 

configure: WARNING: unrecognized options: --with-mysql
[root@onlinepay snort-2.9.4]# make && make install

此处报错 能够忽略 

 

六.配置snort

 

[root@onlinepay snort-2.9.4]# mkdir /etc/snort
[root@onlinepay snort-2.9.4]# mkdir -p /var/log/snort
[root@onlinepay snort-2.9.4]# pwd
/usr/local/src/snort-2.9.4
[root@onlinepay snort-2.9.4]# cp etc/* /etc/snort/
[root@onlinepay snort-2.9.4]#

7、装载规则文件

下载解压规则文件snortrules-snapshot-2.8.tar.gz  http://vdisk.weibo.com/s/lB1gI

[root@onlinepay src]# tar -xvf ~/snortrules-snapshot-2.8.tar.gz
[root@onlinepay src]# cp -R so_rules/ /etc/snort/

8、测试snort 安装

 

[root@onlinepay src]# /usr/local/snort/bin/snort -V

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.4 GRE (Build 40)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
           Copyright (C) 1998-2012 Sourcefire, Inc., et al.
           Using libpcap version 1.0.0
           Using PCRE version: 6.6 06-Feb-2006
           Using ZLIB version: 1.2.3

出现如上提示就说明能够用了

9、数据库设置

 未完待续