一、系統平台
Redhat9.0發行版， 安裝gcc 及相關庫文件，建議不要安裝
Apache,PHP,MySQL,我們將用源碼編譯安裝。基於安全方面的
考慮，可以設置一下iptables只允許SSH和WWW訪問。
二、軟體
MySQL4.0.12 http://mysql.secsup.org
Snort2.0.0 http://www.snort.org
Apache2.0.45 http://www.apache.org
PHP4.3.1 http://www.php.net
ADODBv3.30 http://phplens.com
Acid0.9.6b23 http://acidlab.sourceforge.net
Zlib1.1.4 http://flow.dl.sourceforge.net
JPGraph1.11 http://jpgraph.techuk.com
LibPcap0.7.2 http://www.tcpdump.org
建議到這個站點下載http://ftp.cdut.edu.cn/pub/linux/NEW/
也可以到http://www.rpmfind.com下載相關的xx.src.rpm編譯安裝。如若安裝了rpm包，可以強行將其反安裝
rpm -e -nodeps xx.xx
三、安裝（建議將所有的包文件考到同一目錄） 1.安裝zlib1.1.4
tar -xzvf zlib-xx.tar.gz
cd zlib-xx
/configure;make test
make install
cd ..
2.安裝LibPcap0.7.2
tar -xzvf libpcap.tar.gz
cd libpcap-xx
/configure
make
make install
cd ..
3.安裝MySQL4.0.12
3.1創建mysql組和mysql用戶
groupadd mysql
useradd -g mysql mysql
修改/root下的.bash_profile的這一行：
PATH=?$PATH:?$HOME/bin 為
PATH=?$PATH:?$HOME/bin:/usr/local/mysql/bin
3.2安裝mysql
tar -xzvf mysql-xx.tar.gz
cd mysql-xx
/configure --prefix=/usr/local/mysql
make
make install
cd scripts
/mysql_install_db
chown -R root /usr/local/mysql
chown -R mysql /usr/local/mysql/var
chgrp -R mysql /usr/local/mysql
cd ./support-files/my-medium.cnf /etc/my.cnf
向/etc/ld.so.conf中加入兩行：/usr/local/mysql/lib/mysql
/usr/local/lib
載入庫，執行
ldconfig -v
3.3測試mysql是否工作：
cd /usr/local/mysql/bin/
/mysqld_safe --user=mysql&
#ps -ef |grep mysql
看mysql_safe是否工作
3.4設置mysql為自啟動：
將mysql安裝目錄下的support-files目錄中的
mysql.server文件拷到/etc/init.d目錄
cp mysql.server /etc/init.d/mysql
chmod 755 /etc/init.d/mysql
創建硬鏈接:
cd /etc/rc3.d（文本方式啟動)
ln -s /etc/init.d/mysql S85mysql
ln -s /etc/init.d/mysql K85mysql
cd /etc/rc5.d (圖形方式啟動）
ln -s /etc/init.d/mysql S85mysql
ln -s /etc/init.d/mysql K85mysql
4.安裝Apache2.0.45和PHP4.3.1
tar -zxvf httpd-2.0.xx.tar.gz
cd httpd_2.xx.xx
/configure --prefix=/www --enable-so
註：apache根目錄為 /www
make
make install
cd ..
tar -zxvf php-4.3.x.tar.gz
cd php-4.3.x
/configure --prefix=/www/php --with-apxs2=/www/bin/apxs --with-config- filepath=/www/php --enable-sockets --with-mysql=/usr/local/mysql --with-zlibdir=/
usr/local --with- gd
注意：這些為一行，中間不要有回車。
cp php.ini-dist /www/php/php.ini
編輯httpd.conf(/www/conf):
加入兩行
LoadModule php4_module modules/libphp4.so
AddType application/x-httpd-php .php
httpd.conf中相關內容如下：
#
# LoadModule foo_module modules/mod_foo.so
LoadModule php4_module modules/libphp4.so
# AddType allows you to tweak mime.types without actually editing it, or ?$
# make certain files to be certain types.
#
AddType application/x-tar .tgz
AddType image/x- icon .ico
AddType application/x-httpd-php .php
設置Apache為自啟動：
cp /www/bin/apachectl /etc/init.d/httpd
cd /etc/rc3.d
ln -s /etc/init.d/httpd S85httpd
ln -s /etc/init.d/httpd K85httpd
cd /etc/rc5.d
ln -s /etc/init.d/httpd S85httpd
ln -s /etc/init.d/httpd K85httpd
測試一下 PHP:
cd /etc/init.d
/httpd start
在/www/htdocs下建立文件 test.php
cd /www/htdocs
vi test.php
加入
lt;?php
hpinfo();
?>
用瀏覽器訪問http://IP_address/test.php,成功的話，出現一些
系統,apache,php信息
5.安裝 Snort2.0
5.1建立snort配置文件和日誌目錄
mkdir /etc/snort
mkdir /var/log/snort
tar -zxvf snort-2.x.x.tar.gz
cd snort-2.x.x
/configure --with-mysql=/usr/local/mysql
make
make install
5.2安裝規則和配置文件
cd rules (在snort安裝目錄下）
cp * /etc/snort
cd ./etc
cp snort.conf /etc/snort
cp *.config /etc/snort
5.3修改snort.conf(/etc/snort/snort.conf)
var HOME_NET 10.2.2.0/24 (修改為你的內部網網路地址，我的是
192.168.0.0/24)
var RULE_PATH ./rules 修改為 var RULE_PATH /etc/snort/
改變記錄日誌資料庫：
output database: log, mysql, user=root password=your_password
dbname=snort host=localhost
5.4設置snort為自啟動：
在snort安裝目錄下
cd /contrib
cp S99snort /etc/init.d/snort
vi /etc/init.d/snort
修改snort如下：
CONFIG=/etc/snort/snort.conf
#SNORT_GID=nogroup (註釋掉）
#8194;$SNORT_PATH/snort -c ?$CONFIG -i ?$IFACE ?$OPTIONS
(去掉原文件中的 -g ?$SNORT_GID )
chmod 755 /etc/init.d/snort
cd /etc/rc3.d
ln -s /etc/init.d/snort S99snort
ln -s /etc/init.d/snort K99snort
cd /etc/rc5.d
ln -s /etc/init.d/snort S99snort
ln -s /etc/init.d/snort K99snort
四.在mysql中建立資料庫
/usr/local/mysql/bin/mysql
mysql>SET PASSWORD FOR root@localhost=PASSWORD('your_password');
mysql>create database snort;
mysql>grant INSERT,SELECT on root.* to snort@localhost;
mysql>quit;
進入snort安裝目錄：/usr/local/mysql/bin/mysql -p
gt;Enter password:
安裝DB表：(在contrib目錄）
zcat snortdb-extra.gz | /usr/local/mysql/bin/mysql -p snort
進入mysql資料庫，看看snort資料庫中的表：
/usr/local/mysql/bin/mysql -p
gt;Enter password:
mysql>show databases;
+------------+
| Database
+------------+
| mysql
| snort
| test
+------------+
3 rows in set (0.00 sec)
mysql>use snort;
mysql>show tables; 將會有這些：
+------------------+
| Tables_in_snort |
+------------------+
| data
| detail
| encoding
| event
| flags
| icmphdr
| iphdr
| opt
| protocols
| reference
| reference_system
| schema
| sensor
| services
| sig_class
| sig_reference
| signature
| tcphdr
| udphdr
+------------------+
19 rows in set (0.00 sec)
mysql>exit
五.安裝配置Web介面
安裝JPGraph1.11
cp jpgraph-1.11.tar.gz /www/htdocs
cd /www/htdocs
tar -xzvf jpgraph-1.xx.tar.gz
rm -rf jpgrap-1.xx.tar.gz
cd jpgraph-1.11
rm -rf README
rm -rf QPL.txt
安裝ADODB:
cp adodb330.tgz /www/htdocs/
cd /www/htdocs
tar -xzvf adodb330.tgz
rm -rf adodb330.tgz
安裝配置Acid:
cp acid-0.0.6b23.tar.gz /www/htdocs
cd /www/htdocs
tar -xvzf acid-0.9.6b23.tar.gz
rm -rf acid-0.9.6b23.tar.gz
cd /www/htodcs/acid/
編輯acid_conf.php,修改相關配置如下：
#8194;$DBlib_path = "/www/htdocs/adodb";
/* The type of underlying alert database
*
* MySQL : "mysql"
* PostgresSQL : "postgres"
* MS SQL Server : "mssql"
*/
#8194;$DBtype = "mysql";
/* Alert DB connection parameters
* - ?$alert_dbname : MySQL database name of Snort alert DB
* - ?$alert_host : host on which the DB is stored
* - ?$alert_port : port on which to access the DB
* - ?$alert_user : login to the database with this user
* - ?$alert_password : password of the DB user
*
* This information can be gleaned from the Snort database
* output plugin configuration.
*/
#8194;$alert_dbname = "snort";
#8194;$alert_host = "localhost";
#8194;$alert_port = "";
#8194;$alert_user = "root";
#8194;$alert_password = "Your_Password";
/* Archive DB connection parameters */
#8194;$archive_dbname = "snort";
#8194;$archive_host = "localhost";
#8194;$archive_port = "";
#8194;$archive_user = "root";
#8194;$archive_password = "Your_Password ";
And a little further down
#8194;$ChartLib_path = "/www/htdocs/jpgraph-1.11/src";
/* File format of charts ('png', 'jpeg', 'gif') */
#8194;$chart_file_format = "png";
進入web界面：
http://yourhost/acid/acid_main.php
點"Setup Page"鏈接 ->Create Acid AG
訪問http://yourhost/acid將會看到ACID界面。
六.測試系統
重啟系統或者直接啟動相關後台程序：
/etc/init.d/mysql restart
/etc/init.d/snort start
/etc/init.d/httpd start
利用nmap,nessus,CIS或者X-scan對系統進行掃描，
產生告警紀錄。
http://yourhost/acid 察看紀錄。
至此，一個功能強大的IDS配置完畢。各位可以利用web界面
遠程登陸，監控主機所處區域網，同時安裝phpMyAdmin對mysql
資料庫進行操控。
