第一部分 IDS入侵檢測系統簡單介紹

IDS依照一定的安全策略，通過軟體或者硬體，對網路、系統的執行狀況進行監控，儘可能發現各種攻擊企圖、攻擊行為和結果，以此保證網路系統資源的機密性、完整性和可靠性。一般來說IDS是作為防火牆的補充，處於防火前之後，可對網路進行實時監測，並記錄。

snort作為一個輕量級的入侵監測系統，具有一下幾個特點：

（1）佔用資源少，對網路效能影響小；

（2）支援系統廣泛，可以跨平臺使用；

（3）snort有三種主要的模式：資訊報嗅探器、資訊報記錄器和成熟的入侵檢測系統

（4）採用誤用檢測模型，首先建立入侵行為特徵庫，然後在檢測過程中，將收集到的資料包和特徵碼進行比較，得出是否入侵的結論；

（5）它是用C語言寫的開放原始碼。

snort的體系結構

（1）資料收集：snort使用libpcap收集資料

（2）資料分析：包含包解碼和探測引擎兩部分。包解碼為探測引擎準備資料，探測引擎按照啟動時載入的規則，對每個資料進行分析。

（3）日誌記錄/告警記錄：日誌和告警時兩個不同的子系統。日誌將包解碼收集到的資訊記錄下來，預設情況下，寫到/var/log/snort資料夾中，告警日誌會記錄到/var/log/snort/alert 檔案中。

簡單的畫個原理圖，表示資料流向

第二部分  系統搭建

一、搭建LAMP架構

這個比較簡單，而且這篇文章內容表較多，所以這裡就不做說明了

二、安裝snort需要的一些軟體

1、libpcap是linux平臺下的網路資料包捕獲的含書包，大多數網路監控軟體都是以它作為基礎

在安裝libpcap前，還要安裝兩個軟體

[[email protected] soft]# wget ftp://ftp.gnu.org/gnu/bison/bison-2.4.1.tar.bz2

[[email protected] soft]# tar xf bison-2.4.1.tar.bz2

[[email protected] soft]# cd bison-2.4.1
[[email protected] bison-2.4.1]# ./configure && make && make install

[[email protected] soft]# wget http://nchc.dl.sourceforge.net/project/flex/flex/flex-2.5.35/flex-2.5.35.tar.bz2

[[email protected] soft]# tar xf flex-2.5.35.tar.bz2

[[email protected] flex-2.5.35]# ./configure && make && make install

接下來就是安裝libpcap了

[[email protected] soft]#  wget http://www.tcpdump.org/release/libpcap-1.2.1.tar.gz

[[email protected] soft]# tar xf libpcap-1.2.1.tar.gz 
[[email protected] soft]# cd libpcap-1.2.1
[[email protected] libpcap-1.2.1]# ./configure --prefix=/usr/local/libpcap 

[[email protected] libpcap-1.2.1]# make

[[email protected] libpcap-1.2.1]# make install

2、daq，snort編譯時會用到該庫

[[email protected] soft]# wget http://www.snort.org/dl/snort-current/daq-0.6.2.tar.gz

[[email protected] soft]# tar xf daq-0.6.2.tar.gz 
[[email protected] soft]# cd daq-0.6.2

[[email protected] daq-0.6.2]# ./configure  && make && make install

3、libdnet  通用網路安全開發包

[[email protected] soft]# wget http://libdnet.googlecode.com/files/libdnet-1.12.tgz

[[email protected] soft]# tar xf libdnet-1.12.tgz 
[[email protected] soft]# cd libdnet-1.12

[[email protected] libdnet-1.12]# ./configure && make && make install

4、snort的安裝

[[email protected] soft]# wget http://www.procyonlabs.com/mirrors/snort/snort-2.9.2.1.tar.gz

[[email protected] soft]# tar xf snort-2.9.2.1.tar.gz 
[[email protected] soft]# cd snort-2.9.2.1

[[email protected] snort-2.9.2.1]# ./configure --with-mysql=/usr/local/mysql --with-libpcap-includes=/usr/local/libpcap/include --with-libpcap-libraries=/usr/local/libpcap/lib

[[email protected] snort-2.9.2.1]# make

[[email protected] snort-2.9.2.1]# make install

三、snort的相關配置

[[email protected] snort-2.9.2.1]# mkdir /etc/snort  ------snort的主配置檔案目錄
[[email protected] snort-2.9.2.1]# mkdir /var/log/snort  -------------snort的日誌檔案目錄
[[email protected] snort-2.9.2.1]# groupadd snort  ---------建立snort使用者組
[[email protected] snort-2.9.2.1]# useradd -g snort -s /sbin/nologin  snort   ------------建立snort使用者

[[email protected] soft]# tar xf snortrules-snapshot-2920.tar.gz -C /etc/snort/
[[email protected] soft]# cd /etc/snort/
[[email protected] snort]# ls
etc  preproc_rules  rules  so_rules
[[email protected] snort]# cp etc/* /etc/snort/

[[email protected] snort]# chown snort.snort /var/log/snort----------修改相關目錄的屬主和屬組
[[email protected] snort]# touch /var/log/snort/alert
[[email protected] snort]# chown snort.snort /var/log/snort/alert 
[[email protected] snort]# chmod 600 /var/log/snort/alert ---------------防止其他使用者修改

[[email protected] snort]# mkdir /usr/local/lib/snort_dynamicrules
[[email protected] snort]# cp /etc/snort/so_rules/precompiled/RHEL-6-0/x86-64/2.9.2.0/*.so  /usr/local/lib/snort_dynamicrules/  -------------庫檔案

[[email protected] RHEL-6-0]# cp x86-64/2.9.2.0/*.so /usr/local/lib/snort_dynamicrules/

[[email protected] snort_dynamicrules]# vi /etc/snort/snort.conf#修改下面這幾行

var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules

output unified2: filename snort.log, limit 128

四、mysql資料庫的修改

[[email protected] snort_dynamicrules]# mysql   ------我這裡的資料暫時沒有密碼
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 470
Server version: 5.1.36-debug-log Source distribution

Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> create database snort;        --------------建立snort資料庫

mysql> grant all privileges on snort.* to [email protected]'localhost' with grant option ; -------------給snort使用者授權
Query OK, 0 rows affected (0.12 sec)


mysql> set password for [email protected] = password('aixocm');  --------這也是一種修改mysql使用者密碼的方式哦
Query OK, 0 rows affected (0.00 sec)


mysql> exit
Bye
[[email protected] snort_dynamicrules]# cd /soft/snort
snort-2.9.2.1/                   snortrules-snapshot-2920.tar.gz
snort-2.9.2.1.tar.gz             
[[email protected] snort_dynamicrules]# cd /soft/snort-2.9.2.1

[[email protected] snort-2.9.2.1]# cd schemas/
[[email protected] schemas]# ls
create_db2    create_mysql       create_postgresql  Makefile.am
create_mssql  create_oracle.sql  Makefile           Makefile.in
[[email protected] schemas]# mysql < create_mysql snort
[[email protected] schemas]# mysql
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 472
Server version: 5.1.36-debug-log Source distribution


Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.


Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.


Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.


mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| bbs                |
| itop               |
| mysql              |
| snort              |
| test               |
+--------------------+
6 rows in set (0.00 sec)


mysql> use snort；
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A


Database changed
mysql> show tables;
+------------------+
| Tables_in_snort  |
+------------------+
| data             |
| detail           |
| encoding         |
| event            |
| icmphdr          |
| iphdr            |
| opt              |
| reference        |
| reference_system |
| schema           |
| sensor           |
| sig_class        |
| sig_reference    |
| signature        |
| tcphdr           |
| udphdr           |
+------------------+
16 rows in set (0.00 sec)

五、base和adodb的安裝

[[email protected] lib]# wget http://sourceforge.net/projects/secureideas/files/BASE/base-1.4.5/base-1.4.5.tar.gz

[[email protected] lib]# tar xf base-1.4.5.tar.gz -C /var/www/-----------/var/www是apache的DocumentRoot

[[email protected] lib]# cd /var/www/
[[email protected] www]# mv base-1.4.5 base

[[email protected] www]# wget http://nchc.dl.sourceforge.net/project/adodb/adodb-php5-only/adodb-511-for-php5/adodb511.zip

[[email protected] www]# unzip adodb511.zip

[[email protected] www]# mv adodb5 adodb

[[email protected] www]# chown daemon.daemon /var/www/base -R

六、base的頁面安裝部分

瀏覽器訪問 http://127.0.0.1/base/setup/index.php

點選Continue

選擇簡體中文，下面輸入adodb的路徑/var/www/adodb 然後點選Continue

填入相關的mysql資訊，點選continue

設定管理賬號密碼，點選continue

點選create base AG

可以看到紅色部分表示成功，繼續下一步點選 Now continue tostep 5...

然後就可以看到我們的base介面了

七、頁面配置完成後，還需要安裝一下圖示的外掛，這個時候就要求php必須得支援gd了

如果想讓BASE起作用還得需要安裝一些外掛，必須聯網才能安裝

[[email protected] www]# pear install image_Canvas-alpha

WARNING: "pear/Image_Color" is deprecated in favor of "pear/Image_Color2"
downloading Image_Canvas-0.3.5.tgz ...
Starting to download Image_Canvas-0.3.5.tgz (54,486 bytes)
.............done: 54,486 bytes
downloading Image_Color-1.0.4.tgz ...
Starting to download Image_Color-1.0.4.tgz (9,501 bytes)
...done: 9,501 bytes
install ok: channel://pear.php.net/Image_Color-1.0.4
install ok: channel://pear.php.net/Image_Canvas-0.3.5

[[email protected] www]# pear install image_Graph-0.8.0

Did not download optional dependencies: pear/Numbers_Words, use --alldeps to download automatically
pear/Image_Graph can optionally use package "pear/Numbers_Words"
downloading Image_Graph-0.8.0.tgz ...
Starting to download Image_Graph-0.8.0.tgz (367,646 bytes)
...........................................................................done: 367,646 bytes
install ok: channel://pear.php.net/Image_Graph-0.8.0

[[email protected] www]# pear install Numbers_Roman
downloading Numbers_Roman-1.0.2.tgz ...
Starting to download Numbers_Roman-1.0.2.tgz (6,210 bytes)
.....done: 6,210 bytes
install ok: channel://pear.php.net/Numbers_Roman-1.0.2

八、測試snort

再次修改snort的配置檔案

[[email protected] lib]# vi /etc/snort/snort.conf

將 511 # output database: alert, <db_type>, user=<username> password=<password> test dbname=<name> host=<hostname>
    512 # output database: log, <db_type>, user=<username> password =<password> test dbname=<name> host=<hostname>

這地方一定要注意，如果你跟我使用的是一樣的版本，請你務必按照我的格式改，改版本存有bug，每一項後面都要加","而且之間不能有空格！要不然會報

Error: 

Fatal Error, Quitting..

改為

514  output database: alert, mysql, user=snort ,password=123456,dbname=snort, host=localhost    

515  output database: log, mysql, user=snort,password=123456,dbname=snort, host=localhost

將 110 var WHITE_LIST_PATH /etc/snort/rules
    111 var BLACK_LIST_PATH /etc/snort/rules

    488    whitelist $WHITE_LIST_PATH/white_list.rules, \
    489    blacklist $BLACK_LIST_PATH/black_list.rules

這四行註釋掉，即在每行前面加#

將下面三行的# 去掉

接下來就是測試snort

[[email protected] snort]# snort -c /etc/snort/snort.conf

如果你可以看到這隻小豬，那麼就證明你成功了，呵呵

在這一步完成後，snort不會自己退出，需要使用ctrl+c自己終止退出。

再次開啟瀏覽器http://127.0.0.1/base/base_main.php

我這裡已經檢測到資料了，但是資料不夠，接下來我們需要更多的測試。

九、入侵測試

我推薦使用windows下的一個掃描工具X-way

點選確定

掃描完成後，再次開啟頁面http://127.0.0.1/base/base_main.php

滑鼠點選，我圈中的那個100%檢視詳細的入侵記錄