Centos下安装snort

云中漫步

Centos下安装snort

注：最近因需要安装入侵检测系统，上网找了下文档，大致相同，甚至不全，个人整理了下，有不足之处敬请谅解。保存仅为留个备份。

一．安装所需软件包

1.安装libpcap与libpcap-devel
yum -y install libpcap*
2.安装libpcre
yum -y install pcre*
3.安装libdnet
wget http://pkgs.repoforge.org/libdnet/libdnet-1.11-1.1.el3.rf.x86_64.rpm   
wget http://pkgs.repoforge.org/libdnet/libdnet-devel-1.11-1.1.el3.rf.x86_64.rpm
rpm -ilibdnet-1.11-1.1.el3.rf.x86_64.rpm
rpm -ilibdnet-devel-1.11-1.1.el3.rf.x86_64.rpm
　　二．安装snort
cd /usr/local/src
tar -zxvf libdnet-1.11.tar.gz
cd liddnet-1.11
./configure –eith-pic
make && makeinstall
cd /usr/local/lib
ldconifg –v /usr/local/lib

tar -zxvf daq-2.0.6.tar.gz
cd daq-2.0.6
./configure
make && makeinstall
cd /usr/local/lib
ldconfig –v /usr/local/lib

tar -zxvf snort-2.9.8.tar.gz
cd snort-2.9.8
./configure –enable-sourcefire
make && make install
cd /usr/local/lib
　　ldconfig –v /usr/local/lib
　　安装规则
　　mkdir-p /etc/snort
　　mkdir/etc/snort/rules
　　cd/opt
　　tar-zvxf community.tar.gz -C /etc/snort/rules
　　tar-zxvf snortrules-snapshot-2966.tar.gz -C /etc/snort/rules
　　修改权限
　　cd/etc/snort
　　chown-R snort:snort *
　　添加snort用户
　　groupadd-g 40000 snort
　　useraddsnort -u 40000 -d /var/log/snort -s /sbin/nologin -c SNORT_IDS –g snort
　　cd/etc/snort
　　chown-R snort:snort *
　　chown-R snort:snort /var/log/snort
　　
　　修改配置文件
　　cd/etc/snort
　　cpsnort.conf snort.conf_bak
　　visnort.conf
　　varRULE_PATH /etc/snort/rules
　　ipvarHOME_NET any #or set to a network such as 172.21.0.0/16
　　ipvarEXTERNAL_NET !$HOME_NET
　　varSO_RULE_PATH /etc/snort/rules/so_rules
　　varPREPROC_RULE_PATH /etc/snort/rules/preproc_rules
　　varWHITE_LIST_PATH /etc/snort/rules
　　varBLACK_LIST_PATH /etc/snort/rules
　　修改snort daq的权限
　　cd/usr/local/src
　　chown-R snort.snort daq-2.0.6
　　chown-R snort.snort snort-2.9.8
　　chown-R snort.snort snort_dynamicsrc
　　添加/etc/init.d/snort
　　
　　注：snort脚本下载
　　.http://s3.amazonaws.com/snort-org/www/assets/208/snort-centos-6x.sh
　　添加snort快捷方式
　　cd/usr/sbin
　　ln-s /usr/local/bin/snort snort
　　添加/etc/sysconfig/snort

#### General Configuration

INTERFACE=eth0

CONF=/etc/snort/snort.conf

USER=snort

GROUP=snort

PASS_FIRST=0

#### Logging & Alerting

LOGDIR=/var/log/snort

ALERTMODE=fast

DUMP_APP=1

BINARY_LOG=1

NO_PACKET_LOG=0

PRINT_INTERFACE=

　　注：网卡名称根据实际需求改
　　
　　
　　
　　
　　
　　参考文档：
　　http://wiki.aanval.com/wiki/Community:Snort_2.9.4.X_Installation_Guide_for_CentOS_6.3