Intrusion Detection using Snort - Revision history

Sertonix: replace /etc/init.d with rc-service

2023-11-17T10:41:57Z

replace /etc/init.d with rc-service

← Older revision		Revision as of 10:41, 17 November 2023
Line 81:		Line 81:
	{{Cmd\|<nowiki>/usr/bin/mysql_install_db --user=mysql		{{Cmd\|<nowiki>/usr/bin/mysql_install_db --user=mysql
	rc-update add mysql		rc-update add mysql
	~~/etc/init.d/~~mysql start		rc-service mysql start
	/usr/bin/mysqladmin -u root password 'password' (set password to the same password you specified in the snort.conf file)		/usr/bin/mysqladmin -u root password 'password' (set password to the same password you specified in the snort.conf file)
	mysql -u root -p</nowiki>}}		mysql -u root -p</nowiki>}}

Zcrayfish: /* Download Non-Packaged Applications */ Rescued dead link.

2023-09-03T21:18:19Z

Download Non-Packaged Applications: Rescued dead link.

← Older revision		Revision as of 21:18, 3 September 2023
Line 25:		Line 25:

	:Download snort from www.snort.org. We used version 2.8.6.1 in this document.		:Download snort from www.snort.org. We used version 2.8.6.1 in this document.
	:Download the snort rules from https://www.snort.org/~~snort~~-~~rules/{{dead link}}~~		:Download the snort rules from https://www.snort.org/downloads/#rule-downloads
	:Download BASE from https://sourceforge.net/projects/secureideas/files/BASE/base-1.4.5/base-1.4.5.tar.gz/download		:Download BASE from https://sourceforge.net/projects/secureideas/files/BASE/base-1.4.5/base-1.4.5.tar.gz/download
	:Download adodb5 from https://sourceforge.net/projects/adodb/files/adodb-php5-only/adodb-511-for-php5/adodb511.zip/download		:Download adodb5 from https://sourceforge.net/projects/adodb/files/adodb-php5-only/adodb-511-for-php5/adodb511.zip/download

Zcrayfish: Marked a dead link.

2023-08-25T03:40:51Z

Marked a dead link.

← Older revision		Revision as of 03:40, 25 August 2023
Line 25:		Line 25:

	:Download snort from www.snort.org. We used version 2.8.6.1 in this document.		:Download snort from www.snort.org. We used version 2.8.6.1 in this document.
	:Download the snort rules from https://www.snort.org/snort-rules/		:Download the snort rules from https://www.snort.org/snort-rules/{{dead link}}
	:Download BASE from https://sourceforge.net/projects/secureideas/files/BASE/base-1.4.5/base-1.4.5.tar.gz/download		:Download BASE from https://sourceforge.net/projects/secureideas/files/BASE/base-1.4.5/base-1.4.5.tar.gz/download
	:Download adodb5 from https://sourceforge.net/projects/adodb/files/adodb-php5-only/adodb-511-for-php5/adodb511.zip/download		:Download adodb5 from https://sourceforge.net/projects/adodb/files/adodb-php5-only/adodb-511-for-php5/adodb511.zip/download

Sertonix: use https links

2023-08-25T03:03:54Z

use https links

← Older revision		Revision as of 03:03, 25 August 2023
Line 25:		Line 25:

	:Download snort from www.snort.org. We used version 2.8.6.1 in this document.		:Download snort from www.snort.org. We used version 2.8.6.1 in this document.
	:Download the snort rules from ~~http~~://www.snort.org/snort-rules/		:Download the snort rules from https://www.snort.org/snort-rules/
	:Download BASE from ~~http~~://sourceforge.net/projects/secureideas/files/BASE/base-1.4.5/base-1.4.5.tar.gz/download		:Download BASE from https://sourceforge.net/projects/secureideas/files/BASE/base-1.4.5/base-1.4.5.tar.gz/download
	:Download adodb5 from ~~http~~://sourceforge.net/projects/adodb/files/adodb-php5-only/adodb-511-for-php5/adodb511.zip/download		:Download adodb5 from https://sourceforge.net/projects/adodb/files/adodb-php5-only/adodb-511-for-php5/adodb511.zip/download

	== Compile Snort ==		== Compile Snort ==

Zcrayfish: /* Setup BASE */ Removed hyperlink to a hypothetical URL.

2021-12-20T22:24:00Z

Setup BASE: Removed hyperlink to a hypothetical URL.

← Older revision		Revision as of 22:24, 20 December 2021
Line 118:		Line 118:
	mv /usr/src/base-1.4.5/* /var/www/localhost/htdocs/.}}		mv /usr/src/base-1.4.5/* /var/www/localhost/htdocs/.}}

	Now, open your web browser and navigate to http://X.X.X.X/setup (where x.x.x.x is your server's IP address)		Now, open your web browser and navigate to <nowiki>http://X.X.X.X/setup</nowiki> (where x.x.x.x is your server's IP address)

	:Click continue on the first page.		:Click continue on the first page.

Alpineuser: Undo revision 20519 by Guest09248 (talk)

2021-12-08T06:14:30Z

Undo revision 20519 by Guest09248 (talk)

Show changes

Guest09248: Replaced content with "{{Draft|Last update before this one is 2013 so this page is probably outdated}}"

2021-12-07T16:47:36Z

Replaced content with "{{Draft|Last update before this one is 2013 so this page is probably outdated}}"

Show changes

Fab: /* Start and Setup MySQL */

2013-01-10T15:18:38Z

Start and Setup MySQL

← Older revision		Revision as of 15:18, 10 January 2013
Line 79:		Line 79:
	(Need to add detail here on starting up MySQL for the first time)		(Need to add detail here on starting up MySQL for the first time)

	{{Cmd\|/usr/bin/mysql_install_db --user=mysql		{{Cmd\|<nowiki>/usr/bin/mysql_install_db --user=mysql
	rc-update add mysql		rc-update add mysql
	/etc/init.d/mysql start		/etc/init.d/mysql start
	/usr/bin/mysqladmin -u root password 'password' (set password to the same password you specified in the snort.conf file)		/usr/bin/mysqladmin -u root password 'password' (set password to the same password you specified in the snort.conf file)
	mysql -u root -p}}		mysql -u root -p</nowiki>}}

	Once in mysql, type the following commands:		Once in mysql, type the following commands:

Fab: minor layout changes

2013-01-10T15:17:29Z

minor layout changes

← Older revision		Revision as of 15:17, 10 January 2013
Line 16:		Line 16:
	'''Install Alpine and Pre-packaged components'''		'''Install Alpine and Pre-packaged components'''

	apk add alpine-sdk mysql-dev php-mysql lighttpd php-xml php-pear libpcap-dev php-gd pcre-dev wireshark tcpdump tcpflow cvs bison flex		{{Cmd\|apk add alpine-sdk mysql-dev php-mysql lighttpd php-xml php-pear libpcap-dev php-gd pcre-dev wireshark tcpdump tcpflow cvs bison flex}}


	== Download Non-Packaged Applications ==		== Download Non-Packaged Applications ==
Line 34:		Line 33:
	Uncompress snort with something like:		Uncompress snort with something like:

	tar -zxvf snort-2.8.6.1.tar.gz		{{Cmd\|tar -zxvf snort-2.8.6.1.tar.gz}}

	Then do the following:		Then do the following:

	cd snort-2.8.6.1		{{Cmd\|cd snort-2.8.6.1
	./configure -enable-dynamicplugin --with-mysql		./configure -enable-dynamicplugin --with-mysql
	make		make
	make install		make install}}

	== Configure Snort and Ruleset ==		== Configure Snort and Ruleset ==

	mkdir /etc/snort		{{Cmd\|mkdir /etc/snort
	cd /etc/snort		cd /etc/snort
	cp /usr/src/snort-2.8.6.1/etc/* .		cp /usr/src/snort-2.8.6.1/etc/* .
	mv /usr/src/snortrules-snapshot-2861.tar.gz /etc/snort/.		mv /usr/src/snortrules-snapshot-2861.tar.gz /etc/snort/.
	tar -zxvf /usr/src/snortrules-snapshot-2861.tar.gz		tar -zxvf /usr/src/snortrules-snapshot-2861.tar.gz}}

	Now edit the snort.conf file:		Now edit the snort.conf file:

	vi snort.conf		{{Cmd\|vi snort.conf}}

	and change the following:		and change the following:
Line 80:		Line 79:
	(Need to add detail here on starting up MySQL for the first time)		(Need to add detail here on starting up MySQL for the first time)

	/usr/bin/mysql_install_db --user=mysql		{{Cmd\|/usr/bin/mysql_install_db --user=mysql
	rc-update add mysql		rc-update add mysql
	/etc/init.d/mysql start		/etc/init.d/mysql start
	/usr/bin/mysqladmin -u root password 'password' (set password to the same password you specified in the snort.conf file)		/usr/bin/mysqladmin -u root password 'password' (set password to the same password you specified in the snort.conf file)
	mysql -u root -p		mysql -u root -p}}

	Once in mysql, type the following commands:		Once in mysql, type the following commands:

	mysql> create database snort;		{{Cmd\|mysql> create database snort;
	mysql> exit		mysql> exit}}

	Now create the database schema:		Now create the database schema:

	mysql -D snort -u root -p < /usr/src/snort-2.8.6.1/schemas/create_mysql		{{Cmd\|mysql -D snort -u root -p < /usr/src/snort-2.8.6.1/schemas/create_mysql}}

	== Configure PHP and PEAR ==		== Configure PHP and PEAR ==
Line 99:		Line 98:
	Edit /etc/php/php.ini and add the following under "Dynamic Extensions".		Edit /etc/php/php.ini and add the following under "Dynamic Extensions".

	extension=mysql.so		extension=mysql.so
	extension=gd.so		extension=gd.so

	Save and exit. From the command line, type the following:		Save and exit. From the command line, type the following:

	pear install Image_Color		{{Cmd\|pear install Image_Color
	pear install Image_Canvas-alpha		pear install Image_Canvas-alpha
	pear install Image_Graph-alpha		pear install Image_Graph-alpha
	pear install mail		pear install mail
	pear install mail_mime		pear install mail_mime}}

	== Start Apache or lighttpd ==		== Start Apache or lighttpd ==
Line 116:		Line 115:
	== Setup BASE ==		== Setup BASE ==

	mv /usr/src/adodb5 /var/www/localhost/htdocs/.		^{{Cmd\|mv /usr/src/adodb5 /var/www/localhost/htdocs/.
	mv /usr/src/base-1.4.5/* /var/www/localhost/htdocs/.		mv /usr/src/base-1.4.5/* /var/www/localhost/htdocs/.}}

	Now, open your web browser and navigate to http://X.X.X.X/setup (where x.x.x.x is your server's IP address)		Now, open your web browser and navigate to http://X.X.X.X/setup (where x.x.x.x is your server's IP address)
Line 130:		Line 129:
	:Step 5 of 5: one step 4 is done at the bottom click on Now continue to step 5.		:Step 5 of 5: one step 4 is done at the bottom click on Now continue to step 5.
	:Copy the text on the screen, and then paste into a new file named /var/www/localhost/htdocs/base_conf.php. Save that file.		:Copy the text on the screen, and then paste into a new file named /var/www/localhost/htdocs/base_conf.php. Save that file.


	== Configure Barnyard ==		== Configure Barnyard ==

Dubiousjim: add Category:Security

2012-06-01T13:08:37Z

add Category:Security

← Older revision		Revision as of 13:08, 1 June 2012
Line 140:		Line 140:
	[[Category:PHP]]		[[Category:PHP]]
	[[Category:SQL]]		[[Category:SQL]]
			[[Category:Security]]