Snort的配置与使用

实验1：Snort的配置与使用1实验目的和要求学习Snort的配置与使用，要求：1）掌握Snort入侵检测环境的搭建；2）掌握Snort的配置与使用；3）熟悉Snort的工作原理。2实验设备及材料1）系统环境：WindowsXP/Windows20032）软件安装：JDK：jdk-6u17-windows-i586.exe（可选）TOMCAT：apache-tomcat-5.5.30.exe（可选）MySQL：mysql-5.5.15-win32.msiWinPcap：WinPcap_4_1_2.exeSnort：Snort_2_9_1_Installer.exeIDSCenter：idscenter109b21.zip3实验内容3.1软件安装与配置3.1.1JDK安装与配置软件版本：jdk-6u17-windows-i586.exe双击jdk-6u17-windows-i586.exe安装JDK，安装完后设置环境变量：变量名变量值java_homeC:\ProgramFiles\Java\jdk1.6.0_17classpathC:\ProgramFiles\Java\jdk1.6.0_17\jre\libpathC:\ProgramFiles\Java\jdk1.6.0_17\binjava–version//查看软件版本信息，确定软件是否安装成功3.1.2Tomcat安装与配置软件版本：apache-tomcat-5.5.30.exe、apache-tomcat-5.5.30-admin.zip1）安装apache-tomcat-5.5.30.exe安装过程中会要求指定JRE的安装目录，确定端口，用户名和密码（用于可视化配置界面登录）。启动Tomcat：验证安装是否成功：://127.0.0.1:8088/2）安装pache-tomcat-5.5.30-admin.zip首先解压apache-tomcat-5.5.30-admin.zip，用解压后的文件替换以下tomcat文件。i)将\apache-tomcat-5.5.30\conf\Catalina\localhost\admin.xml的admin.xml文件拷贝到c:\ProgramFiles\ApacheSoftwareFoundation\Tomcat5.5\conf\Catalina\localhost.的文件夹中。注意一定要放在正确的路径的文件夹中。ii)将\apache-tomcat-5.5.30\server\webapps中的admin整个文件夹拷贝到c:\ProgramFiles\ApacheSoftwareFoundation\Tomcat5.5\server\webapps文件夹中。然后重启tomcat，在浏览器中输入：得到：用户名和密码就是前面安装Tomcat时设置的。3.1.3MySQL安装与配置软件版本：mysql-5.5.15-win32.msi1）安装MySQL这一步设置root用户的密码，假设为123。2）配置MySQL步骤1：启动MySQL命令行输入：netstartmysql;mysql–hlocalhost–uroot–p输入安装MySQL时设置的密码123步骤2：利用以下语句在MySQL中建立Snort运行必须的Snort库和库（注意命令后的“;”）：·mysqlcreatedatabasesnort;·mysqlcreatedatabasesnort_archive;步骤3：利用以下语句为MySQL建立Snort账号，使IDSCenter能正常访问MySQL中与Snort·mysqlgrantusageon*.*to“snort”@”localhost”identifiedby“snorttest”;利用以下语句为Snort·mysqlsetpasswordfor“snort”@”localhost”=password(‘123’);-’root’@’localhost’=OLD_PASSWORD(‘123’);步骤4：利用以下语句为Snort用户分配相关权限：·mysqlgrantselect,insert,update,delete,create,alteronsnort.*to”snort”@”localhost”;·mysqlgrantselect,insert,update,delete,create,alteronsnort_archive.*to”snort@”localhost”;最后使用以下命令，使上面对密码和特权的修改生效：·mysqlflushprivileges;步骤5：然后查看MySQL中的数据库，确定建立了Snort和Snort_archive数据库，使用的命令如下·mysqlshowdatabases;步骤6：在确定数据库存在后，利用以下语句，使用c:\snort\contrib目录下的create_mysql脚本（注：部分版本的snort，create_mysql脚本在C:\Snort\schemas目录下）分别在新建的两个库中建立Snort运行必须的数据表：·mysqlusesnort;·mysqlsourcec:\snort\schemas\create_mysql·mysqlusesnort_archive;·mysqlsourcec:\snort\schemas\create_mysql（或是在“运行”窗口中输入如下命令，使用create_mysql·c:\mysql\bin\mysql-Dsnort-uroot-pc:\snort\contrib\create_mysql;·c:\mysql\bin\mysql-Dsnort_archive-uroot-pc:\snort\contrib\create_mysql）;步骤7：查看数据库中的表是否存在·mysqlusesnort;·mysqlshowtables;·mysqlusesnort_archive;·mysqlshowtables;·mysql\q;3.1.4WinPcap安装与配置软件版本：WinPcap_4_1_2.exe3.1.5Snort安装与配置软件版本：Snort_2_9_1_Installer.exe1）安装snort2）配置snorti）安装Snort后，将snortrules-snapshot-2905.zip解压后复制到Snort安装目录中，例如：c:\Snortii）添加c:\snort\bin到系统环境变量PATHiii）配置snort.conf文件（c:\Snort\etc\snort.conf）OriginalLine(s):ipvarHOME_NETanyChangeto:ipvarHOME_NET192.168.1.0/24OriginalLine(s):varRULE_PATH../rulesChangeto:varRULE_PATHc:\snort\rulesOriginalLine(s):varSO_RULE_PATH../so_rulesChangeto:varSO_RULE_PATHc:\snort\so_rulesOriginalLine(s):varPREPROC_RULE_PATH../preproc_rulesChangeto:varPREPROC_RULE_PATHc:\snort\preproc_rulesOriginalLine(s):dynamicpreprocessordirectory/usr/local/lib/snort_dynamicpreprocessor/Changeto:dynamicpreprocessordirectoryc:\snort\lib\snort_dynamicpreprocessorOriginalLine(s):dynamicengine/usr/local/lib/snort_dynamicengine/libsf_engine.soChangeto:dynamicenginec:\snort\lib\snort_dynamicengine\sf_engine.dllOriginalLine(s):dynamicdetectiondirectory/usr/local/lib/snort_dynamicrulesChangeto:#dynamicdetectiondirectory/usr/local/lib/snort_dynamicrulesOriginalLine(s):preprocessornormalize_ip4preprocessornormalize_tcp:ipsecnstreampreprocessornormalize_icmp4preprocessornormalize_ip6preprocessornormalize_icmp6Changeto:#preprocessornormalize_ip4#preprocessornormalize_tcp:ipsecnstream#preprocessornormalize_icmp4#preprocessornormalize_ip6#preprocessornormalize_icmp6OriginalLine(s):preprocessorhttp_inspect:globaliis_unicode_mapunicode.map1252compress_depth20480decompress_depth20480Changeto:preprocessorhttp_inspect:globaliis_unicode_mapunicode.map1252compress_depth65535decompress_depth65535OriginalLine(s):#preprocessorsfportscan:proto{all}memcap{10000000}sense_level{low}Changeto:preprocessorsfportscan:proto{all}memcap{10000000}sense_level{low}logfile{portscan.log}preprocessorfrag3_engine:policywindowsdetect_anomaliesoverlap_limit改成：preprocessorfrag3_engine:policywindowsdetect_anomaliesoverlap_limit10min_fragment_length100timeout180outputalert_fast:alert.idsOriginalLine(s):#outputdatabase:log,db_type,user=usernamepassword=passwordtestdbname=namehost=hostnameChangeto:outputdatabase:log,mysql,user=snortpassword=l0gg3rdbname=snorthost=winidssensor_name=WinIDSOriginalLine(s):includeclassification.configChangeto:includec:\snort\etc\classification.configOriginalLine(s):includereference.configChangeto:includec:\snort\etc\reference.configOriginalLine(s):#include$PREPROC_RULE_PATH/preprocessor.rules#include$PREPROC_RULE_