Hệ thống phát hiện và ngăn chặn xâm nhập

 apt-get update

apt-get -y install build-essential libpcap0.8-dev libmysqlclient15-dev mysql-client-5.1 mysql-server-5.1 bison flex apache2 libapache2-mod-php5 php5-gd php5-mysql libphp-adodb php-pear libc6-dev g++ gcc pcregrep libpcre3-dev

apt-get install uuid-dev libmagic-dev libmemcached-dev  libssl-dev  libssl-dev  libconfig8-dev libpcre3-dev libmysqlclient-dev make libtool  autoconf  automake  libcurl4-openssl-dev  libcli-dev  libjson0-dev

cd /home/admin/
wget hxxp://libdnet.googlecode.com/files/libdnet-1.12.tgz
 tar –zxvf  libdnet-1.12.tgz
cd  libdnet-1.12
./configure
make
make install
ldconfig
ln -s /usr/local/lib/libdnet.1 /usr/lib/libdnet.1

tar  -zxvf  snort-2.9.1.2.tar.gz

tar -xvzf daq-0.6.2.tar.gz
cd daq-0.6.2
./configure
make
make install

tar -zxvf snortsam-src-2.70.tar.gz
cd snortsam
chmod +x makesnortsam.sh
./makesnortsam.sh

cp snortsam /usr/bin/

gunzip  -d snortsam-2.9.1.2.diff.gz

cd  /home/admin/snort-2.9.1.2
patch -p1 < /home/admin/snortsam-2.9.1.2.diff
chmod +x autojunk.sh
./autojunk.sh
libtoolize --automake --copy
aclocal -I m4
autoheader
automake --add-missing --copy
autoconf
./configure -enable-dynamicplugin --with-mysql
make
make  install

mysql -u root –p
create database snort;
create database snort_archive; 
use snort;
grant all privileges on snort.* to 'snort'@'localhost' identified by '123456’;
grant all privileges on snort.* to 'root'@'localhost' identified by '123456';
use snort_archive;
grant all privileges on snort_archive.* to 'snort'@'localhost' identified by ‘123456';
exit
mysql -D snort -u snort -p < /home/admin/snort-2.9.1.2/schemas/create_mysql
mysql -D snort_archive -u snort -p < /home/admin/snort-2.9.1.2/schemas/create_mysql

​adduser snortchsh snort
Login Shell [/bin/bash]: /bin/true
passwd snort -l

mkdir -p /etc/snort/rules /var/log/snort
sudo chown -R root.snort /var/log/snort
sudo chmod -R 770 /var/log/snort
 
tar  -xvzf /home/admin/snortrules-snapshot-2912.tar.gz -C /etc/snort

vim /etc/snort/etc/snort.conf

#dynamicdetection directory /usr/local/lib/snort_dynamicrules
#var RULE_PATH ../rules
#var SO_RULE_PATH ../so_rules
#var PREPROC_RULE_PATH ../preproc_rules
var RULE_PATH /etc/snort/rules 
var SO_RULE_PATH /etc/snort/so_rules 
var PREPROC_RULE_PATH /etc/snort/preproc_rules
#preprocessor reputation: \
#   memcap 500, \
#   priority whitelist, \
#   nested_ip inner, \
#   whitelist $WHITE_LIST_PATH/white_list.rules, \
#   blacklist $BLACK_LIST_PATH/black_list.rules
# dynamic library rules
 include $SO_RULE_PATH/bad-traffic.rules
 include $SO_RULE_PATH/chat.rules
 include $SO_RULE_PATH/dos.rules
 include $SO_RULE_PATH/exploit.rules
 include $SO_RULE_PATH/icmp.rules
 include $SO_RULE_PATH/imap.rules
 include $SO_RULE_PATH/misc.rules
 include $SO_RULE_PATH/multimedia.rules
 include $SO_RULE_PATH/netbios.rules
 include $SO_RULE_PATH/nntp.rules
 include $SO_RULE_PATH/p2p.rules
 include $SO_RULE_PATH/smtp.rules
 include $SO_RULE_PATH/snmp.rules
 include $SO_RULE_PATH/specific-threats.rules
 include $SO_RULE_PATH/web-activex.rules
 include $SO_RULE_PATH/web-client.rules
 include $SO_RULE_PATH/web-iis.rules
 include $SO_RULE_PATH/web-misc.rules
 output database: log, mysql, user=snort password=123456 dbname=snort host=localhost

snort -c /etc/snort/etc/snort.conf

tar -zxvf base-1.4.5.tar.gz
mv base-1.4.5 /var/www/base
pear install Image_Color Image_Canvas-alpha Image_Graph-alpha
chown www-data /var/www/base
chmod 755 /var/www/base

vim /etc/php5/apache2/php.ini
sửa :error_reporting = E_ALL & ~E_NOTICE

vim /var/www/base/base_conf.php.dist

thay đổi:
$DBLib_path = '/usr/share/php/adodb';
$BASE_urlpath = '/base';
    $alert_dbname   = 'snort';
    $alert_host     = 'localhost';
    $alert_port     = '';
    $alert_user     = 'snort';
    $alert_password = '123456';
 
    /* Archive DB connection parameters */
    $archive_exists   = '1'; # Set this to 1 if you have an archive DB
    $archive_dbname   = 'snort_archive';
    $archive_host     = 'localhost';
    $archive_port     = '';
$archive_user = 'snort_archive';
    $archive_password = '123456';
 
cp /var/www/base/base_conf.php.dist /var/www/base/base_conf.php
chown www-data:www-data /var/www/base
chown -R www-data:www-data /var/www/base/*

mysqldump -u root -p snort > snort.db
mysql -u root -p snort_archive < snort.db
mysql -u root –p
use snort_archive;
grant all privileges on snort_archive.* to 'snort'@'localhost' identified by '123456’;

http://ip-address/base

cp snortsam/conf/snortsam.conf.sample /etc/snort/snortsam.conf
mkdir  /var/db
chmod 777  /var/db

vim  /etc/snort/snortsam.conf

​defaultkey 123456
accept localhost
iptables eth0 log
iptables -I FORWARD -i eth0 -s {ip_addr_to_be_blocked} -j REJECT
iptables -D FORWARD -i eth0 -s {ip_addr_to_be_unblocked} -j REJECT

vim /etc/snort/etc/snort.conf

output alert_fwsam: localhost:898/123456​

snort -u snort -g snort -c /etc/snort/etc/snort.conf -i eth0 ~
snortsam /etc/snortsam/snortsam.conf ~

alert tcp 10.2.51.121 any -> any 80 ( msg: "Test Rule: -----ICMP packet detected!"; sid: 10009; uricontent:"index.htm";uricontent:"index2.htm"; uricontent:"index3.htm"; flow:to_server,established ; threshold:type threshold, track by_src, count 20, seconds 3600; fwsam: src, 1 minutes;)

fwsam: src, 1 minutes; ==>chặn IP tấn công là 1 phút