snort安装软件列表:
zlib-1.2.3.tar.gz (zlib-1.2.3-3.i386.rpm)
libpcap-1.0.0.tar.gz (libpcap-0.9.4-14.el5.i386.rpm)
libxml2-2.6.19.tar.gz (libxml2-2.6.26-2.1.2.8.i386.rpm)
libpng-1.2.40.tar.gz (libpng-1.2.10-7.1.el5_3.2.i386.rpm)
gd-2.0.33.tar.gz (gd-2.0.33-9.4.el5_1.1.i386.rpm)
mysql-5.0.22.tar.gz
DBD-mysql-3.0008.tar.gz
httpd-2.2.14.tar.gz
php-5.2.13.tar.gz
pcre-8.00.tar.gz (pcre-6.6-2.el5_1.7.i386.rpm)
snort-2.8.3.1.tar.gz
snortrules-snapshot-2.8.tar.gz
snortrules-snapshot-CURRENT.tar.gz
jpgraph-3.0.6.tar.bz2
adodb498.tgz
acid-0.9.6b23.tar.gz
 

1、需要准备的系统包如下(在RHEL5.4的光盘中都能找到)

1)zlib

RHEL5.4 snort+mysql+php+acid 安装笔记 

2)libpcap

RHEL5.4 snort+mysql+php+acid 安装笔记 

3)libxml2

RHEL5.4 snort+mysql+php+acid 安装笔记 

4)libpng

RHEL5.4 snort+mysql+php+acid 安装笔记 

5)gd

RHEL5.4 snort+mysql+php+acid 安装笔记 

6)perl-DBI

 RHEL5.4 snort+mysql+php+acid 安装笔记

 

2、所有的tar包我都拷贝到了/usr/local/src这个目录下:

 

RHEL5.4 snort+mysql+php+acid 安装笔记 
 
3、安装MYSQL
 
1)解压mysql
[[email protected] src]# tar zxf mysql-5.0.56.tar.gz
2)进入目录mysql-5.0.56
[[email protected] src]# cd mysql-5.0.56
3)增加mysql组群
[[email protected] mysql-5.0.56]# groupadd mysql
4)增加mysql用户
[[email protected] mysql-5.0.56]# useradd -g mysql mysql
5)进行编译前准备,指定安装目录为/us/local/mysql
[[email protected] mysql-5.0.56]# ./configure --prefix=/usr/local/mysql
完成后如下图所示:
RHEL5.4 snort+mysql+php+acid 安装笔记 
6)执行make
[[email protected] mysql-5.0.56]# make
完成后如下图所示:(时间比较长,耐心等待)
RHEL5.4 snort+mysql+php+acid 安装笔记 
7)执行make install
[[email protected] mysql-5.0.56]# make install
完成后如下图所示:
RHEL5.4 snort+mysql+php+acid 安装笔记 
8)初始化数据库
[[email protected] mysql-5.0.56]# cd /usr/local/mysql/
[[email protected] mysql]# /usr/local/mysql/bin/mysql_install_db --user=mysql
RHEL5.4 snort+mysql+php+acid 安装笔记 
9)改变目录权限
RHEL5.4 snort+mysql+php+acid 安装笔记 
[[email protected] mysql]# chmod -R root .
[[email protected] mysql]# chown -R mysql var
[[email protected] mysql]# chgrp -R mysql .
RHEL5.4 snort+mysql+php+acid 安装笔记 
10)后台运行MYSQL
[[email protected] mysql]# /usr/local/mysql/bin/mysqld_safe --user=mysql &
RHEL5.4 snort+mysql+php+acid 安装笔记 
11)修改ld.so.conf文件
[[email protected] mysql]# vi /etc/ld.so.conf
在文件中加入两行:
/usr/local/mysql/lib/mysql
/usr/local/lib
RHEL5.4 snort+mysql+php+acid 安装笔记
[[email protected] mysql]# ldconfig
 
4、安装DBD-mysql
 
[[email protected] src]# tar zxf DBD-mysql-3.0002.tar.gz
[[email protected] src]# cd DBD-mysql-3.0002
[[email protected] DBD-mysql-3.0002]# export LANG=C
[[email protected] DBD-mysql-3.0002]# perl Makefile.PL \
> --libs="-L/usr/local/mysql/lib/mysql -lmysqlclient -lz" \
> --cflags=-I/usr/local/mysql/include/mysql \
> --testhost=127.0.0.1 \
> --mysql_config=/usr/local/mysql/bin/mysql_config
RHEL5.4 snort+mysql+php+acid 安装笔记

[[email protected] DBD-mysql-3.0002]# make

RHEL5.4 snort+mysql+php+acid 安装笔记 

[[email protected] DBD-mysql-3.0002]# make install

RHEL5.4 snort+mysql+php+acid 安装笔记 

 

5、安装snort

 

[[email protected] DBD-mysql-3.0002]# cd /usr/local/src

[[email protected] src]# tar zxf snort-2.8.4.1.tar.gz

[[email protected] src]# cd snort-2.8.4.1

1)  Snort调用mysql

[[email protected] snort-2.8.4.1]# ./configure --with-mysql=/usr/local/mysql

RHEL5.4 snort+mysql+php+acid 安装笔记

1)  执行make

[[email protected] snort-2.8.4.1]#make

 

2)  执行make install

 [[email protected] snort-2.8.4.1]#make instalRHEL5.4 snort+mysql+php+acid 安装笔记

4)创建配置文件目录

[[email protected] snort-2.8.4.1]# mkdir /etc/snort

5)日志目录

[[email protected] snort-2.8.4.1]# mkdir /var/log/snort

6)安装snort规则

[[email protected] src]# tar zxf snortrules-snapshot-2860.tar.gz

[[email protected] src]# tar zxf snortrules-snapshot-CURRENT.tar.gz

[[email protected] src]# mv rules/ /etc/snort

[[email protected] etc]# cp * /etc/snort/

[[email protected] etc]# ll /etc/snort

RHEL5.4 snort+mysql+php+acid 安装笔记 

7)修改/etc/snort/snort.conf文件

监听的本地网段

RHEL5.4 snort+mysql+php+acid 安装笔记 

Rules的路径

RHEL5.4 snort+mysql+php+acid 安装笔记 

修改用户,密码,以及主机名,还有就是把前面的#号去掉

RHEL5.4 snort+mysql+php+acid 安装笔记 

保存退出

8)创建snort数据库

##赋予root用户远程密码123

##root用户远程登录mysql,输入密码(111111)

[[email protected] /]# /usr/local/mysql/bin/mysqladmin -u root password 111111

[[email protected] /]# /usr/local/mysql/bin/mysql -u root –p

 

mysql> SET PASSWORD FOR [email protected]=PASSWORD('111111');

mysql> create database snort;

mysql> connect snort;

mysql> source /usr/local/src/snort-2.8.4.1/schemas/create_mysql;

 

RHEL5.4 snort+mysql+php+acid 安装笔记

mysql>show tables;

 

执行下列命令:

mysql>grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort;

Query OK, 0 rows affected (0.00 sec)

mysql>grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to [email protected];

Query OK, 0 rows affected (0.00 sec)

mysql> flush privileges; ##刷新

Query OK, 0 rows affected (0.01 sec)

 

退出数据库,启动snort

[[email protected] ~]# snort -c /etc/snort/snort.conf

RHEL5.4 snort+mysql+php+acid 安装笔记

看到以上信息,说明snort基本上安装OK!!

 

6、安装apache

 

 

[[email protected] ~]# cd /usr/local/src

[[email protected] src]# tar zxf httpd-2.2.15.tar.gz

[[email protected] src]# cd httpd-2.2.15

[[email protected] httpd-2.2.15]# ./configure --prefix=/usr/local/apache --enable-module=ssl --enable-module=so

RHEL5.4 snort+mysql+php+acid 安装笔记 

[[email protected] httpd-2.2.15]# make

[[email protected] httpd-2.2.15]# make install

RHEL5.4 snort+mysql+php+acid 安装笔记 

1)       启动apache

[[email protected] httpd-2.2.15]# /usr/local/apache/bin/apachectl start

查看端口信息:(这里的tcp链接呢是有80的,说明我们Apache安装成功

[[email protected] httpd-2.2.15]# netstat -tnl

 RHEL5.4 snort+mysql+php+acid 安装笔记

从上图中,我们还可以看到3306端口是mysql的端口

 

7)安装PHP

 

[[email protected] src]# tar zxf php-5.2.13.tar.gz

[[email protected] src]# cd php-5.2.13

[[email protected] php-5.2.13]# ./configure \

>--prefix=/usr/local/php \

>--with-mysql=/usr/local/mysql \

>--with-apxs2=/usr/local/apache/bin/apxs \

> --with-gd \

>--with-zlib

RHEL5.4 snort+mysql+php+acid 安装笔记 

 [[email protected] php-5.2.13]# make

[[email protected] php-5.2.13]# make install

RHEL5.4 snort+mysql+php+acid 安装笔记 

1)复制配置文件

[[email protected] php-5.2.13]# cp php.ini-dist /usr/local/bin/php.ini

2)修改apache配置文件 使其能够识别.PHP结尾的网页文件

[[email protected] php-5.2.13]# echo "AddType application/x-httpd-php .php">> /usr/local/apache/conf/httpd.conf

RHEL5.4 snort+mysql+php+acid 安装笔记 

3)  重启Apache 服务

[[email protected] php-5.2.13]# /usr/local/apache/bin/apachectl stop

[[email protected] php-5.2.13]# /usr/local/apache/bin/apachectl start

4)  写一个php的测试页

[[email protected] php-5.2.13]# vi /usr/local/apache/htdocs/index.php

 

<?

        echo "where to use PHP test page!";

        mysql_connect ("localhost","root","111111");

        mysql_query ("create database test01;");

?>

RHEL5.4 snort+mysql+php+acid 安装笔记 

5)在游览其中输入http://IP地址/index.php:如下图所示:

RHEL5.4 snort+mysql+php+acid 安装笔记

6)登陆到mysql看看数据库中是否建立了test01这个数据库

[[email protected] /]# /usr/local/mysql/bin/mysql -u root -p

mysql> show databases;

RHEL5.4 snort+mysql+php+acid 安装笔记 

 

8、安装acid+adodb+jpgraph

 

[[email protected] src]# tar zxf acid-0.9.6b23.tar.gz

[[email protected] src]# tar zxf adodb511.tgz

[[email protected] src]# tar zxf jpgraph-3.0.7.tar.gz

[[email protected] src]# mv acid /usr/local/apache/htdocs/

[[email protected] src]# mv adodb5 /usr/local/apache/htdocs/adodb

[[email protected] src]# mv jpgraph-3.0.7 /usr/local/apache/htdocs/jpgraph

这里呢,我是剪切过去的,但adodb5 jpgraph-1.27是剪切后改名字为adodb jpgraph

修改acid的配置文件

RHEL5.4 snort+mysql+php+acid 安装笔记 

修改数据库名字,端口默认那就好了,用户名 ,已经用户密码

RHEL5.4 snort+mysql+php+acid 安装笔记 

RHEL5.4 snort+mysql+php+acid 安装笔记 

/usr/local/mysql/bin/mysqld_safe --user=mysql &

snort -d -D -c /etc/snort/snort.conf

/usr/local/apache/bin/apachectl start

这些命令呢。我们可以写入/etc/rc.local 让它开机自动运行

9登陆到acid控制台

1)打开浏览器 输入http://你的ip地址/acid/acid_main.php,选择setup page

RHEL5.4 snort+mysql+php+acid 安装笔记

2)选择“Create ACID AG ”按钮

RHEL5.4 snort+mysql+php+acid 安装笔记

3)可以看到已经成功安装了

RHEL5.4 snort+mysql+php+acid 安装笔记 

4)点击 Home”,返回ACID控制台的首页,在这里就可以看到具体的一些信息了:

RHEL5.4 snort+mysql+php+acid 安装笔记

 

 好了,一个简单的snort搭建就结束了,对snort的深入研究估计还要等一段时间,如果大家需要以上的软件包,请留下邮箱(确保你的邮箱可以接收超过50M的邮件!!!)