centos7平台手动搭建snort入侵检测系统

最新推荐文章于 2023-04-28 20:29:55 发布

原创

最新推荐文章于 2023-04-28 20:29:55 发布 · 1.7k 阅读

9 ·

CC 4.0 BY-SA版权

文章标签：

#http

本文详细介绍了在CentOS7环境中手动搭建Snort入侵检测系统的步骤，包括更新系统、安装依赖、编译安装Snort、配置Snort、创建用户和组、设置开机自启、安装MySQL、编译安装barnyard2、配置数据库以及最终的测试和Web配置。通过这些步骤，读者可以成功建立一个Snort IDS系统。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

centos平台搭建snort入侵检测系统
#centos平台搭建snort入侵检测系统
## centos平台搭建snort入侵检测系统
参考:https://blog.csdn.net/qq_42196196/article/details/88718920
一、搭建环境
我使用的是VMware搭建的centos7的环境:
1、配置更新源：
yum install -y wget # 下载wget
wget -O /etc/yum.repos.d/CentOS-Base.rephttp://mirrors.aliyun.com/repo/Centos-7.repo
yum clean all #清除缓存
yum makecache #生成缓存
yum -y update #更新系统
二、安装基本环境和依赖包：
yum install -y epel-release gcc gcc-c++ flex bison zlib libxml2 libpcap pcre* tcpdump git libtool curl man make flex bison-devel libcap-devel openssl-devel
三、编译安装snort（文件包都需要提前下载好，由器snort和规则包最好能下载最新的资源）：
cd /usr/local/src/
#编译安装libdnet
tar -zxvf /home/centos/snortIDSpacket/libdnet-1.11.tar.gz
cd libdnet-1.11/
./configure
make && make install
#编译安装LuaJIT
tar -zxvf /home/centos/snortIDSpacket/LuaJIT-2.0.5.tar.gz
cd LuaJIT-2.0.5/
make && make install
#编译安装daq
tar -zxvf /home/centos/snortIDSpacket/daq-2.0.6.tar.gz
cd daq-2.0.6/
./configure
make && make install
#编译安装snort
tar -zxvf /home/centos/snortIDSpacket/snort-2.9.14.1.tar.gz
cd snort-2.9.14.1/
./configure --enable-sourcefire
make && make install
四、配置snort
mkdir /etc/snort
cd /etc/snort
cp /usr/local/src/snort-2.9.12/etc/* /etc/snort/
mkdir SnortRules && cd SnortRules
tar -zvxf /home/centos/snortIDSpacket/snortrules-snapshot-29120.tar.gz
touch rules/white_list.rules rules/black_list.rules
vi /etc/snort/snort.conf
修改的内容:
var RULE_PATH …/ruls --> var RULE_PATH /etc/snort/SnortRules/rules
var SO_RULE_PATH …/so_rules --> var SO_RULE_PATH /etc/snort/SnortRules/so_rules