{"id":19503,"date":"2017-04-11T06:03:09","date_gmt":"2017-04-10T22:03:09","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/11\/%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%ae%89%e8%a3%9d-snort\/"},"modified":"2021-03-18T17:24:59","modified_gmt":"2021-03-18T09:24:59","slug":"%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%ae%89%e8%a3%9d-snort","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/11\/%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%ae%89%e8%a3%9d-snort\/","title":{"rendered":"\u5728 CentOS 7.x \u4e0a\u5b89\u88dd snort"},"content":{"rendered":"

snort \u5b98\u65b9\u7db2\u7ad9\uff1ahttps:\/\/www.snort.org\/<\/a>
\"\" <\/a>
1. \u4e0b\u8f09\u5b98\u65b9\u7db2\u7ad9\u63d0\u4f9b\u5957\u4ef6\uff1a
# wget https:\/\/www.snort.org\/downloads\/snort\/daq-2.0.6-1.centos7.x86_64.rpm<\/span>
# wget https:\/\/www.snort.org\/downloads\/snort\/snort-2.9.9.0-1.centos7.x86_64.rpm<\/span> <\/p>\n

[@more@]\u53c3\u8003\u7db2\u7ad9\uff1a
\u6d6e\u96f2\u96c5\u7bc9: [\u7814\u7a76] Snort 2.9.8.0 \u5b89\u88dd + \u5feb\u901f\u5b89\u88dd\u7a0b\u5f0f (CentOS 7.2 x64)<\/a> <\/p>\n

2. \u5b89\u88dd\u5957\u4ef6
# yum install libpcap-devel libdnet-devel libnghttp2-devel<\/span> <\/p>\n

\u5982\u679c\u6c92\u6709\u5148\u5b89\u88dd\u4e0a\u8ff0\u5957\u4ef6\uff0c\u76f4\u63a5\u5b89\u88dd daq \u548c snort \u6703\u51fa\u73fe\u932f\u8aa4\u8a0a\u606f
# rpm -ivh daq-2.0.6-1.centos7.x86_64.rpm<\/span>
error: Failed dependencies:<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 libpcap.so.1()(64bit) is needed by daq-2.0.6-1.x86_64<\/span>
# rpm -ivh snort-2.9.9.0-1.centos7.x86_64.rpm<\/span>
error: Failed dependencies:<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 libdnet.so.1()(64bit) is needed by snort-1:2.9.9.0-1.x86_64<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 libnghttp2.so.14()(64bit) is needed by snort-1:2.9.9.0-1.x86_64<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 libpcap.so.1()(64bit) is needed by snort-1:2.9.9.0-1.x86_64<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 libsfbpf.so.0()(64bit) is needed by snort-1:2.9.9.0-1.x86_64<\/span> <\/p>\n

3. \u9032\u884c\u5b89\u88dd
# rpm -ivh daq-2.0.6-1.centos7.x86_64.rpm snort-2.9.9.0-1.centos7.x86_64.rpm<\/span> <\/p>\n

4. \u8a3b\u518a\u4e26\u4e0b\u8f09 rules
https:\/\/www.snort.org\/downloads\/#rule-downloads<\/span> <\/p>\n

5 \u89e3\u58d3\u7e2e rules
# tar xvzf snortrules-snapshot-2990.tar.gz -C \/etc\/snort<\/span> <\/p>\n

6. \u7522\u751f\u9ed1\/\u767d\u540d\u55ae
# cp \/etc\/snort\/snort.conf \/etc\/snort\/snort.conf.$(date +%F)<\/span>
# sed -i ‘s|..\/rules|rules|’ \/etc\/snort\/snort.conf<\/span>
# touch \/etc\/snort\/rules\/white_list.rules \/etc\/snort\/rules\/black_list.rules<\/span>
\u6216
# sed -i “s|var BLACK_LIST_PATH|#var BLACK_LIST_PATH|” \/etc\/snort\/snort.conf<\/span>
# sed -i “\/var BLACK_LIST_PATH\/avar BLACK_LIST_PATH \/etc\/snort\/rules” \/etc\/snort\/snort.conf<\/span>
# touch \/etc\/snort\/rules\/white_list.rules \/etc\/snort\/rules\/black_list.rules<\/span>
# sed -i “s|var WHITE_LIST_PATH|#var WHITE_LIST_PATH|”\u00a0\u00a0 \/etc\/snort\/snort.conf<\/span>
# sed -i “\/var WHITE_LIST_PATH\/avar WHITE_LIST_PATH \/etc\/snort\/rules” \/etc\/snort\/snort.conf<\/span> <\/p>\n

7. \u4fee\u6539\u8a2d\u5b9a\u6a94 \/etc\/snort\/snort.conf<\/span>
# sed -i ‘s\/^dynamicdetection\/#dynamicdetection\/’ \/etc\/snort\/snort.conf<\/span>
\u6216
# mkdir -p \/usr\/local\/lib\/snort_dynamicrules<\/span> <\/p>\n

8. \u6aa2\u67e5\u8a2d\u5b9a\u6a94\u662f\u5426\u6b63\u78ba
# snort -T -c \/etc\/snort\/snort.conf<\/span>
……<\/span>
Snort successfully validated the configuration!<\/span>
Snort exiting<\/span> <\/p>\n

9. \u555f\u52d5 snort
# systemctl start snortd<\/span>
or
# \/etc\/init.d\/snortd start<\/span> <\/p>\n

10. \u6aa2\u67e5\u555f\u52d5\u72c0\u614b
# \/etc\/init.d\/snortd status<\/span>
\u25cf snortd.service – SYSV: snort is a lightweight network intrusion detection tool that currently detects more than 1100 host and network vulnerabilities, portscans, backdoors, and more.<\/span>
\u00a0\u00a0 Loaded: loaded (\/etc\/rc.d\/init.d\/snortd; bad; vendor preset: disabled)<\/span>
\u00a0\u00a0 Active: active (running<\/span>) since Fri 2017-02-24 21:57:01 CST; 6s ago<\/span>
\u00a0\u00a0\u00a0\u00a0 Docs: man:systemd-sysv-generator(8)<\/span>
\u00a0 Process: 429 ExecStart=\/etc\/rc.d\/init.d\/snortd start (code=exited, status=0\/SUCCESS)<\/span>
\u00a0\u00a0 CGroup: \/system.slice\/snortd.service<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 mq435 \/usr\/sbin\/snort -A fast -b -d -D -i eth0 -u snort -g snort -c \/etc\/snort\/snort.conf -l \/var\/log\/snort<\/span> <\/p>\n

Feb 24 21:57:01 fb snort[435]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Preprocessor Object: SF_DNS\u00a0 Version 1.1\u00a0 <Build 4><\/span>
Feb 24 21:57:01 fb snort[435]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Preprocessor Object: SF_SIP\u00a0 Version 1.1\u00a0 <Build 1><\/span>
Feb 24 21:57:01 fb snort[435]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Preprocessor Object: SF_SSLPP\u00a0 Version 1.1\u00a0 <Build 4><\/span>
Feb 24 21:57:01 fb snort[435]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Preprocessor Object: SF_IMAP\u00a0 Version 1.0\u00a0 <Build 1><\/span>
Feb 24 21:57:01 fb snort[435]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Preprocessor Object: SF_DCERPC2\u00a0 Version 1.0\u00a0 <Build 3><\/span>
Feb 24 21:57:01 fb snort[435]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Preprocessor Object: SF_GTP\u00a0 Version 1.1\u00a0 <Build 1><\/span>
Feb 24 21:57:01 fb snort[435]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Preprocessor Object: SF_POP\u00a0 Version 1.0\u00a0 <Build 1><\/span>
Feb 24 21:57:01 fb snort[435]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Preprocessor Object: SF_SMTP\u00a0 Version 1.1\u00a0 <Build 9><\/span>
Feb 24 21:57:01 fb snort[435]:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Preprocessor Object: SF_SDF\u00a0 Version 1.1\u00a0 <Build 1><\/span>
Feb 24 21:57:01 fb snort[435]: Commencing packet processing (pid=435)<\/span> <\/p>\n

# ps aux | grep snort | grep -v grep<\/span>
snort\u00a0\u00a0\u00a0\u00a0\u00a0 435\u00a0 0.0 80.3 810840 421080 ?\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Ssl\u00a0 21:57\u00a0\u00a0 0:00 \/usr\/sbin\/snort -A fast -b -d -D -i eth0 -u snort -g snort -c \/etc\/snort\/snort.conf -l \/var\/log\/snort<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

snort \u5b98\u65b9\u7db2\u7ad9\uff1ahttps:\/\/www.snort.org\/ 1. \u4e0b\u8f09\u5b98\u65b9\u7db2\u7ad9\u63d0\u4f9b\u5957\u4ef6\uff1a # wget … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5728 CentOS 7.x \u4e0a\u5b89\u88dd snort\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,146],"tags":[],"class_list":["post-19503","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-78491"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["687204"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19503"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19503"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19503\/revisions"}],"predecessor-version":[{"id":21019,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19503\/revisions\/21019"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19503"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19503"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19503"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}