{"id":19510,"date":"2017-04-13T06:58:42","date_gmt":"2017-04-12T22:58:42","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/13\/%e5%ae%89%e8%a3%9d-barnyard2-base-adodb-for-snort\/"},"modified":"2021-03-18T17:24:59","modified_gmt":"2021-03-18T09:24:59","slug":"%e5%ae%89%e8%a3%9d-barnyard2-base-adodb-for-snort","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/13\/%e5%ae%89%e8%a3%9d-barnyard2-base-adodb-for-snort\/","title":{"rendered":"\u5b89\u88dd Barnyard2 \/ Base \/ Adodb – For Snort"},"content":{"rendered":"

\u53c3\u8003\u7db2\u9801\uff1a
\u6d6e\u96f2\u96c5\u7bc9: [\u7814\u7a76] Snort 2.9.6.2 + Barnyard 2.13 \u5b89\u88dd (CentOS 6.5 x64) \u5feb\u901f\u5b89\u88dd\u7a0b\u5f0f<\/a>
Startup script timeout (Centos 7) \u00b7 Issue #141 \u00b7 firnsy\/barnyard2 \u00b7 GitHub<\/a><\/p>\n

\u5e95\u4e0b\u53c3\u8003\u81ea\uff1a\u8b93Snort\u958b\u59cb\u904b\u4f5c,Information Security \u8cc7\u5b89\u4eba\u79d1\u6280\u7db2<\/a><\/p>\n

Barnyard\u662f\u4e00\u5957\u7528\u4f86\u8b80\u53d6 Snort \u7d71\u4e00\u8f38\u51fa\u5831\u8868(Unified output)\u4e26\u5c07\u4e4b\u8f49\u5b58\u5230\u8cc7\u6599\u5eab\u7684\u7279\u88fd\u5de5\u5177\uff0c\u4e26\u4e14\u6703\u76f4\u63a5\u76e3\u8996\u8cc7\u6599\u5eab\u9023\u7dda\u4f86\u9810\u9632\u8cc7\u6599\u7684\u6d41\u5931\u3002\u7d71\u4e00\u8f38\u51fa\u5831\u8868\u662f Snort3 \u7a2e\u8f38\u51fa\u5831\u8868\u7684\u5176\u4e2d\u4e00\u500b\u9078\u9805\uff0c\u5b83\u900f\u904e\u6e1b\u8f15 Snort\u00a0 \u5f15\u64ce\u4e2d\u7684\u6709\u6548\u8ca0\u8377\u7684\u50b3\u8f38(payload translation)\u4f86\u589e\u5feb\u8655\u7406\u901f\u5ea6\u3002<\/p>\n

1. \u5b89\u88dd\u6240\u9700\u5957\u4ef6
# yum install git libtool libnet libnet-devel mariadb-devel daq-devel libyaml-devel file-devel libcap-ng-devel libpcap-devel libdnet-devel
<\/span><\/p>\n

2. \u5207\u63db\u76ee\u9304
# cd \/usr\/local\/src<\/span><\/p>\n

3. \u4f7f\u7528 git \u4e0b\u8f09 barnyard2
# git clone https:\/\/github.com\/firnsy\/barnyard2.git barnyard2<\/span>
Cloning into ‘barnyard2’…<\/span>
remote: Counting objects: 1292, done.<\/span>
remote: Total 1292 (delta 0), reused 0 (delta 0), pack-reused 1292<\/span>
Receiving objects: 100% (1292\/1292), 1.04 MiB | 601.00 KiB\/s, done.<\/span>
Resolving deltas: 100% (896\/896), done.<\/span>[@more@]
4. \u5207\u63db\u76ee\u9304
# cd barnyard2<\/span><\/p>\n

5. \u9032\u884c\u8a2d\u5b9a
# .\/autogen.sh<\/span>
Found libtoolize<\/span>
libtoolize: putting auxiliary files in `.’.<\/span>
libtoolize: copying file `.\/ltmain.sh’<\/span>
libtoolize: putting macros in AC_CONFIG_MACRO_DIR, `m4′.<\/span>
libtoolize: copying file `m4\/libtool.m4′<\/span>
libtoolize: copying file `m4\/ltoptions.m4′<\/span>
libtoolize: copying file `m4\/ltsugar.m4′<\/span>
libtoolize: copying file `m4\/ltversion.m4′<\/span>
libtoolize: copying file `m4\/lt~obsolete.m4′<\/span>
autoreconf: Entering directory `.’<\/span>
autoreconf: configure.ac: not using Gettext<\/span>
autoreconf: running: aclocal –force -I m4<\/span>
autoreconf: configure.ac: tracing<\/span>
autoreconf: running: libtoolize –copy –force<\/span>
libtoolize: putting auxiliary files in `.’.<\/span>
libtoolize: copying file `.\/ltmain.sh’<\/span>
libtoolize: putting macros in AC_CONFIG_MACRO_DIR, `m4′.<\/span>
libtoolize: copying file `m4\/libtool.m4′<\/span>
libtoolize: copying file `m4\/ltoptions.m4′<\/span>
libtoolize: copying file `m4\/ltsugar.m4′<\/span>
libtoolize: copying file `m4\/ltversion.m4′<\/span>
libtoolize: copying file `m4\/lt~obsolete.m4′<\/span>
autoreconf: running: \/usr\/bin\/autoconf –force<\/span>
autoreconf: running: \/usr\/bin\/autoheader –force<\/span>
autoreconf: running: automake –add-missing –copy –force-missing<\/span>
configure.ac:11: installing ‘.\/config.guess’<\/span>
configure.ac:11: installing ‘.\/config.sub’<\/span>
configure.ac:8: installing ‘.\/install-sh’<\/span>
configure.ac:8: installing ‘.\/missing’<\/span>
autoreconf: Leaving directory `.’<\/span>
You can now run “.\/configure” and then “make”.<\/span><\/p>\n

6. \u9032\u884c\u7de8\u8b6f\u53ca\u5b89\u88dd
# .\/configure –with-mysql –with-mysql-libraries=\/usr\/lib64\/mysql<\/span>
# make && make install<\/span><\/p>\n

7. \u8907\u88fd\u6a94\u6848\u5230\u76f8\u5c0d\u61c9\u76ee\u9304
# cp \/usr\/local\/src\/barnyard2\/rpm\/barnyard2.config \/etc\/sysconfig\/barnyard2<\/span>
# c<\/span>p \/usr\/local\/src\/barnyard2\/rpm\/barnyard2 \/etc\/init.d\/<\/span><\/p>\n

8. \u66f4\u6539\u6a94\u6848\u7d66\u4e88\u57f7\u884c\u6b0a\u9650
# chmod +x \/etc\/init.d\/barnyard2<\/span><\/p>\n

9. \u8a2d\u5b9a\u958b\u6a5f\u6642\u555f\u52d5 barnyard2
# chkconfig –add barnyard2<\/span><\/p>\n

10. \u5efa\u7acb\u9023\u7d50
# ln -s \/usr\/local\/etc\/barnyard2.conf \/etc\/snort\/barnyard2.conf<\/span>
# ln -s \/usr\/local\/bin\/barnyard2 \/usr\/bin\/<\/span><\/p>\n

11. \u5efa\u7acb\u76ee\u9304
# mkdir -p \/var\/log\/snort\/eth0\/archive\/<\/span><\/p>\n

12. \u4fee\u6539 \/etc\/init.d\/barnyard2<\/span>
# sed -i -e “s@BARNYARD_OPTS=@#BARNYARD_OPTS=@”\u00a0\u00a0 \/etc\/init.d\/barnyard2<\/span>
# sed -i -e “\/BARNYARD_OPTS=”-D -c $CONF\/aBARNYARD_OPTS=”-D -c \/etc\/snort\/barnyard2.conf -d \/var\/log\/snort -w \/var\/log\/snort\/barnyard2.waldo -l \/var\/log\/snort -a \/var\/log\/snort -f snort.log -X \/var\/lock\/subsys\/barnyard2-eth0.pid””\u00a0\u00a0 \/etc\/init.d\/barnyard2<\/span><\/p>\n

13. \u4fee\u6539 \/etc\/sysconfig\/barnyard2<\/span>
# sed -i -e “s@LOG_FILE=@#LOG_FILE=@”\u00a0\u00a0 \/etc\/sysconfig\/barnyard2<\/span>
# sed -i -e “\/LOG_FILE=”snort_unified.log”\/aLOG_FILE=”snort.log””\u00a0\u00a0 \/etc\/sysconfig\/barnyard2<\/span><\/p>\n

14. \u4fee\u6539 \/etc\/sysconfig\/snort<\/span>
# sed -i -e “s@ALERTMODE=fast@#ALERTMODE=fast@”\u00a0\u00a0\u00a0 \/etc\/sysconfig\/snort<\/span>
# sed -i -e “s@BINARY_LOG=1@#BINARY_LOG=1@”\u00a0\u00a0\u00a0 \/etc\/sysconfig\/snort<\/span><\/p>\n

15. \u4fee\u6539 \/etc\/snort\/barnyard2.conf<\/span>
# sed -i -e “s@config sid_file@# config sid_file@” \/etc\/snort\/barnyard2.conf<\/span>
# sed -i -e “\/config sid_file\/aconfig sid_file: \/etc\/snort\/etc\/sid-msg.map” \/etc\/snort\/barnyard2.conf<\/span>
# sed -i -e “\/database: log to a variety of databases\/aoutput database: log, mysql, user=barnyard2 password=123456 dbname=snort host=localhost” \/etc\/snort\/barnyard2.conf<\/span><\/p>\n

16. \u4fee\u6539 \/etc\/snort\/snort.conf<\/span>
# sed -i -e “s@output unified2@#output unified2@”\u00a0\u00a0\u00a0 \/etc\/snort\/snort.conf<\/span>
# sed -i -e “\/output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types\/aoutput unified2: filename snort.log, limit 128”\u00a0\u00a0 \/etc\/snort\/snort.conf<\/span><\/p>\n

17. \u5efa\u7acb\u8cc7\u6599\u5eab\u53ca\u8a2d\u5b9a\u8a2d\u7528\u8005\u5e33\u865f\u5bc6\u78bc
# \/usr\/bin\/mysql -u root -p<\/span>
MariaDB [(none)]><\/span> create database snortdb;<\/span>
MariaDB [(none)]><\/span> grant all privileges on snortdb.* to barnyard2@localhost identified by ‘123456’;<\/span>
MariaDB [(none)]><\/span> flush privileges;<\/span><\/p>\n

19. \u532f\u5165\u8cc7\u6599
# \/usr\/bin\/mysql snortdb -ubarnyard2 -p123456 < \/usr\/local\/src\/barnyard2\/schemas\/create_mysql<\/span><\/p>\n

20. \u9032\u884c\u6e2c\u8a66
# \/usr\/local\/bin\/barnyard2 -T -c \/etc\/snort\/barnyard2.conf -d \/var\/log\/snort -w \/var\/log\/snort\/<\/span>barnyard2.waldo -l \/var\/log\/snort -a \/var\/log\/snort -f snort.log -X \/var\/lock\/su<\/span>bsys\/barnyard2-eth0.pid<\/span><\/p>\n

\u5982\u679c\u6709\u7121\u6cd5\u555f\u52d5\u7684\u72c0\u6cc1
# vim \/etc\/systemd\/system\/barnyard2.service<\/span>
[Unit]<\/span>
Description=Barnyard2 Dedicated Unified2 Spooler<\/span>
After=network.target<\/span><\/p>\n

[Service]<\/span>
Type=simple<\/span>
ExecStart=\/usr\/local\/bin\/barnyard2 -c \/etc\/snort\/barnyard2.conf -d \/var\/log\/snort\/ -f snort.log<\/span><\/p>\n

[Install]<\/span>
WantedBy=multi-user.target<\/span><\/p>\n

# systemctl enable barnyard2.service<\/span>
Created symlink from \/etc\/systemd\/system\/multi-user.target.wants\/barnyard2.service to \/etc\/systemd\/system\/barnyard2.service<\/span>.
# systemctl start barnyard2<\/span><\/p>\n

21. \u5b89\u88dd Base + adodb (Web UI)
# cd \/usr\/local\/src<\/span>
# wget http:\/\/nchc.dl.sourceforge.net\/project\/adodb\/adodb-php5-only\/adodb-518-for-php5\/adodb518a.tgz<\/span>
# wget http:\/\/nchc.dl.sourceforge.net\/project\/secureideas\/BASE\/base-1.4.5\/base-1.4.5.tar.gz<\/span>
# tar zxvf base-1.4.5.tar.gz -C \/var\/www\/html<\/span>
# mv \/var\/www\/html\/base-1.4.5 \/var\/www\/html\/base<\/span>
# chmod a+w \/var\/www\/html\/base<\/span>
# tar zxvf adodb518a.tgz -C \/var\/www\/html<\/span>
# chmod a+w \/var\/www\/html\/adodb5<\/span>
# \u4fee\u6539 \/etc\/php.ini
# vim \/etc\/php.ini<\/span>
date.timezone = “Asia\/Taipei”<\/span>
error_reporting = E_ALL & ~E_NOTICE<\/span>
\u627e\u5230
; UNIX: “\/path1:\/path2”<\/span>
;include_path = “.:\/php\/includes”<\/span>
\u5e95\u4e0b\u589e\u52a0\u4e00\u884c
include_path => .:\/usr\/share\/pear:\/usr\/share\/php<\/span><\/p>\n

22. \u91cd\u65b0\u555f\u52d5 Web Server
# systemctl restart httpd<\/span><\/p>\n

23. \u5b89\u88dd\u904e\u7a0b\u756b\u9762
\"\"<\/a>
\"\"<\/a>
\"\"<\/a>
\"\"<\/a>
\"\"<\/a><\/p>\n

\"\"<\/a>
\"\"<\/a><\/p>\n

24. \u66f4\u6539\u76ee\u9304\u6b0a\u9650
# chmod a-w \/var\/www\/html\/base<\/span>
# chmod a-w \/var\/www\/html\/adodb5<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u9801\uff1a\u6d6e\u96f2\u96c5\u7bc9: [\u7814\u7a76] Snort 2.9.6.2 + Barnyard 2.13 \u5b89\u88dd (CentO … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5b89\u88dd Barnyard2 \/ Base \/ Adodb – For Snort\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,146],"tags":[],"class_list":["post-19510","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-78491"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["687249"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19510"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19510"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19510\/revisions"}],"predecessor-version":[{"id":21026,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19510\/revisions\/21026"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}