{"id":19521,"date":"2017-04-19T06:54:32","date_gmt":"2017-04-18T22:54:32","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/19\/%e5%ae%89%e8%a3%9d-barnyard2-base-adodb-for-suricata\/"},"modified":"2021-03-18T17:25:00","modified_gmt":"2021-03-18T09:25:00","slug":"%e5%ae%89%e8%a3%9d-barnyard2-base-adodb-for-suricata","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/19\/%e5%ae%89%e8%a3%9d-barnyard2-base-adodb-for-suricata\/","title":{"rendered":"\u5b89\u88dd Barnyard2 \/ Base \/ Adodb – For Suricata"},"content":{"rendered":"

\u53c3\u8003\u7db2\u9801\uff1a
Suricata + Barnyard + BASE \u5b89\u88dd \u2013 Neverland<\/a><\/p>\n

\u5e95\u4e0b\u53c3\u8003\u81ea\uff1a\u8b93Snort\u958b\u59cb\u904b\u4f5c,Information Security \u8cc7\u5b89\u4eba\u79d1\u6280\u7db2<\/a><\/p>\n

Barnyard\u662f\u4e00\u5957\u7528\u4f86\u8b80\u53d6 Snort \u7d71\u4e00\u8f38\u51fa\u5831\u8868(Unified output)\u4e26\u5c07\u4e4b\u8f49\u5b58\u5230\u8cc7\u6599\u5eab\u7684\u7279\u88fd\u5de5\u5177\uff0c\u4e26\u4e14\u6703\u76f4\u63a5\u76e3\u8996\u8cc7\u6599\u5eab\u9023\u7dda\u4f86\u9810\u9632\u8cc7\u6599\u7684\u6d41\u5931\u3002\u7d71\u4e00\u8f38\u51fa\u5831\u8868\u662f Snort3 \u7a2e\u8f38\u51fa\u5831\u8868\u7684\u5176\u4e2d\u4e00\u500b\u9078\u9805\uff0c\u5b83\u900f\u904e\u6e1b\u8f15 Snort\u00a0 \u5f15\u64ce\u4e2d\u7684\u6709\u6548\u8ca0\u8377\u7684\u50b3\u8f38(payload translation)\u4f86\u589e\u5feb\u8655\u7406\u901f\u5ea6\u3002<\/p>\n

1. \u5b89\u88dd\u6240\u9700\u5957\u4ef6
# yum install git libtool libnet libnet-devel mariadb-devel daq-devel libyaml-devel file-devel libcap-ng-devel libpcap-devel libdnet-devel
<\/span><\/p>\n

2. \u5207\u63db\u76ee\u9304
# cd \/usr\/local\/src<\/span><\/p>\n

3. \u4f7f\u7528 git \u4e0b\u8f09 barnyard2
# git clone https:\/\/github.com\/firnsy\/barnyard2.git barnyard2<\/span>
Cloning into ‘barnyard2’…<\/span>
remote: Counting objects: 1292, done.<\/span>
remote: Total 1292 (delta 0), reused 0 (delta 0), pack-reused 1292<\/span>
Receiving objects: 100% (1292\/1292), 1.04 MiB | 601.00 KiB\/s, done.<\/span>
Resolving deltas: 100% (896\/896), done.<\/span>[@more@]
4. \u5207\u63db\u76ee\u9304
# cd barnyard2<\/span><\/p>\n

5. \u9032\u884c\u8a2d\u5b9a
# .\/autogen.sh<\/span>
Found libtoolize<\/span>
libtoolize: putting auxiliary files in `.’.<\/span>
libtoolize: copying file `.\/ltmain.sh’<\/span>
libtoolize: putting macros in AC_CONFIG_MACRO_DIR, `m4′.<\/span>
libtoolize: copying file `m4\/libtool.m4′<\/span>
libtoolize: copying file `m4\/ltoptions.m4′<\/span>
libtoolize: copying file `m4\/ltsugar.m4′<\/span>
libtoolize: copying file `m4\/ltversion.m4′<\/span>
libtoolize: copying file `m4\/lt~obsolete.m4′<\/span>
autoreconf: Entering directory `.’<\/span>
autoreconf: configure.ac: not using Gettext<\/span>
autoreconf: running: aclocal –force -I m4<\/span>
autoreconf: configure.ac: tracing<\/span>
autoreconf: running: libtoolize –copy –force<\/span>
libtoolize: putting auxiliary files in `.’.<\/span>
libtoolize: copying file `.\/ltmain.sh’<\/span>
libtoolize: putting macros in AC_CONFIG_MACRO_DIR, `m4′.<\/span>
libtoolize: copying file `m4\/libtool.m4′<\/span>
libtoolize: copying file `m4\/ltoptions.m4′<\/span>
libtoolize: copying file `m4\/ltsugar.m4′<\/span>
libtoolize: copying file `m4\/ltversion.m4′<\/span>
libtoolize: copying file `m4\/lt~obsolete.m4′<\/span>
autoreconf: running: \/usr\/bin\/autoconf –force<\/span>
autoreconf: running: \/usr\/bin\/autoheader –force<\/span>
autoreconf: running: automake –add-missing –copy –force-missing<\/span>
configure.ac:11: installing ‘.\/config.guess’<\/span>
configure.ac:11: installing ‘.\/config.sub’<\/span>
configure.ac:8: installing ‘.\/install-sh’<\/span>
configure.ac:8: installing ‘.\/missing’<\/span>
autoreconf: Leaving directory `.’<\/span>
You can now run “.\/configure” and then “make”.<\/span><\/p>\n

6. \u9032\u884c\u7de8\u8b6f\u53ca\u5b89\u88dd
# .\/configure –with-mysql –with-mysql-libraries=\/usr\/lib64\/mysql<\/span>
# make && make install<\/span><\/p>\n

7. \u8907\u88fd\u6a94\u6848\u5230\u76f8\u5c0d\u61c9\u76ee\u9304
# cp \/usr\/local\/src\/barnyard2\/rpm\/barnyard2.config \/etc\/sysconfig\/barnyard2<\/span>
# c<\/span>p \/usr\/local\/src\/barnyard2\/rpm\/barnyard2 \/etc\/init.d\/<\/span><\/p>\n

8. \u66f4\u6539\u6a94\u6848\u7d66\u4e88\u57f7\u884c\u6b0a\u9650
# chmod +x \/etc\/init.d\/barnyard2<\/span><\/p>\n

9. \u8a2d\u5b9a\u958b\u6a5f\u6642\u555f\u52d5 barnyard2
# chkconfig –add barnyard2<\/span><\/p>\n

10. \u5efa\u7acb\u9023\u7d50
# ln -s \/usr\/local\/etc\/barnyard2.conf \/etc\/suricata\/barnyard2.conf<\/span>
# ln -s \/usr\/local\/bin\/barnyard2 \/usr\/bin\/<\/span><\/p>\n

11. \u5efa\u7acb\u76ee\u9304
# mkdir -p \/var\/log\/snort\/eth0\/archive\/<\/span><\/p>\n

12. \u4fee\u6539 \/etc\/init.d\/barnyard2
<\/span># sed -i -e “s@Snort Output Processor@Suricata Output Processor@”\u00a0\u00a0 \/etc\/init.d\/barnyard2<\/span>
# sed -i -e “s@BARNYARD_OPTS=@#BARNYARD_OPTS=@”\u00a0\u00a0 \/etc\/init.d\/barnyard2<\/span>
# sed -i -e “\/daemon\/iBARNYARD_OPTS=”-D -c \/etc\/suricata\/barnyard2.conf -d \/var\/log\/suricata -w \/var\/log\/suricata\/barnyard2.waldo -l \/var\/log\/suricata -a \/var\/log\/suricata -f unified2.alert -X \/var\/lock\/subsys\/barnyard2.pid”” \/etc\/init.d\/barnyard2d2<\/span><\/p>\n

13. \u4fee\u6539 \/etc\/sysconfig\/barnyard2<\/span>
# sed -i -e “s@LOG_FILE=@#LOG_FILE=@”\u00a0\u00a0 \/etc\/sysconfig\/barnyard2<\/span>
# sed -i -e “\/LOG_FILE=”snort_unified.log”\/aLOG_FILE=”<\/span>unified2.log<\/span>“”\u00a0\u00a0 \/etc\/sysconfig\/barnyard2
#<\/span> sed -i -e “s@CONF@#CONF@” \/etc\/sysconfig\/barnyard2
# <\/span><\/span>sed -i -e “s@<\/span>SNORTDIR@#<\/span>SNORTDIR@” <\/span>\/etc\/sysconfig\/barnyard2
<\/span># sed -i -e “\/Probably not this either\/aCONF=\/etc\/suricata\/barnyard2.conf” \/etc\/sysconfig\/barnyard2
<\/span># sed -i -e “\/#SNORTDIR\/aSNORTDIR=”\/var\/log\/suricata”” \/etc\/sysconfig\/barnyard2<\/span><\/span><\/p>\n

14. \u4fee\u6539 \/etc\/suricata\/barnyard2.conf
<\/span># cp \/etc\/suricata\/barnyard2.conf \/etc\/suricata\/barnyard2.conf.$(date +%F)<\/span>
# sed -i ‘s@\/etc\/snort\/reference.config@\/etc\/suricata\/rules\/reference.config@’ \/etc\/suricata\/barnyard2.conf<\/span>
# sed -i ‘s@<\/span>\/etc\/snort\/classification.config<\/span>@<\/span>\/etc\/suricata\/rules\/classification.config<\/span>@’ \/etc\/suricata\/barnyard2.conf
<\/span># sed -i ‘s@\/etc\/snort\/gen-msg.map@\/etc\/suricata\/rules\/gen-msg.map@’ \/etc\/suricata\/barnyard2.conf
<\/span># sed -i ‘s@\/etc\/snort\/sid-msg.map@\/etc\/suricata\/rules\/sid-msg.map@’ \/etc\/suricata\/barnyard2.conf
<\/span># <\/span>sed -i -e “\/database: log to a variety of databases\/aoutput database: log, mysql, user=barnyard2 password=123456 dbname=suricatadb host=localhost” \/etc\/suricata\/barnyard2.conf<\/span><\/p>\n

15. \u4fee\u6539 \/etc\/suricata\/suricata.yaml<\/span>
# vim \/etc\/suricata\/suricata.yaml<\/span>
\u00a0 – unified2-alert:<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0 enabled: yes<\/span><\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0 filename: unified2.alert<\/span><\/p>\n

16. \u5efa\u7acb\u8cc7\u6599\u5eab\u53ca\u8a2d\u5b9a\u8a2d\u7528\u8005\u5e33\u865f\u5bc6\u78bc
# \/usr\/bin\/mysql -u root -p<\/span>
MariaDB [(none)]><\/span> create database snortdb;<\/span>
MariaDB [(none)]><\/span> grant all privileges on snortdb.* to barnyard2@localhost identified by ‘123456’;<\/span>
MariaDB [(none)]><\/span> flush privileges;<\/span><\/p>\n

17. \u532f\u5165\u8cc7\u6599
# \/usr\/bin\/mysql suricatadb -ubarnyard2 -p123456 < \/usr\/local\/src\/barnyard2\/schemas\/create_mysql<\/span><\/p>\n

18. \u9032\u884c\u6e2c\u8a66
# \/usr\/local\/bin\/barnyard2 -T -c \/etc\/suricata\/barnyard2.conf -d \/var\/log\/suricata -w \/var\/log\/suricata\/<\/span>barnyard2.waldo -l \/var\/log\/suricata -a \/var\/log\/suricata -f unified2.alert\u00a0-X \/var\/lock\/su<\/span>bsys\/barnyard2.pid<\/span><\/p>\n

19. \u5982\u679c\u6709\u7121\u6cd5\u555f\u52d5\u7684\u72c0\u6cc1
# vim \/etc\/systemd\/system\/barnyard2.service<\/span>
[Unit]<\/span>
Description=Barnyard2 Dedicated Unified2 Spooler<\/span>
After=network.target<\/span><\/p>\n

[Service]<\/span>
Type=simple<\/span>
ExecStart=\/usr\/local\/bin\/barnyard2 -c \/etc\/suricata\/barnyard2.conf -d \/var\/log\/suricata\/ -w \/var\/log\/suricata\/barnyard2.waldo -l \/var\/log\/suricata -a \/var\/log\/suricata -f unified2.alert -X \/var\/lock\/subsys\/barnyard2.pid<\/span><\/p>\n

[Install]<\/span>
WantedBy=multi-user.target<\/span><\/p>\n

20. \u5efa\u7acb\u76ee\u9304\u53ca\u6539\u8b8a\u76ee\u9304\u64c1\u6709\u8005\u7fa4\u7d44
# mkdir \/var\/log\/barnyard2<\/span>
# chown -R suricata:suricata \/var\/log\/barnyard2<\/span><\/p>\n

21. \u8a2d\u5b9a\u958b\u6a5f\u6642\u555f\u52d5
# systemctl enable barnyard2.service<\/span>
Created symlink from \/etc\/systemd\/system\/multi-user.target.wants\/barnyard2.service to \/etc\/systemd\/system\/barnyard2.service<\/span>.<\/p>\n

22. \u555f\u52d5\u4e26\u6aa2\u67e5
# systemctl start barnyard2<\/span>
# systemctl status barnyard2.service<\/span>
\u25cf barnyard2.service – Barnyard2 Dedicated Unified2 Spooler<\/span>
\u00a0\u00a0 Loaded: loaded (\/etc\/systemd\/system\/barnyard2.service; enabled; vendor preset: disabled)<\/span>
\u00a0\u00a0 Active: active (running<\/span>) since Wed 2017-03-01 19:06:47 CST; 1min 18s ago<\/span>
\u00a0Main PID: 630 (barnyard2)<\/span>
\u00a0\u00a0 CGroup: \/system.slice\/barnyard2.service<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 mq630 \/usr\/local\/bin\/barnyard2 -c \/etc\/suricata\/barnyard2.conf -d \/var\/log\/suricata\/ -f unified2.alert<\/span><\/p>\n

Mar 01 19:07:24 ids barnyard2[630]: database:\u00a0 data encoding = hex<\/span>
Mar 01 19:07:24 ids barnyard2[630]: database:\u00a0\u00a0 detail level = full<\/span>
Mar 01 19:07:24 ids barnyard2[630]: database:\u00a0\u00a0\u00a0\u00a0 ignore_bpf = no<\/span>
Mar 01 19:07:24 ids barnyard2[630]: database: using the “log” facility<\/span>
Mar 01 19:07:24 ids barnyard2[630]: –== Initialization Complete ==–<\/span>
Mar 01 19:07:24 ids barnyard2[630]: ______\u00a0\u00a0 -*> Barnyard2 <*-<\/span>
Mar 01 19:07:24 ids barnyard2[630]: \/ ,,_\u00a0 \u00a0 Version 2.1.14 (Build 337)<\/span>
Mar 01 19:07:24 ids barnyard2[630]: |o”\u00a0 )~|\u00a0 By Ian Firns (SecurixLive): http:\/\/www.securixlive.com\/<\/span>
Mar 01 19:07:24 ids barnyard2[630]: + ”” +\u00a0 (C) Copyright 2008-2013 Ian Firns <firnsy@securixlive.com><\/span>
Mar 01 19:07:24 ids barnyard2[630]: Waiting for new spool file<\/span> <\/p>\n

23 \u5b89\u88dd Base + adodb (Web UI)
# cd \/usr\/local\/src<\/span>
# wget http:\/\/nchc.dl.sourceforge.net\/project\/adodb\/adodb-php5-only\/adodb-518-for-php5\/adodb518a.tgz<\/span>
# wget http:\/\/nchc.dl.sourceforge.net\/project\/secureideas\/BASE\/base-1.4.5\/base-1.4.5.tar.gz<\/span>
# tar zxvf base-1.4.5.tar.gz -C \/var\/www\/html<\/span>
# mv \/var\/www\/html\/base-1.4.5 \/var\/www\/html\/base<\/span>
# chmod a+w \/var\/www\/html\/base<\/span>
# tar zxvf adodb518a.tgz -C \/var\/www\/html<\/span>
# chmod a+w \/var\/www\/html\/adodb5<\/span>
# \u4fee\u6539 \/etc\/php.ini
# vim \/etc\/php.ini<\/span>
date.timezone = “Asia\/Taipei”<\/span>
error_reporting = E_ALL & ~E_NOTICE<\/span>
\u627e\u5230
; UNIX: “\/path1:\/path2”<\/span>
;include_path = “.:\/php\/includes”<\/span>
\u5e95\u4e0b\u589e\u52a0\u4e00\u884c
include_path => .:\/usr\/share\/pear:\/usr\/share\/php<\/span><\/p>\n

24. \u91cd\u65b0\u555f\u52d5 Web Server
# systemctl restart httpd<\/span><\/p>\n

25. \u66f4\u6539\u76ee\u9304\u6b0a\u9650
# chmod a-w \/var\/www\/html\/base<\/span>
# chmod a-w \/var\/www\/html\/adodb5<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u9801\uff1aSuricata + Barnyard + BASE \u5b89\u88dd \u2013 Neverland \u5e95\u4e0b\u53c3\u8003\u81ea\uff1a\u8b93S … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5b89\u88dd Barnyard2 \/ Base \/ Adodb – For Suricata\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,146],"tags":[],"class_list":["post-19521","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-78491"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["687426"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19521"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19521"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19521\/revisions"}],"predecessor-version":[{"id":21036,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19521\/revisions\/21036"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19521"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19521"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19521"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}