当前位置：网站首页>Getting started with web security - deploy snort open source ids/ips system

Getting started with web security - deploy snort open source ids/ips system

2022-07-19 11:04:00 【51CTO】

This article simply deploys open source IDS/IPS System


1、windows Server deployment snort


web Safe entry - Deploy Snort Open source IDS/IPS System _snort


The environment is as follows ：

1、npcap Software

2、snort2 Software

3、windows_server2016


download npcap Software


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_02


land npcap Website , Click on “ download ”


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_03


Select the corresponding version to download


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_04


download


open snort Website


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _05


choice “download”


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _06


choice exe Version to download


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _07


download


3、windows server


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _08


Install the standard version


4、 install npcap


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_09


I agree


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_10


install


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_11


Waiting for the installation


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _12


next


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _13


finish


6、 install snort


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_14


I  agree 


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _15


next


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_16


next


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_17


close


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_18


Click ok


7、 Prepare to edit the file


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_19


Open the installation directory

The default is in C disc


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _20



bin Folder


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _21


Input cmd

Open here cmd


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _22



Input 


      
      

       
       snort -ev
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_23


snort Has been launched


And is already crawling data


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_24


ctrl + c You can stop


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_25


Statistics


8、 edit snort.conf


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_26


Open Directory


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_27



Notepad open


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_28



It can be opened by writing pad


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_29


find windows users


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_30


Directory location


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _31


rules Catalog


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _32


download rules


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _33


Click on sign in


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_34


Click on sign up


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_35


To register


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_36



Download rule library


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_37


Put in rules In the folder


1、snort It's an engine , It is a system

2、 Data collection is also needed

3、 Data analysis 、 classification 、 Arrangement

4、 Visual interface


2、linux Server deployment snort


1、 Install basic dependency package 


      
      

       
       yum 
       
       install 
       
       vim 
       
       git 
       
       wget 
       
       net
       
       -
       
       tools
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _38


choice yes


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_39


choice y


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _40


Installation completed 


      
      

       
       yum 
       
       install 
       
       flex 
       
       bison 
       
       gcc 
       
       gcc
       
       -
       
       c
       
       ++ 
       
       make
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_41


Input 


      
      

       
       rm 
       
       -
       
       f 
       
       /
       
       var
       
       /
       
       run
       
       /
       
       yum.
       
       pid
      
      

      
      
    
       
       
  • 1.
    •


End yum, restart yum process


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_42


Input 


      
      

       
       yum 
       
       install 
       
       flex 
       
       bison 
       
       gcc 
       
       gcc
       
       -
       
       c
       
       ++ 
       
       make
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _43


Input y


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _44


Updating


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_45


Input 


      
      

       
       yum 
       
       install 
       
       libdnet
       
       -
       
       devel 
       
       hwloc
       
       -
       
       devel 
       
       openssl
       
       -
       
       devel 
       
       zlib
       
       -
       
       devel 
       
       pkgconfig
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _46


Input y


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _47


install cmake Tools


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _48


Download the source code


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_49


Put it on the desktop 


      
      

       
       cd 
       
       cmake
       
       -
       
       3.24.0
       
       -
       
       rc3
       
       /
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_50


perform 


      
      

       
       .
       
       /
       
       configure
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _51


In execution


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_52


compile 


      
      

       
       make
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_53


Have in hand


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_54



install 


      
      

       
       make 
       
       install
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_55


install LuaJIT


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_56


To download


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _57


Entry directory 


      
      

       
       cd 
       
       LuaJIT
       
       -
       
       2.0.5
       
       /
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _58


Compile and install 


      
      

       
       make 
       
       && 
       
       make 
       
       install
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _ intrusion detection system IPS_59


In execution


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _60


Copy file 


      
      

       
       cp 
       
       /
       
       usr
       
       /
       
       local
       
       /
       
       lib
       
       /
       
       pkgconfig
       
       /
       
       luajit.
       
       pc 
       
       /
       
       usr
       
       /
       
       lib64
       
       /
       
       pkgconfig
       
       /
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _61


      
      

       
       yum 
       
       install 
       
       luajit
       
       -
       
       devel
      
      

      
      
    
       
       
  • 1.
    •


Install first PCRE


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _62


download


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _63


Entry directory 


      
      

       
       cd 
       
       pcre
       
       -
       
       8.45
       
       /
      
      

      
      
    
       
       
  • 1.
    • 
      
      


      
      

       
       .
       
       /
       
       configure 
       
       --
       
       libdir
       
       =/
       
       usr
       
       /
       
       lib64 
       
       --
       
       includedir
       
       =/
       
       usr
       
       /
       
       include
       
       /
      
      

      
      
    
       
       
  • 1.
    • 
      
      


      
      

       
       make
      
      

      
      
    
       
       
  • 1.
    • 
      
      


      
      

       
       make 
       
       install
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort Installation and deployment _64


install libpcap


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_65


      
      

       
       .
       
       /
       
       configure
      
      

      
      
    
       
       
  • 1.
    • 
      
      


      
      

       
       make 
       
       && 
       
       make 
       
       install
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_66


      
      

       
       yum 
       
       install 
       
       libpcap
       
       -
       
       devel
      
      

      
      
    
       
       
  • 1.
    •


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_67


Input y


web Safe entry - Deploy Snort Open source IDS/IPS System _snort_68


Because it is installed manually snort, So this is the end of the installation tutorial .

snort Just an intrusion detection system engine . Later, we will install visual IDS.

原网站

版权声明
本文为[51CTO]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/200/202207171340244004.html

边栏推荐

猜你喜欢

随机推荐