Instalasi SNORT dan BASE: Difference between revisions

From OnnoCenterWiki
Jump to navigationJump to search
← Older edit
Onnowpurbo (talk | contribs)
69,477 edits
Onnowpurbo (talk | contribs)
69,477 edits
No edit summary
Onnowpurbo (talk | contribs)
69,477 edits
No edit summary
 
(32 intermediate revisions by 2 users not shown)
Line 1: Line 1:
Download [[SNORT]] & [[SNORT RULES]] versi terakhir dari
* [[SNORT: Compile SNORT dan BASE]]
* [[SNORT: Install SNORT]]
* [[SNORT: Install SNORT untuk BARNYARD2]] '''RECOMMENDED'''


http://www.snort.org/dl/
==Bacaan==
http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-CURRENT.tar.gz
 
 
Siapkan [[software]] pendukung
 
# apt-get install libpcre3 libpcre3-dev libpcrecpp0 libpcap0.8 libpcap0.8-dev \
mysql-server libmysqlclient15-dev libphp-adodb libgd2-xpm libgd2-xpm-dev php5-mysql \
php5-gd php-image-graph php-image-canvas php-pear
 
Untuk [[Ubuntu]] 9.04 tampaknya menggunakan
 
# apt-get install libpcre3 libpcre3-dev libpcrecpp0 libpcap0.8 libpcap0.8-dev \
mysql-server libmysqlclient15-dev libphp-adodb libgd2-xpm libgd2-xpm-dev php5-mysql \
php5-gd php-pear
 
Untuk [[Ubuntu]] 10.04
 
# apt-get install libpcre3 libpcre3-dev libpcrecpp0 libpcap0.8 libpcap0.8-dev \
mysql-server libmysqlclient15-dev libphp-adodb libgd2-xpm libgd2-xpm-dev php5-mysql \
php5-gd php-pear
 
Karena [[BASE]] menggunakan [[PHP4]], sebaiknya pakai yang mengenali [[PHP4]] dan [[PHP5]] seperti ini
 
cp adodb4992.tgz /var
cd /var
tar zxvf adodb4992.tgz
 
 
Restart [[Server]]
 
/etc/init.d/apache2 restart
/etc/init.d/mysql restart
 
Install [[snort]]
 
 
cp -Rf snort-2.8.6.tar.gz /usr/local/src/
cd /usr/local/src
tar zxvf snort-2.8.6.tar.gz
 
cd /usr/local/src/snort-2.8.6
./configure --with-mysql
make
make install
 
groupadd snort
useradd -g snort snort
mkdir /etc/snort
mkdir /etc/snort/rules
mkdir /var/log/snort
 
 
Ambil [[Snort Rules]] dari
 
http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-CURRENT.tar.gz
 
Tampaknya alamat di atas sudah tidak valid lagi. Perlu di cari community rules snort yang bebas / gratis :( ..
Jika anda berhasil memperoleh community rules snort, lakukan copy [[Snort Rules]]
 
cp snortrules-snapshot-CURRENT.tar.gz /etc/snort/
cd /etc/snort
tar zxvf snortrules-snapshot-CURRENT.tar.gz
 
 
Siapkan konfigurasi [[Snort]]
 
cp /usr/local/src/snort-2.8.5.1/etc/* /etc/snort
cd /etc/snort/
mkdir /etc/snort/preproc_rules
vi /etc/snort/snort.conf
 
        “var RULE_PATH ../rules” -> “var RULE_PATH /etc/snort/rules”
        "var PREPROC_RULE_PATH ../preproc_rules" -> "var PREPROC_RULE_PATH /etc/snort/preproc_rules"
        output database: log, mysql, user=snort password=snort dbname=snort host=localhost
 
 
Ujicoba jalankan [[snort]], karena [[Snort rules]] yang digunakan biasanya masih banyak bug / error dan harus dibuang supaya hanya rules yang baik yang digunakan
 
# /usr/local/bin/snort -dev -c /etc/snort/snort.conf
 
 
Contoh error
 
Initializing rule chains...
ERROR: (/etc/snort/rules/web-misc.rules)98 => Cannot use 'rawbytes' and  'http_uri' as modifiers for the same "content" nor use 'rawbytes' with  "uricontent".
Fatal Error, Quitting..
 
 
Artinya
 
* file /etc/snort/rules/web-misc.rules mengandung error pada line 98
* edit file /etc/snort/rules/web-misc.rules dan buang line yang ada error-nya
 
 
Siapkan snort di rc.local
 
# vi /etc/rc.local
 
masukan
 
/usr/local/bin/snort -dev -c /etc/snort/snort.conf -D
 
 
 
Siapkan [[database]] [[MySQL]]
 
mysql
mysql> SET PASSWORD FOR root@localhost=PASSWORD('password');
 
Selanjutnya dengan [[database]] [[MySQL]]
 
# mysql -u root -p
Enter password:
create database snort;
grant INSERT,SELECT on root.* to snort@localhost;
grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort@localhost IDENTIFIED BY 'snortpass' ;
grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort IDENTIFIED BY 'snortpass' ;
exit
 
 
Atau jika anda masih dalam tahap ujicoba bukan untuk operasional,
dengan asumsi username snort, password snort, database snort; dapat menggunakan perintah
 
# mysql -u root -p
Enter password:
create database snort;
grant ALL on root.* to snort@localhost;
grant ALL on snort.* to snort@localhost IDENTIFIED BY 'snort' ;
grant ALL on snort.* to snort IDENTIFIED BY 'snort' ;
exit
 
 
Siapkan tabel di [[database]] [[snort]]
 
# mysql -u root -p < /usr/local/src/snort-2.8.5.1/schemas/create_mysql snort
password:
 
 
Cek [[database]] [[snort]]
 
# mysql -p
Enter password:
mysql> show databases;
mysql> use snort
mysql> show tables;
mysql> exit
 
 
Entah kenapa [[BASE]] versi 1.4 susah untuk di instalasi. Mungkin sebaiknya di coba menggunakan versi lama versi 1.3.9.
 
Install [[BASE]] untuk versi 1.3.9
 
cp base-1.3.9.tar.gz /var/www/
cd /var/www
tar zxvf base-1.3.9.tar.gz
mv base-1.3.9 base
cd /var/www/base
cp base_conf.php.dist base_conf.php
 
 
Install [[BASE]] untuk versi 1.4.4
 
cp base-1.4.4.tar.gz /var/www/
cd /var/www
tar zxvf base-1.4.4.tar.gz
mv base-1.4.4 base
cd /var/www/base
cp base_conf.php.dist base_conf.php
 
 
 
Edit konfigurasi [[BASE]]
 
# vi base_conf.php
$BASE_urlpath = "/base";
# $DBlib_path = "/usr/share/php/adodb/";
$DBlib_path = "/var/adodb/"; - gunakan ini untuk instalasi adodb manual
$DBtype = "mysql";
 
$alert_dbname  = 'snort';
$alert_host    = 'localhost';
$alert_port    = '';
$alert_user    = 'snort';
$alert_password = 'snort';
 
$archive_exists  = 0;
$archive_dbname  = 'snort';
$archive_host    = 'localhost';
$archive_port    = '';
  $archive_user    = 'snort';
$archive_password = 'snort';
 
 
Beri ijin [[Apache]] [[Web Server]] mengakses folder [[BASE]]
 
# chown -Rf www-data.www-data /var/www/base
 
 
Akses [[Web]] [[SNORT]] & [[BASE]]
 
http://localhost/base
 
Setup page
CREATE BASE AG
Main page


* http://willy.lecturer.maranatha.edu/?p=817


==Referensi==


* http://125.160.17.21/speedyorari/index.php?dir=snort/rules '''RULES JADOEL untuk Percobaan'''
* http://www.snort.org/snort-downloads
* http://www.snort.org/dl/
* http://www.snort.org/start/rules
* http://base.secureideas.net/


==Pranala Menarik==
==Pranala Menarik==


* [[SNORT]]
* [[Linux Howto]]
* [[Linux Howto]]
[[Category: Linux]]
[[Category: Network Security]]

Latest revision as of 22:36, 11 September 2015

Bacaan

Referensi

Pranala Menarik

Retrieved from "https://lms.onnocenter.or.id/wiki/index.php?title=Instalasi_SNORT_dan_BASE&oldid=44408"