snortのログをbaseで確認

2005.06.23

前書き

snortのログをbaseで確認できるようにする

PostreSQL対応のsnortをインストールする

BASEのページより、rpmをダウンロードし てインストール
$ cd /tmp
$ wget http://jaist.dl.sourceforge.net/sourceforge/secureideas/base-1.1.3-1.i386.rpm
--19:18:48--  http://jaist.dl.sourceforge.net/sourceforge/secureideas/base-1.1.3-1.i386.rpm
           => `base-1.1.3-1.i386.rpm'
jaist.dl.sourceforge.net をDNSに問いあわせています... 150.65.7.130
jaist.dl.sourceforge.net[150.65.7.130]:80 に接続しています... 接続しました。
HTTP による接続要求を送信しました、応答を待っています... 200 OK
長さ: 304,719 [application/x-redhat-package-manager]

100%[===============================================================================>] 304,719        1.05M/s            

19:18:48 (1.05 MB/s) - `base-1.1.3-1.i386.rpm' saved [304,719/304,719]


# rpm -ivh base-1.1.3-1.i386.rpm
Preparing...                ########################################### [100%]
   1:base                   ########################################### [100%]

ADOdbをインストールする

ADOdbのページより、rpmをダウンロードしてインス トール
$ cd /tmp
$ wget http://jaist.dl.sourceforge.net/sourceforge/adodb/adodb464.tgz
--19:46:26--  http://jaist.dl.sourceforge.net/sourceforge/adodb/adodb464.tgz
           => `adodb464.tgz'
jaist.dl.sourceforge.net をDNSに問いあわせています... 150.65.7.130
jaist.dl.sourceforge.net[150.65.7.130]:80 に接続しています... 接続しました。
HTTP による接続要求を送信しました、応答を待っています... 200 OK
長さ: 419,110 [application/x-gzip]

100%[===============================================================================>] 419,110      997.21K/s            

19:46:27 (996.32 KB/s) - `adodb464.tgz' saved [419,110/419,110]

$ cd /var/www/html
$ sudo tar zxvf /tmp/adodb464.tgz
adodb/adodb-csvlib.inc.php
adodb/adodb-datadict.inc.php
adodb/adodb-error.inc.php
adodb/adodb-errorhandler.inc.php
adodb/adodb-errorpear.inc.php
adodb/adodb-exceptions.inc.php
adodb/adodb-iterator.inc.php
adodb/adodb-lib.inc.php
adodb/adodb-pager.inc.php
adodb/adodb-pear.inc.php
adodb/adodb-perf.inc.php
adodb/adodb-php4.inc.php
adodb/adodb-time.inc.php
adodb/adodb-time.zip
adodb/adodb-xmlschema.inc.php
adodb/adodb.inc.php
adodb/license.txt
adodb/pivottable.inc.php
adodb/readme.txt
adodb/rsfilter.inc.php
adodb/server.php
adodb/toexport.inc.php
adodb/tohtml.inc.php
adodb/xmlschema.dtd
adodb/perf/perf-db2.inc.php
adodb/perf/perf-informix.inc.php
adodb/perf/perf-mssql.inc.php
adodb/perf/perf-mysql.inc.php
adodb/perf/perf-oci8.inc.php
adodb/perf/perf-postgres.inc.php
adodb/session/adodb-compress-bzip2.php
adodb/session/adodb-compress-gzip.php
adodb/session/adodb-cryptsession.php
adodb/session/adodb-encrypt-mcrypt.php
adodb/session/adodb-encrypt-md5.php
adodb/session/adodb-encrypt-secret.php
adodb/session/adodb-sess.txt
adodb/session/adodb-session-clob.php
adodb/session/adodb-session.php
adodb/session/adodb-sessions.mysql.sql
adodb/session/adodb-sessions.oracle.clob.sql
adodb/session/adodb-sessions.oracle.sql
adodb/session/crypt.inc.php
adodb/session/session_schema.xml
adodb/pear/readme.Auth.txt
adodb/pear/Auth/Container/ADOdb.php
adodb/session/old/adodb-cryptsession.php
adodb/session/old/adodb-session-clob.php
adodb/session/old/adodb-session.php
adodb/session/old/crypt.inc.php
adodb/drivers/adodb-access.inc.php
adodb/drivers/adodb-ado.inc.php
adodb/drivers/adodb-ado5.inc.php
adodb/drivers/adodb-ado_access.inc.php
adodb/drivers/adodb-ado_mssql.inc.php
adodb/drivers/adodb-borland_ibase.inc.php
adodb/drivers/adodb-csv.inc.php
adodb/drivers/adodb-db2.inc.php
adodb/drivers/adodb-fbsql.inc.php
adodb/drivers/adodb-firebird.inc.php
adodb/drivers/adodb-ibase.inc.php
adodb/drivers/adodb-informix.inc.php
adodb/drivers/adodb-informix72.inc.php
adodb/drivers/adodb-ldap.inc.php
adodb/drivers/adodb-mssql.inc.php
adodb/drivers/adodb-mssqlpo.inc.php
adodb/drivers/adodb-mysql.inc.php
adodb/drivers/adodb-mysqli.inc.php
adodb/drivers/adodb-mysqlt.inc.php
adodb/drivers/adodb-netezza.inc.php
adodb/drivers/adodb-oci8.inc.php
adodb/drivers/adodb-oci805.inc.php
adodb/drivers/adodb-oci8po.inc.php
adodb/drivers/adodb-odbc.inc.php
adodb/drivers/adodb-odbc_mssql.inc.php
adodb/drivers/adodb-odbc_oracle.inc.php
adodb/drivers/adodb-odbtp.inc.php
adodb/drivers/adodb-odbtp_unicode.inc.php
adodb/drivers/adodb-oracle.inc.php
adodb/drivers/adodb-pdo.inc.php
adodb/drivers/adodb-postgres.inc.php
adodb/drivers/adodb-postgres64.inc.php
adodb/drivers/adodb-postgres7.inc.php
adodb/drivers/adodb-postgres8.inc.php
adodb/drivers/adodb-proxy.inc.php
adodb/drivers/adodb-sapdb.inc.php
adodb/drivers/adodb-sqlanywhere.inc.php
adodb/drivers/adodb-sqlite.inc.php
adodb/drivers/adodb-sqlite.inc.php.bak
adodb/drivers/adodb-sqlitepo.inc.php
adodb/drivers/adodb-sybase.inc.php
adodb/drivers/adodb-sybase_ase.inc.php
adodb/drivers/adodb-vfp.inc.php
adodb/lang/adodb-ar.inc.php
adodb/lang/adodb-bg.inc.php
adodb/lang/adodb-bgutf8.inc.php
adodb/lang/adodb-ca.inc.php
adodb/lang/adodb-cn.inc.php
adodb/lang/adodb-cz.inc.php
adodb/lang/adodb-da.inc.php
adodb/lang/adodb-de.inc.php
adodb/lang/adodb-en.inc.php
adodb/lang/adodb-es.inc.php
adodb/lang/adodb-esperanto.inc.php
adodb/lang/adodb-fr.inc.php
adodb/lang/adodb-hu.inc.php
adodb/lang/adodb-it.inc.php
adodb/lang/adodb-nl.inc.php
adodb/lang/adodb-pl.inc.php
adodb/lang/adodb-pt-br.inc.php
adodb/lang/adodb-ro.inc.php
adodb/lang/adodb-ru1251.inc.php
adodb/lang/adodb-sv.inc.php
adodb/lang/adodb-uk1251.inc.php
adodb/tests/benchmark.php
adodb/tests/client.php
adodb/tests/pdo.php
adodb/tests/test-datadict.php
adodb/tests/test-perf.php
adodb/tests/test-pgblob.php
adodb/tests/test-php5.php
adodb/tests/test-xmlschema.php
adodb/tests/test.php
adodb/tests/test2.php
adodb/tests/test3.php
adodb/tests/test4.php
adodb/tests/test5.php
adodb/tests/test_rs_array.php
adodb/tests/testcache.php
adodb/tests/testdatabases.inc.php
adodb/tests/testgenid.php
adodb/tests/testmssql.php
adodb/tests/testoci8.php
adodb/tests/testoci8cursor.php
adodb/tests/testpaging.php
adodb/tests/testpear.php
adodb/tests/testsessions.php
adodb/tests/time.php
adodb/tests/tmssql.php
adodb/tests/xmlschema-mssql.xml
adodb/tests/xmlschema.xml
adodb/cute_icons_for_site/adodb.gif
adodb/cute_icons_for_site/adodb2.gif
adodb/datadict/datadict-access.inc.php
adodb/datadict/datadict-db2.inc.php
adodb/datadict/datadict-firebird.inc.php
adodb/datadict/datadict-generic.inc.php
adodb/datadict/datadict-ibase.inc.php
adodb/datadict/datadict-informix.inc.php
adodb/datadict/datadict-mssql.inc.php
adodb/datadict/datadict-mysql.inc.php
adodb/datadict/datadict-oci8.inc.php
adodb/datadict/datadict-postgres.inc.php
adodb/datadict/datadict-sapdb.inc.php
adodb/datadict/datadict-sybase.inc.php
adodb/contrib/toxmlrpc.inc.php
adodb/xsl/convert-0.1-0.2.xsl
adodb/xsl/convert-0.2-0.1.xsl
adodb/xsl/remove-0.2.xsl
adodb/docs/docs-adodb.htm
adodb/docs/docs-datadict.htm
adodb/docs/docs-oracle.htm
adodb/docs/docs-perf.htm
adodb/docs/docs-session.htm
adodb/docs/old-changelog.htm
adodb/docs/readme.htm
adodb/docs/tips_portable_sql.htm
adodb/docs/tute.htm
# chown -R apache:apache adodb


BASEの設定ファイル編集


$ cd /usr/share/base-php4
$ sudo cp -p base_conf.php.dist base_conf.php
# vi base_conf.php


<編集前>
$BASE_Language = "english";
$BASE_urlpath = "";
$DBlib_path = ""
$DBtype = "mysql";
$alert_dbname   = "snort_log";
$alert_password = "mypassword";

<編集後>
$BASE_Language = "japanese";
$BASE_urlpath = "/base";
$DBlib_path = "/var/www/html/adodb";
$DBtype = "postgres";
$alert_dbname   = "snort";
$alert_password = "";

gd(PHP用graphics library)のインストール


# yum install php-gd
Setting up Install Process
Setting up Repos
base                      100% |=========================| 1.1 kB    00:00
updates-released          100% |=========================|  951 B    00:00
Reading repository metadata in from local files
base      : ################################################## 2622/2622
updates-re: ################################################## 853/853
Parsing package install arguments
Resolving Dependencies
--> Populating transaction set with selected packages. Please wait.
---> Downloading header for php-gd to pack into transaction set.
php-gd-4.3.11-2.5.i386.rp 100% |=========================|  16 kB    00:00
---> Package php-gd.i386 0:4.3.11-2.5 set to be updated
--> Running transaction check

Dependencies Resolved
Transaction Listing:
  Install: php-gd.i386 0:4.3.11-2.5 - updates-released
Total download size: 95 k
Is this ok [y/N]: y
Downloading Packages:
(1/1): php-gd-4.3.11-2.5. 100% |=========================|  95 kB    00:00
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing: php-gd 100 % done 1/1

Installed: php-gd.i386 0:4.3.11-2.5
Complete!


PEAR::Image_Graphのインストール

BASE1.1より、PHP用グラフ作成ライブラリとして、jpgraphではなく
PEAR::Image_Graphを使用することになったようです。
# pear install Image_Color
downloading Image_Color-1.0.1.tgz ...
Starting to download Image_Color-1.0.1.tgz (7,718 bytes)
.....done: 7,718 bytes
install ok: Image_Color 1.0.1

# pear install Log
downloading Log-1.8.7.tgz ...
Starting to download Log-1.8.7.tgz (32,693 bytes)
.........done: 32,693 bytes
Optional dependencies:
'sqlite' PHP extension is recommended to utilize some features
install ok: Log 1.8.7

# pear install Numbers_Roman
downloading Numbers_Roman-0.2.0.tgz ...
Starting to download Numbers_Roman-0.2.0.tgz (3,753 bytes)
....done: 3,753 bytes
install ok: Numbers_Roman 0.2.0

# pear install http://pear.php.net/get/Numbers_Words-0.13.1.tgz
downloading Numbers_Words-0.13.1.tgz ...
Starting to download Numbers_Words-0.13.1.tgz (44,185 bytes)
............done: 44,185 bytes
install ok: Numbers_Words 0.13.1

# pear install http://pear.php.net/get/Image_Graph-0.3.0dev4.tgz
downloading Image_Graph-0.3.0dev4.tgz ...
Starting to download Image_Graph-0.3.0dev4.tgz (144,077 bytes)
................................done: 144,077 bytes
install ok: Image_Graph 0.3.0dev4

apacheの再起動


# /etc/init.d/httpd restart
httpd を停止中:                                             [  OK  ]
httpd を起動中:                                             [  OK  ]


BASEのページへアクセス


ブラウザで、BASEの設定ページへアクセスし、リンク「Setup page」をクリック
URLは、http://BASEをインストールしたホスト /base/base_main.php



20050623_010.gif


Postgresqlにテーブルを作成


ボタン「Create BASE AG」をクリック

20050623_020.gif


Postgresqlにテーブルを作成

エラーが出ていないことを確認する

Postgresqlにテーブルを作成


再度BASEのページへアクセス

再 度、http://BASEをインストールしたホスト /base/base_main.php へアクセス。
設定が完璧であれば、このような画面が出ます。思う存分、IDSのすばらしさを堪能してください。
20050623_040.gif

導入手順書へ戻る