Snort

来自开放百科 - 灰狐
(版本间的差异)
跳转到: 导航, 搜索
(Snort移动到Snort (software))

2010年9月20日 (一) 06:16的版本

Wikipedia-35x35.png 您可以在Wikipedia上了解到此条目的英文信息 Snort Thanks, Wikipedia.
Snort-90x90.gif

Snort - the de facto standard for intrusion detection/prevention

目录

Install

Debian

apt-get install snort
apt-get install snort-doc

PostgreSQL

apt-get install snort-pgsql

MySQL

mysql> create database snort;
mysql> grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on snort.* to snort@localhost;
mysql> set password for snort@localhost=PASSWORD('snort');
mysql> flush privileges;
mysql -u root -p snort <//home/allen/snort-2.8.3.2/schemas/create_mysql
edit the /etc/snort/snort.conf 
var HOME_NET 192.168.0.0/24
var EXTERNAL_NET !$HOME_NET
var RULE_PATH /etc/snort/rules
output database: log, mysql, user=snort password=snort dbname=snort host=localhost
chown root:snort /etc/snort/snort.conf
chmod 0640 /etc/snort/snort.conf
/usr/sbin/snort -c /etc/snort/snort.conf &
or 
/usr/bin/snort -c /etc/snort/snort.conf -D -g snort -u snort -i eth0 -l /var/log/snort
echo "SELECT hostname FROM sensor;" | mysql -u root -p snort

Run

/usr/local/bin/snort -d -h 192.168.1.0/24 -l /var/log/snort -c /usr/local/etc/snort.conf -s -D

Links

分享您的观点
个人工具
名字空间

变换
操作
导航
工具箱