Install the lightweight intrusion Monitoring System-Linux Enterprise Application-Linux Server Application On Debian. For details, see the following. Snort is a well-known lightweight IDS. Yesterday, a netizen reminded me that the first attempt to install it on debian was very simple.
To facilitate the analysis results, ACID is also installed. The process is briefly described below.
First, install apache + php4 + mysql. There are a large number of related documents on the Internet, so it is no longer a waste of resources.
Create a database snortdb for mysql to store snort output;
Create an account snort @ localhost to manage the database, except GRANT permissions.
If you are not familiar with mysql commands, you can use phpmyadmin (many bugs have been found before)
Web-Based Visual mysql management tool
Install snort-mysql. snort-common and snort-rules-default are automatically installed.
# Apt-get install snort-mysql
After the installation, answer several questions about the configuration script, and then remember to set up tables in snortdb.
Zcat/usr/share/doc/snort-mysql/contrib/create_mysql.gz | mysql-u [id]-p-h [host] [snort-database]
If it is the same as I mentioned above, [id] = snort [host] = localhost [snort-database] = snortdb
You may want to manually modify/etc/snort. conf/etc/snort/rules/* to suit your system situation.
Install acidlab
# Apt-get install acidlab
I also want to answer a few questions. snort-achieve-db also uses the snotdb library.
Now, let's take a look at http: // [yourhost]/acidlab/in the browser.
Debian is really good, saving yourself the need to change the script to make these things work together.
Note the following points:
1. Set up. htpasswd to protect http: // [yourhost]/acidlab/directory
2. Remember to update your snort-rules frequently.
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.