Install a lightweight intrusion Monitoring System On Debian

Install the lightweight intrusion Monitoring System-Linux Enterprise Application-Linux Server Application On Debian. For details, see the following. Snort is a well-known lightweight IDS. Yesterday, a netizen reminded me that the first attempt to install it on debian was very simple.
To facilitate the analysis results, ACID is also installed. The process is briefly described below.

First, install apache + php4 + mysql. There are a large number of related documents on the Internet, so it is no longer a waste of resources.
Create a database snortdb for mysql to store snort output;
Create an account snort @ localhost to manage the database, except GRANT permissions.
If you are not familiar with mysql commands, you can use phpmyadmin (many bugs have been found before)
Web-Based Visual mysql management tool

Install snort-mysql. snort-common and snort-rules-default are automatically installed.
# Apt-get install snort-mysql
After the installation, answer several questions about the configuration script, and then remember to set up tables in snortdb.
Zcat/usr/share/doc/snort-mysql/contrib/create_mysql.gz | mysql-u [id]-p-h [host] [snort-database]
If it is the same as I mentioned above, [id] = snort [host] = localhost [snort-database] = snortdb
You may want to manually modify/etc/snort. conf/etc/snort/rules/* to suit your system situation.

Install acidlab
# Apt-get install acidlab
I also want to answer a few questions. snort-achieve-db also uses the snotdb library.

Now, let's take a look at http: // [yourhost]/acidlab/in the browser.
Debian is really good, saving yourself the need to change the script to make these things work together.

Note the following points:
1. Set up. htpasswd to protect http: // [yourhost]/acidlab/directory
2. Remember to update your snort-rules frequently.