ubuntu 12.04 Sagan IDS

暫時紀錄一下
這是LOG分析的IDS
原廠網址
http://sagan.quadrantsec.com/



//******紀錄安裝步驟*********//

//套件

apt-get -y install flex bison gcc g++ libesmtp-dev libpcap0.8-dev make

libpcre3-dev libpcre3 liblognorm0 liblognorm-dev libdumbnet1 libdumbnet-dev
mysql-server-5.5 mysql-client-5.5 libmysqlclient15-dev

wget http://libdnet.googlecode.com/files/libdnet-1.12.tgz
tar zxvf libdnet-1.12.tgz
cd libdnet-1.12
./configure
make
make install

wget http://www.tcpdump.org/release/libpcap-1.3.0.tar.gz
tar zxvf libpcap-1.3.0.tar.gz
cd libpcap-1.3.0
./configure
make
make install

//主程式

wget http://sagan.quadrantsec.com/download/sagan-0.3.0.tar.gz
tar zxvf sagan-0.3.0.tar.gz
cd sagan-0.3.0
./configure --with-mysql-libraries=/usr/lib/i386-linux-gnu/  --disable-postgresql --disable-prelude --disable-lognorm --with-libpcap-libraries=/usr/lib/i386-linux-gnu/  --build=x86_64-unknown-linux
make
make install

******************************************************

vi /etc/rsyslog.conf

# The standard "input" template Sagan uses. Basically the message 'format' Sagan understands. The template is _one_ line. $template sagan,"%fromhost-ip%|%syslogfacility-text%|%syslogpriority-text%|%syslogseverity-text%|%syslogtag%|%timegenerated:1:10:date-rfc3339%|%timegenerated:12:19:date-rfc3339%|%programname%|%msg%\n" # The FIFO/named pipe location. This is what Sagan will read. *.* |/var/run/sagan.fifo;sagan

******************************************************

mkfifo /var/run/sagan.fifo
/etc/init.d/rsyslog restart

useradd sagan -s /sbin/nologin

//****useradd sagan --shell /sbin/nologin --home /****//
chown sagan:sagan /var/run/sagan.fifo
mkdir /var/log/sagan
mkdir /var/run/sagan
chown -R sagan:sagan /var/log/sagan
chown -R sagan:sagan /var/run/sagan
chown sagan:sagan /var/run/sagan.fifo

//****rules****//

wget http://sagan.quadrantsec.com/rules/sagan-rules-current.tar.gz
tar zxvf sagan-rules-current.tar.gz
cd /usr/local/etc
mkdir sagan-rules
cd sagan-rules