平行地球

2.1.13

卡巴斯基實驗室針對2013年的資安預測

Security forecast for 2013

The end of the year is traditionally a time for reflection – for taking stock of our lives and looking to the future. So we’d like to offer you our forecast for the year ahead, looking at the key issues that we believe are likely to dominate the security landscape in 2013. Of course, the future is always rooted in the present, so our security retrospective, outlining the key trends of 2012, is a good starting-point.

1.1.13

Ubuntu1204 + Bro-IDS 2.1

apt-get install //安裝相關套件

libncurses5-dev

g++

gcc

bison

flex

libmagic-dev

libgeoip-dev

libssl-dev

build-essential

python-dev

libpcap-dev

cmake

swig2.0

libssl0.9.8

make

下載Bro-IDS安裝
wget http://www.bro-ids.org/downloads/release/bro-2.1.tar.gz //下載
tar zxvf bro-2.1.tar.gz //解壓縮
cd bro-2.1 //切換目錄
./configure //編譯
make
make install //安裝

/usr/local/bro //安裝預設目錄

/usr/local/bro/bin/broctl //執行broctl

[BroControl] > install // 產生預設腳本
[BroControl] > start //啟動

CentOS 6.3 + Firestorm NIDS 0.5.4 //模組，rules更新

rpm -q libpcap //-q 查看 libpcap版本 //-e 移除 libpcap版本
rpm -e libpcap //firestorm-0.5.4支援libpcap-0.6.2版，如不對請重新安裝
rpm -ivh
ftp://ftp.pbone.net/mirror/archive.download.redhat.com/pub/redhat/linux/7.3/en/os/i386/RedHat/RPMS/libpcap-0.6.2-12.i386.rpm
//安裝libpcap-0.6.2-12.i386.rpm
rpm -ivh http://www.scaramanga.co.uk/firestorm/v0.5.4/firestorm-0.5.4-1.i386.rpm
//安裝firestorm-0.5.4-1.i386.rpm
find / -name firestorm //查看系統內的firestorm相關資料夾

下載snortrules-snapshot-2945.tar.gz
解壓縮後，將so_rules/precompiled/RHEL-6.0/i386/2.9.4.5/裡面全部的.so都複製到
/usr/lib/firestorm/protocols/
將rules裡面的全部.rules都複製到
/var/lib/firestorm/snort-rules/
編輯/etc/firestorm.conf
將新規則打入到最後一行

/etc/rc.d/init.d/firestorm restart //重新啟動