搭建基于Suricata+Barnyard2+Base的IDS前端Snorby

[[email protected] ~]#yum -y install libyaml libyaml-devel gcc gcc-c++ make file file-devel git libxslt-devel curl curl-devel ImageMagic ImageMagic-devel  [[email protected] ~]#yum -y install mysql mysql-libs mysql-server mysql-devel  [[email protected] ~]#/usr/bin/mysql_secure_installation  [[email protected] ~]#yum -y install httpd httpd-devel apr-utils php php-common php-cli php-pear php-curl php-mcrypt php-pecl php-devel  php-mysql  [[email protected] ~]#ln -sf /usr/lib64/mysql /usr/lib/mysql  [[email protected] ~]#sed -i 's/Options Indexes FollowSymLinks/Options FollowSymLinks/g' /etc/httpd/conf/httpd.conf  [[email protected] ~]#sed -i 's/ServerTokens OS/ServerTokens Prod/g' /etc/httpd/conf/httpd.conf  [[email protected] ~]#sed -i 's/ServerAdmin [email protected]/ServerAdmin [email protected]/g' /etc/httpd/conf/httpd.conf  [[email protected] ~]#/etc/init.d/httpd restart  

[[email protected] opt]#wget http://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.3-p327.tar.gz  [[email protected] opt]#tar zxvf ruby-1.9.3-p227/  [[email protected] ruby-1.9.3-p227]#./configure  [[email protected] ruby-1.9.3-p227]#make && make install  [[email protected] ruby-1.9.3-p227]#cd ../  

[[email protected] ~]#cd /opt/  [[email protected] opt]#cd ruby-1.9.3-p227/ext/openssl  [[email protected] openssl]#ruby extconf.rb  [[email protected] openssl]#make && make install  [[email protected] openssl]#cd ../../../  

[[email protected] ~]#cd /opt  [[email protected] opt]#tar zxvf rubygems-1.8.24.tar.gz  [[email protected] opt]#cd rubygems-1.8.24/  [[email protected] opt]#ruby setup.rb  

[[email protected] ~]#gem sources -l  [[email protected] ~]#gem sources -r https://rubygems.org/  [[email protected] ~]#gem sources –a http://ruby.taobao.org/  [[email protected] ~]#gem sources -u  

[[email protected] ~]#gem install bundle  [[email protected] ~]#gem install thor i18n bundler tzinfo builder memcache-client rack rack-test erubis mail rack-mount rails --no-rdoc --no-ri  [[email protected] ~]#gem install tzinfo-data  [[email protected] ~]#gem install rake --version=0.9.2 --no-rdoc --no-ri  [[email protected] ~]#gem uninstall rake --version=0.9.2.2  

[[email protected] ~]#cd /opt  [[email protected] ~]#wget http://wkhtmltopdf.googlecode.com/files/wkhtmltopdf-0.9.9-static-amd64.tar.bz2  [[email protected] ~]#tar jxvf wkhtmltopdf-0.9.9-static-amd64.tar.bz2  [[email protected] ~]#cp wkhtmltopdf-amd64 /usr/local/bin/wkhtmltopdf  [[email protected] ~]#chown root.root /usr/local/bin/wkhtmltopdf 

[[email protected] ~]#cd /var/www/html  [[email protected] html]#git clone http://github.com/Snorby/snorby.git  [[email protected] html]#cd /var/www/html/snorby/config/  [[email protected] config]#cp database.yml.example database.yml  [[email protected] config]#cp snorby_config.yml.example snorby_config.yml  [[email protected] config]#chown -R apache.apache /var/www/html/snorby/  

[root@localhost config]#cd ../  [root@localhsot snorby]#bundle exec rake snorby:setup  [root@localhost snorby]#bundle exec rails server -e production &  

[[email protected] snorby]#ruby script/delayed_job start RAILS_ENV=production  

[[email protected] ~]#gem install --no-ri --no-rdoc passenger  

[[email protected] ~]#/usr/local/bin/passenger-install-apache2-module –a  

[[email protected] ~]#cd /etc/httpd/conf.d/  

LoadModule passenger_module /usr/local/lib/ruby/gems/1.9.1/gems/passenger-4.0.14/buildout/apache2/mod_passenger.so PassengerRoot /usr/local/lib/ruby/gems/1.9.1/gems/passenger-4.0.14 PassengerDefaultRuby /usr/local/bin/ruby  <VirtualHost *:80>  ServerName snorby.domain.com # !!! Be sure to point DocumentRoot to 'public'!  DocumentRoot /var/www/html/snorby/public  <Directory /var/www/html/snorby/public> # This relaxes Apache security settings.  AllowOverride all # MultiViews must be turned off. Options -MultiViews  </Directory> </VirtualHost>