Centos6.6安装Snort+Barnyard+Pulledpork+Snorby.docxVIP

Installing Snort, Barnyard, Pulledpork and Snorby on CentOS 6.6Snort?is an open source network intrusion prevention system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching, and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. Snort output is in binary format(unified2), so we need a tool to parse this binary format. For this task we use?Barnyard2, which is an open source interpreter for Snort unified2 binary output files. Its primary use is allowing Snort to write to disk in an efficient manner and leaving the task of parsing binary data into various formats to a separate process that will not cause Snort to miss network traffic. Snort needs rules and periodically have to update them. Here comes?Pulledpork, a perl script that keeps Snort’s rules updated. Finally we need a nice front-end in order to analyze easier the alerts that Snort produces. For this purpose we will installSnorby, a ruby on rails web application for network security monitoring that interfaces with current popular intrusion detection systems (Snort, Suricata and Sagan). The basic fundamental concepts behind Snorby are simplicity, organization and power(you can find a demo?hereusrername: demo@?password: snorby).We will install??version of?Snort?which is the latest version.Configuring Snort and all the other stuff that is required is a boring job. So?@petkoutroumpisand I made a simple bash script that automate all the process. You can find the bash script atgithub. Nevertheless below is step by step the full installation.Before begin with the installation disable selinuxvi /etc/selinux/config?and change the lineSELINUX=enforcingtoSELINUX=disabledandrebboot.Install some prerequisite packages.yum -y install vim wget man make gcc flex bison zlibzlib-devellibpcaplibpcap-develpcrepcre-develtc