Toronto Web Hosting - Snort Intrusion Dection Guide

Installation and Configuration

  Use the

cd

 command to go to

/var/www/html/acid

 directory.

  Use the command

tar zxvf /opt/adodb221.tgz

  to extract ADODB

files. The command will create a directory

/var/www/html/acid/adodb

and put all ADODB files under this directory.

  Use the command

tar zxvf /opt/phplot 4.4.6.tar.gz

to

extract PHPLOT files. This will create a directory

/var/www/html/acid/

phplot 4.4.6

 and put all PHPLOT files under this directory.

  Create another database

snort_archive

 using

create database

snort_archive;

  command after starting

mysql

 client using the

procedure described in Chapter 5. You have already created a database with the

name

snort

  and a user with the name

rr

  as discussed in Chapter 5. The

new

snort_archive

 database is used by ACID to archive old data. The new

database is not required by Snort to log data. If you don't want to archive old

data using ACID, you can skip this step and the next step as well.

  Grant permissions to user

rr

 to manage

snort_archive

 database using the

command

grant CREATE,INSERT,DELETE,UPDATE,SELECT on

snort_archive.* to rr@localhost;

  Create tables in this database using the command

mysql  u rr  p

snort_archive

  as described in Chapter 5.

Set

display_errors

 variable in

/etc/php.ini

 to Off.

Now you have to configure ACID so that it can interact with the MySQL data

base. The configuration process also enables Snort to use the PHPLOT package. The

configuration process is simple and includes setting up different parameters in the

acid_conf.php

 configuration file which is located in the same directory where

you uncompressed the ACID files. For the examples in this book, the file is located in

the

/var/www/html/acid

 directory. You have to put information about the fol

lowing items in this file:

  Location of ADODB files. In our case this path is

./adodb

. This is because

all ADODB files are located in adodb directory under the directory where

ACID

 files are located.

  Type of database server. For the example in this book the type of server is

mysql

  MySQL database name for Snort log data.

  MySQL database server name or IP address.

  MySQL database user name and password.

footer