2024.06.17.보안 day50

시험 보는 날 

 

https://snort.org/

Snort - Network Intrusion Detection & Prevention System

 

 

 

10.10.10.100)

 

 

wget https://snort.org/downloads/snort/snort-2.9.20-1.centos.x86_64.rpm --no-check-certificate

 

C:\Users\Administrator>scp -r D:\Class231228jyj\0_share\snort-2.9.20-1.centos.x86_64.rpm root@10.10.10.100:/usr/local/src

 

rpm -ivh --nodeps snort-2.9.20-1.centos.x86_64.rpm

 

 

 

yum install epel* -y

 

yum groupinstall "Development Tools"

yum install libdnet* -y

yum install snort-2.9.20-1.centos.x86_64.rpm

 

 snort -T -c /etc/snort/snort.conf

==> 안뜰거임 

 

[root@localhost snort]# find / -name libdnet*
/usr/lib64/libdnet.so.1
/usr/lib64/libdnet.so.1.0.1
/usr/lib64/libdnet.so
/usr/share/doc/libdnet-1.12

 

ln -s /usr/lib64/libdnet.so.1 /usr/lib64/libdnet.1

 

[ vi /etc/snort/snort.conf ]

    104  #var RULE_PATH /etc/snort/rules
    105 #var SO_RULE_PATH ../so_rules
    106 #var PREPROC_RULE_PATH ../preproc_rules
    107 var RULE_PATH /rules
    108 var SO_RULE_PATH so_rules
    109 var PREPROC_RULE_PATH preproc_rules

    116 #var WHITE_LIST_PATH ../rules
    117 #var BLACK_LIST_PATH ../rules
    118 var WHITE_LIST_PATH rules
    119 var BLACK_LIST_PATH rules

 

    551 include $RULE_PATH/local.rules 에 아래에 
    552 include threshold.conf 추가하고 

그 밑에 다 지우기 

 

 

우리가 하는건 베스천호스트이다 . 

 

 

 

듀얼홈드호스트구조

 

 

 

베스천호스트