Ä¿ÇǴнº, ½Ã½ºÅÛ ¿£Áö´Ï¾îÀÇ ½°ÅÍ Ä¿ÇÇÇâÀÌ ³ª´Â *NIX
Ä¿ÇǴнº
½Ã½ºÅÛ/³×Æ®¿÷/º¸¾ÈÀ» ´Ù·ç´Â °÷
* HanIRCÀÇ #coffeenix ¹æ
[ Àåºñ ¹× ȸ¼± ÈÄ¿ø ]
HOME > º¸¾È(security) > ¹æÈ­º®, ÆÐŶ ÇÊÅ͸µ / IDS µµ¿ò¸»
°Ë»ö : »çÀÌÆ® WHOIS À¥¼­¹ö Á¾·ù


  snort ºê¶ó¿ìÀú·Î º¸±â À§ÇÑ snortsnarf ¼³Ä¡Çϱâ ÀÛ¼ºÀÏ : 2003/10/01 00:20
 
  • ±Û¾´ÀÌ : sin ( http://chtla.com/ )
  • Á¶È¸¼ö : 8568
          [ ÀÌÀüÈ­¸é / ¼öÁ¤ ]   ºñ¹Ð¹øÈ£ :     Àμâ¿ë È­¸é
      ÀÛ¼ºÀÚ : sin, http://chtla.com/ ÃʽÉÀ¸·Î..(¸®´ª½º Ä¿¹Â´ÏƼ)

    snort ºê¶ó¿ìÀú·Î º¸±â À§ÇÑ snortsnarf ¼³Ä¡Çϱâ

    snortsnarf¸¦ ¼³Ä¡Çϱâ À§Çؼ­´Â perlÀÌ ¼³Ä¡ µÇ¾î ÀÖ¾î¾ß ÇÕ´Ï´Ù.
    http://www.silicondefense.com/software/snortsnarf/index.htm ¿¡¼­ ÃֽŹöÀüÀ» ´Ù¿î ¹Þ´Â´Ù.
    (ÇöÀç SnortSnarf-021111.1.tar.gz ÃֽŹöÀü)


    [root@dream rpm]# tar xvfz SnortSnarf-021111.1.tar.gz
    [root@dream rpm]# cd SnortSnarf-021111.1
    [root@dream SnortSnarf-021111.1]# cd include/
    [root@dream include]# cp * /usr/lib/perl5/site_perl/5.8.0/
    [root@dream include]# cd ..
    [root@dream SnortSnarf-021111.1]# cd cgi
    [root@dream cgi]# cp * /home/card/html/cgi-bin/

    card¶ó´Â °÷ÀÌ ÇöÀç httpdÀÇ ÃÖ»óÀ§ µð·ºÅ丮ÀÓ..
    httpd.conf¿¡¼­ cgi-binÀ¸·Î ÁöÁ¤µÈ µð·ºÅ丮¸í..
    ScriptAlias /cgi-bin/ "/home/card/html/cgi-bin/"


    [root@dream cgi]# cd ..
    [root@dream SnortSnarf-021111.1]# cp snortsnarf.pl /home/admin/html
    [root@dream SnortSnarf-021111.1]# cd /home/admin/html
    [root@dream html]# ./snortsnarf.pl -rulesdir /usr/local/snort-1.9.1 -rulesfile /usr/local/snort-1.9.1/etc/snort.conf -d /home/admin/html/snort /var/log/snort/alert /var/log/snort/portscan.log

    Can't locate Time/ParseDate.pm in @INC (@INC contains: ./include /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . /usr/lib/perl5/site_perl/5.8.0/SnortSnarf) at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/TimeFilters.pm line 18.
    BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/TimeFilters.pm line 18.
    Compilation failed in require at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/Filter.pm line 19.
    BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/Filter.pm line 19.
    Compilation failed in require at ./snortsnarf.pl line 87.
    BEGIN failed--compilation aborted at ./snortsnarf.pl line 87.


    ÀÌ¿Í °°Àº ¿¡·¯°¡ º¸ÀÌÁö ¾Ê´Â´Ù¸é.. Á¦´ë·Î ¼³Ä¡°¡ ´Ù µÈ°ÍÀÌ´Ù.
    ÇÏÁö¸¸ °ÅÀÇ ÀÌ ¿¡·¯°¡ ³¯°Ì´Ï´Ù.

    ÀÌ°ÍÀº Time::ParseDate °¡ ¼³Ä¡µÇÁö ¾Ê¾Æ¼­ ±×·±°ÍÀÌ´Ù..
    ÀÌ ¹®Á¦¸¦ ÇØ°áÇϱâ À§Çؼ­´Â ¾Æ·¡¿Í °°ÀÌ Time::ParseDate¸¦ ¼³Ä¡ÇØ¾ß ÇÕ´Ï´Ù.
    ¼³Ä¡ÇÏ´Â ¹æ¹ý¿£ Á÷Á¢ ¼³Ä¡ÇÏ´Â ¹æ¹ý°ú »çÀÌÆ®¿¡ °¡¼­ ¼Ò½º ÆÄÀÏÀ» °¡Áö°í¿Í¼­ Ä«ÇÇÇØ µÎ´Â ¹æ¹ýÀÌ ÀÖ½À´Ï´Ù.

    1. Á÷Á¢ ¼³Ä¡Çϱâ


    [root@dream SnortSnarf]# perl -MCPAN -e shell

    /usr/lib/perl5/5.8.0/CPAN/Config.pm initialized.


    CPAN is the world-wide archive of perl resources. It consists of about
    100 sites that all replicate the same contents all around the globe.
    Many countries have at least one CPAN site already. The resources
    found on CPAN are easily accessible with the CPAN.pm module. If you
    want to use CPAN.pm, you have to configure it properly.

    If you do not want to enter a dialog now, you can answer 'no' to this
    question and I'll try to autoconfigure. (Note: you can revisit this
    dialog anytime later by typing 'o conf init' at the cpan prompt.)

    Are you ready for manual configuration? [yes] no

    [color='oliver']yes¸¦ ÀÔ·ÂÇϸé.. ¼öµ¿À¸·Î ¼³Á¤À» Àâ´Â °ÍÀÌ°í.. no¸¦ Çϸé ÀÚµ¿À¸·Î ¼³Á¤À» Àâ¾ÆÁØ´Ù..
    ¾Æ·¡´Â no¸¦ ÇßÀ»°æ¿ì ÀÚµ¿À¸·Î °æ·Î¸¦ Àâ´Â ³»¿ëÀÔ´Ï´Ù..[/color]

    -------------------------------------------------------------------------------
    The following questions are intended to help you with the
    configuration. The CPAN module needs a directory of its own to cache
    important index files and maybe keep a temporary mirror of CPAN files.
    This may be a site-wide directory or a personal directory.

    I see you already have a directory
    /root/.cpan
    Shall we use it as the general CPAN build and cache directory?

    CPAN build and cache directory? [/root/.cpan]

    Áß°£ »ý·« ......
    Your favorite WAIT server?
    [wait://ls6-www.informatik.uni-dortmund.de:1404]

    commit: wrote /usr/lib/perl5/5.8.0/CPAN/Config.pm

    cpan shell -- CPAN exploration and modules installation (v1.61)
    ReadLine support available (try 'install Bundle::CPAN')
    -------------------------------------------------------------------------------------

    ¼³Á¤ÀÌ ³¡³ª¸é ¾Æ·¡¿Í °°ÀÌ ÇÁ·³ÇÁÆ®°¡ ¶ß´Âµ¥.. ÀÌ°÷¿¡´Ù install Time::ParseDate ¸¦ ÀÔ·ÂÇÑ´Ù..


    cpan> install Time:ParseDate <== Çϸé perl.org¿¡ °¡¼­ ÇØ´ç ÆÄÀÏÀ» ¹Þ¾Æ¼­ ÀÚµ¿À¸·Î ¼³Ä¡¸¦ ÇÑ´Ù.
    CPAN: Storable loaded ok
    Going to read /root/.cpan/Metadata
    Database was generated on Tue, 11 Mar 2003 08:41:21 GMT
    Running install for module Time::ParseDate
    Running make for M/MU/MUIR/modules/Time-modules-2003.0211.tar.gz
    CPAN: LWP::UserAgent loaded ok
    Fetching with LWP:
    ftp://ftp.perl.org/pub/CPAN/authors/id/M/MU/MUIR/modules/Time-modules-2003.0211.tar.gz
    CPAN: Digest::MD5 loaded ok
    Fetching with LWP:
    ftp://ftp.perl.org/pub/CPAN/authors/id/M/MU/MUIR/modules/CHECKSUMS
    Checksum for /root/.cpan/sources/authors/id/M/MU/MUIR/modules/Time-modules-2003.0211.tar.gz ok
    ..... Áß°£ »ý·«.......
    Appending installation info to /usr/lib/perl5/5.8.0/i386-linux-thread-multi/perllocal.pod
    /usr/bin/make install -- OK

    cpan> quit
    Lockfile removed.


    [root@dream 5.8.0]# find /usr/lib/perl5/ -name 'ParseDate.pm' -print
    /usr/lib/perl5/site_perl/5.8.0/Time/ParseDate.pm <=== Á¤»óÀûÀ¸·Î ¼³Ä¡µÇ¾î ÀÖ´Â °ÍÀ» º¼¼ö ÀÖÀ»°ÍÀÌ´Ù..


    [root@dream html]# ./snortsnarf.pl -rulesdir /usr/local/snort-1.9.1 -rulesfile /usr/local/snort-1.9.1/etc/snort.conf -d /home/admin/html/snort /var/log/snort/alert /var/log/snort/portscan.log
    Using an array as a reference is deprecated at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/HTMLMemStorage.pm line 290.
    Using an array as a reference is deprecated at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/HTMLAnomMemStorage.pm line 266.
    could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
    could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
    could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
    could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
    could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
    could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
    SnortFileInput: input file /var/log/snort/portscan.log exists but is length 0; skipping it


    2. Ä«ÇÇÇؼ­ °¡Áö°í ¿À±â

    ±¸¹öÀüÀ̰ųª Time:ParseDate°¡ Á¦´ë·Î ¼³Ä¡°¡ ¾ÈµÈ´Ù¸é.. Á÷Á¢ »çÀÌÆ®¿¡¼­ °¡¼­ Ä«ÇÇÇØ ¿Íµµ µÈ´Ù.

    http://search.cpan.org/dist/Time-modules/
    ÀÌ°÷¿¡ °¡¸é..

    Time::CTime format times ala POSIX asctime 99.062201
    Time::DaysInMonth simply report the number of days in a month 99.1117
    Time::JulianDay Julian calendar manipulations 99.061501
    Time::ParseDate date parsing both relative and absolute 2003.0211
    Time::Timezone

    5°³ÀÇ ¸ðµâÀÌ ÀÖ´Ù.. °¢°¢À» Ŭ¸¯ÇØ µé¾î°¡ Source ¸¦ Ŭ¸¯ÇÏ¸é ¼Ò½º°¡ º¸À̴µ¥.. Ä«ÇÇÇؼ­
    µ¿ÀÏÇÑ ÆÄÀϸíÀ¸·Î »ý¼ºÇؼ­
    /usr/lib/perl5/°¢ ¹öÀü/Time ¹ØÀ¸·Î Ä«ÇÇÇØ ÁØ´Ù..

    ±×¸®°í snortsnarf.pl ¸¦ ½ÇÇàÇϸé.. Time:PasrseDate¿¡ °üÇÑ ¿¡·¯´Â ÀâÀ»¼ö ÀÖ´Ù.

    ¿É¼Ç ¼³¸í

    -rulesdir : ·êÀÇ µð·ºÅ丮¸í
    -rulesfile : snort.conf ÆÄÀÏÀÇ À§Ä¡
    -d : ·Î±×ÆÄÀÏÀÌ ÀÖ´Â À§Ä¡

    ÀÌÁ¦ ÀÌ°ÍÀ» cronÀ¸·Î µ¹·Á¼­ ÁÖ±âÀûÀ¸·Î htmlÈ­¸¦ ½ÃÄÑ ÁÖ¾î¾ß ÇÑ´Ù.
    ÇÏÁö¸¸, ·Î±×±â·ÏÀÌ ¸¹ÀÌ Áú¼ö·Ï ½Ã½ºÅÛÀÇ ºÎÇϸ¦ ¸¹ÀÌ Áֱ⠶§¹®¿¡.. cron Áֱ⠽ð£À» µÇµµ·Ï ±æ°Ô Àâ¾Æ ÁÖ´Â °ÍÀÌ ÁÁ´Ù.


    [root@dream html]# vi snort.cron
    ./snortsnarf.pl -rulesdir /usr/local/snort-1.9.1 -rulesfile /usr/local/snort-1.9.1/etc/snort.conf -d /home/admin/html/snort /var/log/snort/alert /var/log/snort/portscan.log

    [root@dream html]# vi /etc/crontab
    50 6 * * * root /home/card/html/snort.cron>/dev/null 2>&1

    ¸ÅÀÏ 6½Ã 50ºÐ¿¡ ½ÇÇàÀ» ÇÑ´Ù.


    ¸ðµç ¼³Ä¡°¡ ³¡³ª°í ºê¶ó¿ìÀú·Î °¡¸é.. ¾Æ·¡¿Í °°ÀÌ snortÀÇ ±â·Ï µéÀ» À¥»ó¿¡¼­ º¼¼ö ÀÖ°Ô µÉ°ÍÀÌ´Ù.

      Ä¿ÇǴнº Ä«Æä ÃÖ±Ù ±Û
    [03/24] Youtube òÁ&#2
    [03/20] Re: ¿Â¶óÀΰÔÀÓÀÇ Á¾ÁÖ±¹ ´ëÇѹα¹
    [03/20] ½ÇÁ¦&#4
    [03/18] ±¹°¡&#5
    [10/20] Cross Compiler ±ò
    [07/14] SSL ¬¡¬°
    [04/26] Re: µµ½ºÈ­¸é ¿ø°ÝÁ¶Á¾ ¿©ºÎ
    [04/25] µµ½ºÈ­¸é ¿ø°ÝÁ¶Á¾ ¿©ºÎ
    [10/30] Cshell¿¡¼­ ³­¼ö ¼³Á¤
    [10/23] °øÇ×öµµÁÖ½Äȸ»ç SE ±¸ÀÎ Ëì
    [01/26] Re: wgetÀ¸·Î ´Ù¸¥¼­¹ö¿¡ÀÖ´Â µð·ºÅ丮¸¦ °¡Á®¿À·Á°íÇÕ´Ï´Ù.
    [01/25] wgetÀ¸·Î ´Ù¸¥¼­¹ö¿¡ÀÖ´Â µð·ºÅ丮¸¦ °¡Á®¿À·Á°íÇÕ´Ï´Ù.
    [01/11] ƯÁ¤ ¾Èµå·ÎÀ̵å WebView ¹öÀü¿¡¼­ SSL ¹®Á¦ (WebView ¹ö±×)
    [08/01] DNS forwarder (Àü´ÞÀÚ) ¼­¹ö¸¦ ÅëÇؼ­ Äõ¸®ÇÏ¸é ¿ª¹æÇâÀ» ¹Þ¾Æ¿ÀÁú ¸øÇÕ´Ï´Ù.
    [05/16] (ÁÖ)ÈÄÀÌÁî ½Ã½ºÅÛ¿£Áö´Ï¾î (°æ·ÂÀÚ) ¸ðÁý
      New!   ÃÖ±Ù¿¡ µî·ÏÇÑ ÆäÀÌÁö
      KiCad EDA Suite project (Free/Libre/Open-Source EDA Suite) (CAD)
      ¿ÀÇÂij½ºÄÉÀ̵å ijµå (OpenCASCADE CAD)
      QCad for Windows --- GNU GPL (Free Software)
      The Hello World Collection
      IPMI¸¦ È°¿ëÇÑ ¸®´ª½º ¼­¹ö°ü¸®
      DNS ¼³Á¤ °Ë»ç
      nagiosgraph ¼³Ä¡ ¹æ¹ý
      Slony-I ¼³Ä¡ ¹æ¹ý (postgresql replication tool)
      Qmail±â¹ÝÀÇ Anti spam ½Ã½ºÅÛ ±¸ÃàÇϱâ
      clusterssh

    [ ÇÔ²²ÇÏ´Â »çÀÌÆ® ]




    ¿î¿µÁø : ÁÁÀºÁøÈ£(truefeel), ¾ß¼ö(yasu), ¹ü³ÃÀÌ, sCag
    2003³â 8¿ù 4ÀÏ~