Ä¿ÇÇÇâÀÌ ³ª´Â *NIX
Ä¿ÇǴнº
½Ã½ºÅÛ/³×Æ®¿÷/º¸¾ÈÀ» ´Ù·ç´Â °÷
*
HanIRCÀÇ #coffeenix ¹æ
[
Àåºñ ¹× ȸ¼± ÈÄ¿ø
]
> Forum <
IT ÀÏÁ¤
N
e
w
!
ÀÚµ¿È ÇÁ·ÎÁ§Æ®
HOME
>
º¸¾È(security)
>
¹æȺ®, ÆÐŶ ÇÊÅ͸µ / IDS
µµ¿ò¸»
°Ë»ö :
»çÀÌÆ®
WHOIS
À¥¼¹ö Á¾·ù
snort ºê¶ó¿ìÀú·Î º¸±â À§ÇÑ snortsnarf ¼³Ä¡Çϱâ
ÀÛ¼ºÀÏ : 2003/10/01 00:20
±Û¾´ÀÌ : sin (
http://chtla.com/
)
Á¶È¸¼ö : 8568
[
ÀÌÀüȸé
/
¼öÁ¤
] ºñ¹Ð¹øÈ£ :
ÀÛ¼ºÀÚ : sin,
http://chtla.com/
ÃʽÉÀ¸·Î..(¸®´ª½º Ä¿¹Â´ÏƼ)
snort ºê¶ó¿ìÀú·Î º¸±â À§ÇÑ snortsnarf ¼³Ä¡Çϱâ
snortsnarf¸¦ ¼³Ä¡Çϱâ À§Çؼ´Â perlÀÌ ¼³Ä¡ µÇ¾î ÀÖ¾î¾ß ÇÕ´Ï´Ù.
http://www.silicondefense.com/software/snortsnarf/index.htm
¿¡¼ ÃֽŹöÀüÀ» ´Ù¿î ¹Þ´Â´Ù.
(ÇöÀç SnortSnarf-021111.1.tar.gz ÃֽŹöÀü)
[root@dream rpm]# tar xvfz SnortSnarf-021111.1.tar.gz
[root@dream rpm]# cd SnortSnarf-021111.1
[root@dream SnortSnarf-021111.1]# cd include/
[root@dream include]# cp * /usr/lib/perl5/site_perl/5.8.0/
[root@dream include]# cd ..
[root@dream SnortSnarf-021111.1]# cd cgi
[root@dream cgi]# cp * /home/card/html/cgi-bin/
card¶ó´Â °÷ÀÌ ÇöÀç httpdÀÇ ÃÖ»óÀ§ µð·ºÅ丮ÀÓ..
httpd.conf¿¡¼ cgi-binÀ¸·Î ÁöÁ¤µÈ µð·ºÅ丮¸í..
ScriptAlias /cgi-bin/ "/home/card/html/cgi-bin/"
[root@dream cgi]# cd ..
[root@dream SnortSnarf-021111.1]# cp snortsnarf.pl /home/admin/html
[root@dream SnortSnarf-021111.1]# cd /home/admin/html
[root@dream html]# ./snortsnarf.pl -rulesdir /usr/local/snort-1.9.1 -rulesfile /usr/local/snort-1.9.1/etc/snort.conf -d /home/admin/html/snort /var/log/snort/alert /var/log/snort/portscan.log
Can't locate Time/ParseDate.pm in @INC (@INC contains: ./include /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . /usr/lib/perl5/site_perl/5.8.0/SnortSnarf) at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/TimeFilters.pm line 18.
BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/TimeFilters.pm line 18.
Compilation failed in require at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/Filter.pm line 19.
BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/Filter.pm line 19.
Compilation failed in require at ./snortsnarf.pl line 87.
BEGIN failed--compilation aborted at ./snortsnarf.pl line 87.
ÀÌ¿Í °°Àº ¿¡·¯°¡ º¸ÀÌÁö ¾Ê´Â´Ù¸é.. Á¦´ë·Î ¼³Ä¡°¡ ´Ù µÈ°ÍÀÌ´Ù.
ÇÏÁö¸¸ °ÅÀÇ ÀÌ ¿¡·¯°¡ ³¯°Ì´Ï´Ù.
ÀÌ°ÍÀº Time::ParseDate °¡ ¼³Ä¡µÇÁö ¾Ê¾Æ¼ ±×·±°ÍÀÌ´Ù..
ÀÌ ¹®Á¦¸¦ ÇØ°áÇϱâ À§Çؼ´Â ¾Æ·¡¿Í °°ÀÌ Time::ParseDate¸¦ ¼³Ä¡ÇØ¾ß ÇÕ´Ï´Ù.
¼³Ä¡ÇÏ´Â ¹æ¹ý¿£ Á÷Á¢ ¼³Ä¡ÇÏ´Â ¹æ¹ý°ú »çÀÌÆ®¿¡ °¡¼ ¼Ò½º ÆÄÀÏÀ» °¡Áö°í¿Í¼ Ä«ÇÇÇØ µÎ´Â ¹æ¹ýÀÌ ÀÖ½À´Ï´Ù.
1. Á÷Á¢ ¼³Ä¡Çϱâ
[root@dream SnortSnarf]# perl -MCPAN -e shell
/usr/lib/perl5/5.8.0/CPAN/Config.pm initialized.
CPAN is the world-wide archive of perl resources. It consists of about
100 sites that all replicate the same contents all around the globe.
Many countries have at least one CPAN site already. The resources
found on CPAN are easily accessible with the CPAN.pm module. If you
want to use CPAN.pm, you have to configure it properly.
If you do not want to enter a dialog now, you can answer 'no' to this
question and I'll try to autoconfigure. (Note: you can revisit this
dialog anytime later by typing 'o conf init' at the cpan prompt.)
Are you ready for manual configuration? [yes] no
[color='oliver']yes¸¦ ÀÔ·ÂÇϸé.. ¼öµ¿À¸·Î ¼³Á¤À» Àâ´Â °ÍÀÌ°í.. no¸¦ Çϸé ÀÚµ¿À¸·Î ¼³Á¤À» Àâ¾ÆÁØ´Ù..
¾Æ·¡´Â no¸¦ ÇßÀ»°æ¿ì ÀÚµ¿À¸·Î °æ·Î¸¦ Àâ´Â ³»¿ëÀÔ´Ï´Ù..[/color]
-------------------------------------------------------------------------------
The following questions are intended to help you with the
configuration. The CPAN module needs a directory of its own to cache
important index files and maybe keep a temporary mirror of CPAN files.
This may be a site-wide directory or a personal directory.
I see you already have a directory
/root/.cpan
Shall we use it as the general CPAN build and cache directory?
CPAN build and cache directory? [/root/.cpan]
Áß°£ »ý·« ......
Your favorite WAIT server?
[wait://ls6-www.informatik.uni-dortmund.de:1404]
commit: wrote /usr/lib/perl5/5.8.0/CPAN/Config.pm
cpan shell -- CPAN exploration and modules installation (v1.61)
ReadLine support available (try 'install Bundle::CPAN')
-------------------------------------------------------------------------------------
¼³Á¤ÀÌ ³¡³ª¸é ¾Æ·¡¿Í °°ÀÌ ÇÁ·³ÇÁÆ®°¡ ¶ß´Âµ¥.. ÀÌ°÷¿¡´Ù install Time::ParseDate ¸¦ ÀÔ·ÂÇÑ´Ù..
cpan> install Time:ParseDate <== Çϸé perl.org¿¡ °¡¼ ÇØ´ç ÆÄÀÏÀ» ¹Þ¾Æ¼ ÀÚµ¿À¸·Î ¼³Ä¡¸¦ ÇÑ´Ù.
CPAN: Storable loaded ok
Going to read /root/.cpan/Metadata
Database was generated on Tue, 11 Mar 2003 08:41:21 GMT
Running install for module Time::ParseDate
Running make for M/MU/MUIR/modules/Time-modules-2003.0211.tar.gz
CPAN: LWP::UserAgent loaded ok
Fetching with LWP:
ftp://ftp.perl.org/pub/CPAN/authors/id/M/MU/MUIR/modules/Time-modules-2003.0211.tar.gz
CPAN: Digest::MD5 loaded ok
Fetching with LWP:
ftp://ftp.perl.org/pub/CPAN/authors/id/M/MU/MUIR/modules/CHECKSUMS
Checksum for /root/.cpan/sources/authors/id/M/MU/MUIR/modules/Time-modules-2003.0211.tar.gz ok
..... Áß°£ »ý·«.......
Appending installation info to /usr/lib/perl5/5.8.0/i386-linux-thread-multi/perllocal.pod
/usr/bin/make install -- OK
cpan> quit
Lockfile removed.
[root@dream 5.8.0]# find /usr/lib/perl5/ -name 'ParseDate.pm' -print
/usr/lib/perl5/site_perl/5.8.0/Time/ParseDate.pm <=== Á¤»óÀûÀ¸·Î ¼³Ä¡µÇ¾î ÀÖ´Â °ÍÀ» º¼¼ö ÀÖÀ»°ÍÀÌ´Ù..
[root@dream html]# ./snortsnarf.pl -rulesdir /usr/local/snort-1.9.1 -rulesfile /usr/local/snort-1.9.1/etc/snort.conf -d /home/admin/html/snort /var/log/snort/alert /var/log/snort/portscan.log
Using an array as a reference is deprecated at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/HTMLMemStorage.pm line 290.
Using an array as a reference is deprecated at /usr/lib/perl5/site_perl/5.8.0/SnortSnarf/HTMLAnomMemStorage.pm line 266.
could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
could not open /usr/local/snort-1.9.1/snort.conf to read rules from -- skipping
SnortFileInput: input file /var/log/snort/portscan.log exists but is length 0; skipping it
2. Ä«ÇÇÇؼ °¡Áö°í ¿À±â
±¸¹öÀüÀ̰ųª Time:ParseDate°¡ Á¦´ë·Î ¼³Ä¡°¡ ¾ÈµÈ´Ù¸é.. Á÷Á¢ »çÀÌÆ®¿¡¼ °¡¼ Ä«ÇÇÇØ ¿Íµµ µÈ´Ù.
http://search.cpan.org/dist/Time-modules/
ÀÌ°÷¿¡ °¡¸é..
Time::CTime format times ala POSIX asctime 99.062201
Time::DaysInMonth simply report the number of days in a month 99.1117
Time::JulianDay Julian calendar manipulations 99.061501
Time::ParseDate date parsing both relative and absolute 2003.0211
Time::Timezone
5°³ÀÇ ¸ðµâÀÌ ÀÖ´Ù.. °¢°¢À» Ŭ¸¯ÇØ µé¾î°¡ Source ¸¦ Ŭ¸¯ÇÏ¸é ¼Ò½º°¡ º¸À̴µ¥.. Ä«ÇÇÇؼ
µ¿ÀÏÇÑ ÆÄÀϸíÀ¸·Î »ý¼ºÇؼ
/usr/lib/perl5/°¢ ¹öÀü/Time ¹ØÀ¸·Î Ä«ÇÇÇØ ÁØ´Ù..
±×¸®°í snortsnarf.pl ¸¦ ½ÇÇàÇϸé.. Time:PasrseDate¿¡ °üÇÑ ¿¡·¯´Â ÀâÀ»¼ö ÀÖ´Ù.
¿É¼Ç ¼³¸í
-rulesdir : ·êÀÇ µð·ºÅ丮¸í
-rulesfile : snort.conf ÆÄÀÏÀÇ À§Ä¡
-d : ·Î±×ÆÄÀÏÀÌ ÀÖ´Â À§Ä¡
ÀÌÁ¦ ÀÌ°ÍÀ» cronÀ¸·Î µ¹·Á¼ ÁÖ±âÀûÀ¸·Î htmlȸ¦ ½ÃÄÑ ÁÖ¾î¾ß ÇÑ´Ù.
ÇÏÁö¸¸, ·Î±×±â·ÏÀÌ ¸¹ÀÌ Áú¼ö·Ï ½Ã½ºÅÛÀÇ ºÎÇϸ¦ ¸¹ÀÌ Áֱ⠶§¹®¿¡.. cron Áֱ⠽ð£À» µÇµµ·Ï ±æ°Ô Àâ¾Æ ÁÖ´Â °ÍÀÌ ÁÁ´Ù.
[root@dream html]# vi snort.cron
./snortsnarf.pl -rulesdir /usr/local/snort-1.9.1 -rulesfile /usr/local/snort-1.9.1/etc/snort.conf -d /home/admin/html/snort /var/log/snort/alert /var/log/snort/portscan.log
[root@dream html]# vi /etc/crontab
50 6 * * * root /home/card/html/snort.cron>/dev/null 2>&1
¸ÅÀÏ 6½Ã 50ºÐ¿¡ ½ÇÇàÀ» ÇÑ´Ù.
¸ðµç ¼³Ä¡°¡ ³¡³ª°í ºê¶ó¿ìÀú·Î °¡¸é.. ¾Æ·¡¿Í °°ÀÌ snortÀÇ ±â·Ï µéÀ» À¥»ó¿¡¼ º¼¼ö ÀÖ°Ô µÉ°ÍÀÌ´Ù.
Ä¿ÇǴнº Ä«Æä ÃÖ±Ù ±Û
[03/24]
Youtube òÁ
[03/20]
Re: ¿Â¶óÀΰÔÀÓÀÇ Á¾ÁÖ±¹ ´ëÇѹα¹
[03/20]
½ÇÁ¦
[03/18]
±¹°¡
[10/20]
Cross Compiler ±ò
[07/14]
SSL ¬¡¬°
[04/26]
Re: µµ½ºÈ¸é ¿ø°ÝÁ¶Á¾ ¿©ºÎ
[04/25]
µµ½ºÈ¸é ¿ø°ÝÁ¶Á¾ ¿©ºÎ
[10/30]
Cshell¿¡¼ ³¼ö ¼³Á¤
[10/23]
°øÇ×öµµÁÖ½Äȸ»ç SE ±¸ÀÎ Ëì
[01/26]
Re: wgetÀ¸·Î ´Ù¸¥¼¹ö¿¡ÀÖ´Â µð·ºÅ丮¸¦ °¡Á®¿À·Á°íÇÕ´Ï´Ù.
[01/25]
wgetÀ¸·Î ´Ù¸¥¼¹ö¿¡ÀÖ´Â µð·ºÅ丮¸¦ °¡Á®¿À·Á°íÇÕ´Ï´Ù.
[01/11]
ƯÁ¤ ¾Èµå·ÎÀ̵å WebView ¹öÀü¿¡¼ SSL ¹®Á¦ (WebView ¹ö±×)
[08/01]
DNS forwarder (Àü´ÞÀÚ) ¼¹ö¸¦ ÅëÇؼ Äõ¸®ÇÏ¸é ¿ª¹æÇâÀ» ¹Þ¾Æ¿ÀÁú ¸øÇÕ´Ï´Ù.
[05/16]
(ÁÖ)ÈÄÀÌÁî ½Ã½ºÅÛ¿£Áö´Ï¾î (°æ·ÂÀÚ) ¸ðÁý
N
e
w
! ÃÖ±Ù¿¡ µî·ÏÇÑ ÆäÀÌÁö
KiCad EDA Suite project (Free/Libre/Open-Source EDA Suite) (CAD)
¿ÀÇÂij½ºÄÉÀ̵å ijµå (OpenCASCADE CAD)
QCad for Windows --- GNU GPL (Free Software)
The Hello World Collection
IPMI¸¦ È°¿ëÇÑ ¸®´ª½º ¼¹ö°ü¸®
DNS ¼³Á¤ °Ë»ç
nagiosgraph ¼³Ä¡ ¹æ¹ý
Slony-I ¼³Ä¡ ¹æ¹ý (postgresql replication tool)
Qmail±â¹ÝÀÇ Anti spam ½Ã½ºÅÛ ±¸ÃàÇϱâ
clusterssh
[ ÇÔ²²ÇÏ´Â »çÀÌÆ® ]
¿î¿µÁø :
ÁÁÀºÁøÈ£(truefeel)
, ¾ß¼ö(yasu), ¹ü³ÃÀÌ, sCag
2003³â 8¿ù 4ÀÏ~