HowtoForge - Linux Howtos in English English|HowtoForge.de - Linux-Howtos auf Deutsch Deutsch

Intrusion Detection With BASE And Snort - Page 4

Submitted by edge (Contact Author) (Forums) on Sun, 2006-07-09 08:35. ::

BASE web page setup

Open your favorite web browser and go to: http://www.example.com/base-1.2.5/setup
If all is setup okay you should see the BASE Setup Program page:

BASE setup

Click on Continue

step 1 of 5:
Enter the path to ADODB (/var/www/adodb):

BASE Step 1 setup
click on Submit Query

step 2 of 5:
Enter the needed info on the next screen: (leave the Use Archive Database as is):

BASE Step 2 setup
click on Submit Query

step 3 of 5:
If you want to Use Authentication for the Base page you can do so here:

BASE Step 3 setup

click on Submit Query

step 4 of 5:
Click on Create BASE AG to create the database.

BASE Step 4a setup
and after Create BASE AG
BASE Step 4b setup

Once done, click on Now continue to step 5...

BASE Step 5 setup

To make the Graph's from BASE work you will also need to install Image_Color, Image_Canvas and Image_Graph.
To do this do:

pear install Image_Color
pear install Image_Canvas-alpha
pear install Image_Graph-alpha

That it for BASE!

If you want you can chmod the base-1.2.5 dir back to 775:

chmod 775 base-1.2.5

You can also delete the snorttemp directory, and all the files in it.

Starting Snort

To start SNORT and make BASE show you the Snort's logged info, you will need to run:

/usr/local/bin/snort -c /etc/snort/snort.conf -i eth0 -g root -D

Now wait some time and see all the Snort alerts show up in BASE.

BASE alerts

Links


Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.
Please do not use the comment function to ask for help! If you need help, please use our forum: http://www.howtoforge.com/forums
Comments will be published after administrator approval.
Submitted by norbert (Contact Author) (Forums) on Mon, 2008-01-14 11:59.
Thanks a lot for your tutorial. It allowed me to get everything up and running in a very short time.
Submitted by oakleeman (Contact Author) (Forums) on Mon, 2007-07-23 05:59.
This guide is a pretty good start but I actually found Patrick Harper's guide to be more in-depth. His guide is available at www.internetsecurityguru.com which I've used to develop a Snort/Centos/BASE install cd that I'm calling EasyIDS.
Submitted by kav5 (Contact Author) (Forums) on Fri, 2006-09-08 20:51.
Looks good but it is not complete. It would be very nice to add snortsam installation to the tutorial because it implements IPS system. (to block attacker automatically) 
Submitted by Anonymous (Contact Author) (Forums) on Mon, 2006-07-10 22:30.

Nice, easy to follow tutorial. Keep up the good work!

It's been a while that I've been meaning to get back to using snort. I think I'll give a try sometime this week. Never used BASE, I'll probably try it out this Wednesday.

Good Stuff.

--Jon Zhttp://jzencovich.blogspot.com/

Submitted by Anonymous (Contact Author) (Forums) on Sun, 2006-08-06 01:56.
 Not bad actually, but the project still not grow up, if you use commercial variants you know this is nowhere comparing to them...