<![CDATA[Latest posts for the topic "Cần giúp đở cài đặt snortsam-patch trên Centos"]]> /hvaonline/posts/list/8.html JForum - http://www.jforum.net Cần giúp đở cài đặt snortsam-patch trên Centos http://www.snortsam.net/files/snort-plugin/ Code:
snortsam-2.9.2.2.diff.gz
Tiến hành patch Code:
patch -p1 < ../snortsam-2.9.2.2.diff
Chạy aclocal : Code:
[root@localhost snort-2.9.2]# aclocal
configure.in:877: warning: macro 'AM_PATH_LIBPRELUDE' not found in library
[root@localhost snort-2.9.2]#
em copy Code:
[root@localhost snort-2.9.2]# cp m4/libprelude.m4 /usr/share/aclocal
Chạy lại vẫn báo lỗi, Mọi người ai đã triễn khai cái này rồi có thể giúp em khắc phục lỗi hay hướng dẫn em cách nào tốt hơn được không?]]> /hvaonline/posts/list/42317.html#263321 /hvaonline/posts/list/42317.html#263321 GMT Cần giúp đở cài đặt snortsam-patch trên Centos

lamletoi wrote:
em copy Code:
[root@localhost snort-2.9.2]# cp m4/libprelude.m4 /usr/share/aclocal
Chạy lại vẫn báo lỗi,  
"Vẫn lỗi" là lỗi như trên hay lỗi khác? ]]> /hvaonline/posts/list/42317.html#263323 /hvaonline/posts/list/42317.html#263323 GMT Cần giúp đở cài đặt snortsam-patch trên Centos Code:
aclocal
autoheader
Đến chổ Code:
automake --add-missing
thì thêm lỗi, Code:
src/dynamic-preprocessors/ssl/Makefile.am:8: Libtool library used but `LIBTOOL' is undefined
src/dynamic-preprocessors/ssl/Makefile.am:8:   The usual way to define `LIBTOOL' is to add `AC_PROG_LIBTOOL'
src/dynamic-preprocessors/ssl/Makefile.am:8:   to `configure.in' and run `aclocal' and `autoconf' again.
src/dynamic-preprocessors/ssl/Makefile.am:8:   If `AC_PROG_LIBTOOL' is in `configure.in', make sure
src/dynamic-preprocessors/ssl/Makefile.am:8:   its definition is in aclocal's search path.
]]> /hvaonline/posts/list/42317.html#263324 /hvaonline/posts/list/42317.html#263324 GMT Cần giúp đở cài đặt snortsam-patch trên Centos /hvaonline/posts/list/42317.html#263326 /hvaonline/posts/list/42317.html#263326 GMT Cần giúp đở cài đặt snortsam-patch trên Centos Code:
autoconf
Ok. build lại snort #./configure --with-mysql-libraries=/usr/lib/mysql --enable-targetbased --enable-dynamicplugin --enable-sourcefire --enable-reload --enable-zlib --enable-gre --enable-mpls --enable-ppm --enable-perfprofiling --with-dnet-includes=/usr/local/snort/include --with-dnet-libraries=/usr/local/snort/lib --with-daq-includes=/usr/local/snort/include --with-daq-libraries=/usr/local/snort/lib make make install Ok. Thêm vào /etc/snort/snort.conf Code:
output alert_fwsam: 192.168.2.2
Mở một rule trong web-misc.rules thêm vào Code:
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:”WEB-MISC /~root
access”; flow:to_server,established; uricontent:”/~root”; nocase;classtype:attempted-recon; sid:1145;  rev:6; fwsam: src, 10 minutes;)
Khởi chạy lại snort Code:
Starting snort:                                            [FAILED]
Log Code:
May 16 08:41:57 localhost snort[32736]: !! WARNING: The database output plugins are considered deprecated as
May 16 08:41:57 localhost snort[32736]: !!          of Snort 2.9.2 and will be removed in Snort 2.9.3.
May 16 08:41:57 localhost snort[32736]: !!          The recommended approach to logging is to use unified2 with
May 16 08:41:57 localhost snort[32736]: !!          barnyard2 or similar.
May 16 08:41:57 localhost snort[32736]: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
May 16 08:41:57 localhost snort[32736]: FATAL ERROR: /etc/snort/snort.conf(490) Unknown output plugin: "alert_fwsam"
Đến đây thì em biết là quá trình patch chưa thành công. Thực sự trong quá trình làm thì em đã xử lý hết lỗi .]]> /hvaonline/posts/list/42317.html#263329 /hvaonline/posts/list/42317.html#263329 GMT Cần giúp đở cài đặt snortsam-patch trên Centos /hvaonline/posts/list/42317.html#263334 /hvaonline/posts/list/42317.html#263334 GMT Cần giúp đở cài đặt snortsam-patch trên Centos Code:
./configure --enable-debug --enable-dynamicplugin 
 --enable-build-dynamic-examples --enable-reload --enable-reload-error-restart 
 --enable-flexresp3 --enable-active-response --with-mysql=no --with-odbc=no 
 --with-postgresql=no --disable-prelude --enable-large-pcap --disable-corefiles 
 --enable-sourcefire --enable-perfprofiling --enable-ppm --enable-gre 
 --enable-mpls --enable-decoder-preprocessor-rules --enable-zlib 
 --enable-normalizer --enable-react --prefix=/usr/local --mandir=/usr/local/man 
 --infodir=/usr/local/info/
Lỗi Code:
output-plugins/libspo.a(spo_alert_fwsam.o): In function `AlertFWsamInit':
/usr/local/src/snort-2.9.2/src/output-plugins/spo_alert_fwsam.c:406: undefined reference to `AddFuncToReloadList'
collect2: ld returned 1 exit status
make[3]: *** [snort] Error 1
make[3]: Leaving directory `/usr/local/src/snort-2.9.2/src'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/usr/local/src/snort-2.9.2/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/usr/local/src/snort-2.9.2'
make: *** [all] Error 2
Lần khác : [/code] spo_alert_fwsam.c:1292: warning: pointer targets in assignment differ in signedness spo_alert_fwsam.c:1293: error: ‘TwoFish_BLOCK_SIZE’ undeclared (first use in this function) spo_alert_fwsam.c:1293: error: ‘FWsamStation’ has no member named ‘stationfish’ spo_alert_fwsam.c:1309: error: ‘FWsamStation’ has no member named ‘lastcontact’ spo_alert_fwsam.c:1320: error: incompatible type for argument 1 of ‘sfip_to_str’ ../../src/sfutil/sf_ip.h:494: note: expected ‘const struct sfip_t *’ but argument is of type ‘struct in_addr’ spo_alert_fwsam.c:1325: error: incompatible type for argument 1 of ‘sfip_to_str’ ../../src/sfutil/sf_ip.h:494: note: expected ‘const struct sfip_t *’ but argument is of type ‘struct in_addr’ spo_alert_fwsam.c:1330: error: incompatible type for argument 1 of ‘sfip_to_str’ ../../src/sfutil/sf_ip.h:494: note: expected ‘const struct sfip_t *’ but argument is of type ‘struct in_addr’ make[3]: *** [spo_alert_fwsam.o] Error 1 make[3]: Leaving directory `/usr/local/src/snort/snort-2.9.2/src/output-plugins' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/snort/snort-2.9.2/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/snort/snort-2.9.2' make: *** [all] Error 2 [code]]]> /hvaonline/posts/list/42317.html#263359 /hvaonline/posts/list/42317.html#263359 GMT Cần giúp đở cài đặt snortsam-patch trên Centos /hvaonline/posts/list/42317.html#263738 /hvaonline/posts/list/42317.html#263738 GMT Cần giúp đở cài đặt snortsam-patch trên Centos

vd_ wrote:
@lamletoi Bạn nên cân nhắc dùng barnyard2-1.10beta2 (1.9 chưa hỗ trợ) unified2 snort ----------> barnyard2 ------> snortsam Sau này có thể upgrade từng phần dễ dàng hơn là cứ phải patch snort 
Bạn có thể hướng dẫn cách làm được không, tìm trên mạng chưa thấy bài hướng dẫn cách làm trên ----solved---]]> /hvaonline/posts/list/42317.html#274598 /hvaonline/posts/list/42317.html#274598 GMT