just finished setting up an experimental intrusion detection system (ids) for a reason i'm not sure of. anyway, i used snort with postgresql8 as its logging facility. though that setup would be enough for an ids, it would be better to have an interface to the logs of the ids. i used the base project for this, which needs a webserver w/ php support. i used apache2 and php5 for this. in setting up the various services, i used the source tarballs in order to apply the optimizations i learned from bluepoint (though we really didn't use snort in our training but we used portsentry, i thought i'd give snort a try to compare or at least know what differs it from the other). there are some differences in compiling and setting up of the services since they are of newer versions. for my fellow bluers out there, below are some of the differences.
in building postgresql, the ./configure options are somewhat the same. but you may add --without-docdir so as not to install the documentation since these are removed after installation. instead of using make, use gmake. there is an option to test the binaries, gmake check, but the tests fails when compiling static binaries and succeeds when compiling modular binaries. when installing, use gmake install-strip to strip the binaries automatically. postgresql8 has a different options for syslog in its confifuration file. remove syslog=2 and replace it with log_destination='syslog' instead. also, you need the options syslog_facility='LOCAL0' and syslog_ident='postgres' and you need to add the following line in the /etc/syslog.conf:
local0.* -/var/log/postgresql
i searched the internet for a guide to build apache2 and php5 statically, but i can't find any. even php.net only provides documentation for building it as a shared module. does anybody out there knows how to do that? i tried copying the source for php's module to apache2's modules directory and added the necessary libraries and includes in the build/config_vars.mk and the compilation of the source went ok but there seems to be a problem during linking. it gave out these errors: modules/php5/.libs/mod_php5.a(mod_php5.o)(.data+0x20): undefined reference to `create_php_config'
modules/php5/.libs/mod_php5.a(mod_php5.o)(.data+0x24): undefined reference to `merge_php_config'
modules/php5/.libs/mod_php5.a(mod_php5.o)(.data+0x30): undefined reference to `php_dir_cmds'
modules/php5/.libs/mod_php5.a(mod_php5.o)(.data+0x34): undefined reference to `php_ap2_register_hook'
collect2: ld returned 1 exit status
i also tried looking for an apache2 equivalent to apache's --activate-module so that i can just use the libphp5.a, but i didn't find any. am i missing something here? i also tried looking into how mod_perl integrates its module statically to apache2, that's how i learned to include the libraries and includes. anyway, what i did is to statically build apache2 with the necessary modules, but enabled support for shared modules for php5. mod_ssl is integrated in apache2, but is disabled by default. also, i used the config.layout file and edited it, instead of specifying the directories as options for ./configure. by the way, configuring and installing mod_perl will also configure and install apache2. well, you might as well use mod_perl, just be sure to pass necessary apache2 ./configure options to mod_perl's MP_AP_CONFIGURE.
after chrooting apache2 and configuring postgresql to accept connections from snort and base, my ids is up and running. though i still have to learn how to use it. will be reading the documentations and the rules. hmm...
0 comments:
Post a Comment