Ubuntu server 24 (Linux) Snort3 3.2.1.0 Guardian IPtables 联动实战 主 ...

一  Snort3 安装配置，参考:Ubuntu server 24 安装配置 snort3 3.2.1.0 网络入侵检测防御体系 配置注册规则集-CSDN博客
二  安装自动防御程序Guardian
1 下载，解压

1. tar zxvf guardian-1.7.tar.gz
2. cd  guardian-1.7/

复制代码

2  配置

1. #拷贝文件
2. sudo cp guardian.pl /usr/local/bin/
3. sudo cp scripts/iptables_block.sh /usr/local/bin/guardian_block.sh
4. sudo cp scripts/iptables_unblock.sh  /usr/local/bin/guardian_unblock.sh
5. sudo  touch /var/log/snort/guardian.log
6. sudo touch /usr/local/snort/etc/snort/guardian.ignore
7. sudo touch /usr/local/snort/etc/snort/guardian.target
8. sudo cp guardian.conf  /usr/local/snort/etc/snort/
9. #修改配置文件
10. sudo vim /usr/local/snort/etc/snort/guardian.conf
11. Interface       ens33
12. HostIpAddr 192.168.50.19
13. HostGatewayByte  1
14. LogFile         /var/log/snort/guardian.log
15. AlertFile       /var/log/snort/alert_fast.txt
16. IgnoreFile      /usr/local/snort/etc/snort/guardian.ignore
17. TargetFile      /usr/local/snort/etc/snort/guardian.target
18. TimeLimit       86400
19. #其中HostIpAddr，如不填写会报如下错误
20. Warning! HostIpAddr is undefined! Attempting to guess..
21. Couldn't figure out the ip address

复制代码

3 guardian启动

1. #启动
2. sudo /usr/bin/perl  /usr/local/bin/guardian.pl -c /usr/local/snort/etc/snort/guardian.conf
3. #报错
4. Can't locate getopts.pl in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5) at ./guardian.pl line 10.
5. #修改guardian.pl 解决
6. sudo vim /usr/local/bin/guardian.pl
7. require 'getopts.pl'; --> #require 'getopts.pl';
8. &Getopts ('hc:d');    --> &getopts ('hc:d');

复制代码

1. #再次启动
2. test@ubuntuserver:~$ sudo /usr/bin/perl  /usr/local/bin/guardian.pl -c /usr/local/snort/etc/snort/guardian.conf
3. OS shows Linux
4. My ip address and interface are: 192.168.50.19 ens33
5. Loaded 1 addresses from /usr/local/snort/etc/snort/guardian.ignore
6. Loaded 0 addresses from /usr/local/snort/etc/snort/guardian.target
7. Becoming a daemon..
8. #查看进程

复制代码

三  snort+guard+iptables 实战联动测试
1 查看Iptables 表 

1. sudo iptables  -L  -n

复制代码

2  别的一台主机上测试ping 测试

1. #自定义告警规则
2. sudo vim /usr/local/snort/etc/rules/local.rules
3. alert icmp any any -> $HOME_NET any (msg:"ICMP connection test"; sid:1000001; rev:1;)

复制代码

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。