<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook V3.1//EN">

<article lang="ko">

<!-- Header -->

 <artheader>

  <!-- title of HOWTO, include the word HOWTO -->

<title>Snort-Setup for Statistics HOWTO</title>

<author>
     <firstname>Sandro</firstname>
     <surname>Poppi</surname>
<affiliation>
        <address>
        <email>spoppi at gmx.de</email>
        </address>
</affiliation>
</author>

<othercredit role="translator">
<firstname>Á¤·æ</firstname>
<surname>¼­</surname>
<affiliation>
<address>
<email>s_ryong at hotmail.com</email>
</address>
</affiliation>
</othercredit>

<othercredit role="translator">
<firstname>Àç¼÷</firstname>
<surname>¼Û</surname>
<affiliation>
<address>
<email>affinity at orgio.net</email>
</address>
</affiliation>
</othercredit>

<revhistory>
      <revision>
         <revnumber>1.0</revnumber>
         <date>2002-01-01</date>
         <authorinitials>sp</authorinitials>
          <revremark>
- ÃÖÃÊ ¹ßÇ¥ ¹öÀü
- Snort ¹öÀü 1.8.3 À» »ç¿ëÇÏ¿´´Ù
- www.snort.org ¿¡ ÀÖ´Â RPM À» »ç¿ëÇÏ¿´´Ù
- ÀúÀÚÀÇ snortd initscript ¿¡ ´ëÇÑ ¸µÅ©¸¦ Ãß°¡ÇÏ¿´´Ù
- ÀÚµ¿ ±ÔÄ¢ °»½Å¿¡ ´ëÇÑ °æ°í¸¦ Ãß°¡ÇÏ¿´´Ù
- IDSPM ¿¡ ´ëÇÑ ÈùÆ®¸¦ Ãß°¡ÇÏ¿´´Ù
- snort.org ÀÇ RPM À» ¹Ý¿µÇÏ±â À§ÇØ /etc/snort ¿¡ ´ëÇÑ ±ÔÄ¢ ÆÄÀÏÀ» º¯°æÇÏ¿´´Ù
- as allways: ¸î¸î ºÎºÐÀ» ¸íÈ®È÷ ¼³¸íÇÏ¿´´Ù
         </revremark>
      </revision>

<revision>
         <revnumber>0.05</revnumber>
         <date>2001-11-14</date>
         <authorinitials>sp</authorinitials>
          <revremark>
- ¹®¼­ÀÌ¸§À» Snort-Setup for Statistics HOWTO ·Î º¯°æÇÏ¿´´Ù
- Greg Sarsons ¿¡ °í¹«µÇ¾î ÂªÀº Åë°è ½ºÅ©¸³Æ®¸¦ Ãß°¡ÇÏ¿´´Ù
- ¸î¸î ºÎºÐÀ» ¸íÈ®È÷ ¼³¸íÇÏ¿´°í ¾à°£ÀÇ ¿ÀÅ¸¸¦ ¼öÁ¤ÇÏ¿´´Ù
         </revremark>
</revision>

<revision>
         <revnumber>0.04</revnumber>
         <date>2001-09-29</date>
         <authorinitials>sp</authorinitials>
          <revremark>
- Greg Sarsons À¸·ÎºÎÅÍ Á¦¾ÈµÈ "snort ³»ºÎ Åë°èÀÚ·á" ÀýÀ» Ãß°¡ÇÏ¿´´Ù
- Greg Sarsons ÀÌ Á¦°øÇÑ ÂªÀº Åë°è ½ºÅ©¸³Æ®¸¦ Ãß°¡ÇÏ¿´Áö¸¸ ´õ¿í ÀÏ¹ÝÀûÀÎ ¹öÀüÀ» À§ÇØ ÁÖ¼®Ã³¸®ÇÏ¿´´Ù
        </revremark>
</revision>

<revision>
         <revnumber>0.03</revnumber>
         <date>2001-09-19</date>
         <authorinitials>sp</authorinitials>
          <revremark>
- swatch.conf ¿¡ throttle ¿É¼ÇÀ» Ãß°¡ÇÏ¿´´Ù
- ACID ¹öÀüÀ» 0.9.6b15 ·Î º¯°æÇÏ¿´´Ù
- ACID Àý¿¡ ¾à°£ÀÇ ÁÖ¼®À» Ãß°¡ÇÏ¿´´Ù
- MD5 Ã¼Å©¼¶À» Ãß°¡ÇÏ¿´Áö¸¸ ÁÖ¼®Ã³¸®ÇÏ¿´´Ù
         </revremark>
</revision>

<revision>
         <revnumber>0.02</revnumber>
         <date>2001-09-16</date>
         <authorinitials>sp</authorinitials>
          <revremark>
Greg Sarsons À¸·ÎºÎÅÍ Á¦¾ÈµÈ ¾à°£ÀÇ ¼³¸í
         </revremark>
</revision>

<revision>
         <revnumber>0.01</revnumber>
         <date>2001-09-04</date>
         <authorinitials>sp</authorinitials>
          <revremark>
            ÃÖÃÊ ¹öÀü
         </revremark>
        </revision>
</revhistory>

<abstract>
    <indexterm>
      <primary>Overview</primary>
    </indexterm>

<para>

ÀÌ HOWTO ´Â Åë°è µµ±¸ÀÎ  ACID (Analysis Consol for Intrusion Databases) ¿Í SnortSnarf ¿Í ÇÔ²² »ç¿ëµÇ´Â 
Snort ¹öÀü 1.8.3 ÀÇ ¼³Á¤ ¹æ¹ýÀ» ±â¼úÇÑ´Ù. ¶ÇÇÑ snort ¿¡¼­ ¹ö·ÁÁö´Â ÆÐÅ¶ÀÌ ÀÖ´ÂÁö¿Í °°ÀÌ ´Ù¼ÒÀÇ ³»ºÎ Åë°è 
ÀÚ·á¸¦ ¾ò´Â ¹æ¹ýÀÌ ¼³¸íµÇ¾î ÀÖ´Ù.

</para><para>

Ãß°¡ÀûÀ¸·Î Max Vision ÀÇ ±ÔÄ¢À» ÀÚµ¿ÀûÀ¸·Î °»½ÅÇÏ´Â ¹æ¹ýÀÌ ±â¼úµÇ¾î ÀÖÀ¸¸ç À¯¿ëÇÑ ¾à°£ÀÇ ½ºÅ©¸³Æ®¿Í 
swatch µ¥¸ð ¼³Á¤ÀÌ Æ÷ÇÔµÇ¾î ÀÖ´Ù.

</para>
</abstract>

 </artheader>

<!-- Section1: intro -->

<sect1 id="intro">
<title>¼Ò°³</title>

<indexterm>
    <primary>Snort-Statistics!introduction</primary>
</indexterm>

<para>

ÀÌ ¹®¼­´Â IDS (Ä§ÀÔ Å½Áö ½Ã½ºÅÛ, Intrusion Detection System) ¸¦ ±¸ÇöÇÏ·Á´Â »ç¶÷µé¿¡°Ô
µµ¿òÀ» ÁÖ±âÀ§ÇØ Snort ¿Í ¸î¸î Åë°è µµ±¸¸¦ »ç¿ëÇÏ¿© IDS ¼¾¼­¸¦ ¸¸µé¾úÀ» ¶§ ÀÛ¼ºµÇ¾ú´Ù.
Àû¾îµµ ÀÌ ¹®¼­ÀÇ ³»¿ëÁß ÇÏ³ª¶óµµ µµ¿òÀÌ µÉ ¼ö ÀÖ´Ù¸é ÀÌ ¹®¼­¸¦ ÀÛ¼ºÇÑ °¡Ä¡°¡ ÀÖÀ» °ÍÀÌ´Ù.

</para><para>

Snort ´Â ¿©·¯ À¯´Ð½º ÇÃ·§Æû¿¡¼­ »ç¿ëÇÒ ¼ö ÀÖ´Â ¿ì¼öÇÑ NIDS (Network IDS, ³×Æ®¿öÅ© Ä§ÀÔ Å½Áö ½Ã½ºÅÛ) ÀÌ´Ù.
Snort È¨ÆäÀÌÁö´Â <ulink url="http://www.snort.org/">http://www.snort.org/</ulink> ·Î ÀÌ ¹®¼­¿¡¼­ ±â¼úµÈ
¹öÀüÀº ¹®¼­ ÀÛ¼º½ÃÁ¡ÀÇ ÇöÀç ¹öÀüÀÎ 1.8.3 ÀÌ´Ù.

</para><para>

ÀÌ ¹®¼­¿¡ ±â¼úÇÒ Åë°è µµ±¸´Â snort ¿¡ ´ëÇÑ µ¥ÀÌÅ¸º£ÀÌ½º ºÐ¼® µµ±¸ÀÎ ACID ¿Í snort ·Î±×¿¡ ´ëÇÑ Åë°è µµ±¸ÀÎ SnortSnarf ·Î
°¢°¢ <ulink url="http://www.cert.org/kb/acid/">http://www.cert.org/kb/acid/</ulink> ¿Í 
<ulink url="http://www.silicondefense.com/software/snortsnarf/index.htm">http:/
/www.silicondefense.com/software/snortsnaft/index.htm</ulink> ¿¡¼­ ´Ù¿î·Îµå¹ÞÀ» ¼ö ÀÖ´Ù.

</para><para>

ACID ¿¡ ´ëÇØ¼­´Â Ãß°¡ÀûÀÎ Áö¿ø ÆÐÅ°ÁöµéÀÌ ÇÊ¿äÇÑµ¥ ÀÌµéÀº <emphasis remap="it">apache</emphasis> (<ulink 
url="http://www.apache.org/">http://www.apache.org/</ulink>) ¿Í °°Àº À¥ ¼­¹ö, PHP ¿¡¼­ ±×·¡ÇÁ »ý¼º¿¡ »ç¿ëµÇ´Â PHPlot (
<ulink url="http://www.phplot.com/">http://www.phplot.com/</ulink>) ¿Í PHP ¿Í ÇÔ²² µ¥ÀÌÅ¸º£ÀÌ½º ¿¬°á¿¡ »ç¿ëµÇ´Â
ADODB (<ulink url="http://php.weblogs.com/ADODB/">http://php.weblogs.com/ADODB/</ulink>) ÀÌ´Ù.

</para><para>

¶ÇÇÑ ÀÌ ¹®¼­´Â ACID ¿¡ ´ëÇØ ¾î¶² Ãß°¡ÀûÀÎ ¼ÒÇÁÆ®¿þ¾î°¡ ÇÊ¿äÇÑÁö ±×¸®°í snortd initscript ¹× swatch (
<ulink url="http://www.stanford.edu/~atkins/swatch"></ulink>) ¿¡ ´ëÇÑ °£·«ÇÑ ºÎºÐÀ» Æ÷ÇÔÇÏ¿© ÀúÀÚ°¡ »ç¿ëÇÑ
¸î¸î ½ºÅ©¸³Æ®¿Í ÇÔ²² ÆÞ·Î ÀÛ¼ºµÈ ·Î±× ÆÄÀÏ °¨½Ã ½ºÅ©¸³Æ®¸¦ ¾î¶»°Ô ¼³Á¤ÇÏ´ÂÁö¸¦ ±â¼úÇÑ´Ù.
ÀúÀÚ´Â swatch RPM À» ÀÛ¼ºÇßÀ¸¸ç ÀÌ´Â <ulink url="http://www.lug-burghausen.org/projects/Snort-Statistics/swatch-3.0.2-1.noarch.rpm">
http://www.lug-burghausen.org/projects/Snort-Statistics/swatch-3.0.2-1.noarch.rpm</ulink> ¿¡¼­ Ã£À» ¼ö ÀÖ´Ù.

</para><para>

ÇÑ°³ ÀÌ»óÀÇ snort ¼¾¼­¸¦ º¸À¯ÇÏ´Âµ¥ °ü½ÉÀÌ ÀÖ´Â »ç¶÷µéÀº <ulink url="http://www.activeworx.com/">http://www.activeworx.com/</ulink>
¿¡¼­ IDSPM (IDS Policy Manager) ¸¦ Á¶»çÇØ º¸±æ ¹Ù¶õ´Ù. ÀÌ´Â »õ·Î¿î ±ÔÄ¢À» ±âÁ¸ ±ÔÄ¢À¸·Î º´ÇÕ½ÃÅ´Àº ¹°·Ð »óÀÌÇÑ Á¤Ã¥À» °®´Â 
¿©·¯ ¼¾¼­µéÀ» À¯ÁöÇÏ±â À§ÇÑ ¾ÖÇÃ¸®ÄÉÀÌ¼ÇÀÌ´Ù. ´ÜÁö "³­Ã³ÇÑ" °ÍÀº W2K/XP ÇÃ·§Æû¿¡ ÀÛµ¿ÇÏ¸ç ¿ÀÇÂ ¼Ò½º°¡ ¾Æ´Ï¶ó´Â °ÍÀÌ´Ù.

</para>

<!-- Section2: copyright -->

<sect2 id="copyright">
<title>ÀúÀÛ±Ç Á¤º¸</title>

<para>
    This document is copyrighted (c) 2001, 2002 Sandro Poppi and is
    distributed under the terms of the Linux Documentation Project
    (LDP) license, stated below.
</para>

   <para>
    Unless otherwise stated, Linux HOWTO documents are
    copyrighted by their respective authors. Linux HOWTO documents may
    be reproduced and distributed in whole or in part, in any medium
    physical or electronic, as long as this copyright notice is
    retained on all copies. Commercial redistribution is allowed and
    encouraged; however, the author would like to be notified of any
    such distributions.
   </para>

<para>

    All translations, derivative works, or aggregate works
    incorporating any Linux HOWTO documents must be covered under this
    copyright notice. That is, you may not produce a derivative work
    from a HOWTO and impose additional restrictions on its
    distribution. Exceptions to these rules may be granted under
    certain conditions; please contact the Linux HOWTO coordinator at
    the address given below.
   </para>

<para>

¿ä¾àÇØ¼­ ¸»ÇÏ¸é ÀúÀÚ´Â °¡´ÉÇÑ ¸¹Àº Ã¤³ÎÀ» ÅëÇØ ÀÌ Á¤º¸°¡ À¯Æ÷µÇ±â¸¦ ¹Ù¶õ´Ù. ±×·¯³ª ÀÌ HOWTO ¹®¼­ÀÇ ÀúÀÛ±ÇÀÌ
À¯ÁöµÇ±æ ¹Ù¶ó¸ç ÀÌ ¹®¼­¸¦ Àç¹èÆ÷ÇÏ·Á´Â ¸ðµç °èÈ¹À» Åëº¸¹Þ°í ½Í´Ù.

</para>

<para>

Áú¹®ÀÌ ÀÖ´Ù¸é <email>linux-howto at metalab.unc.edu</email> ·Î ¿¬¶ôÇÏ±â ¹Ù¶õ´Ù.

</para>
</sect2>

<!-- Section2: disclaimer -->

<sect2 id="disclaimer">
<title>ºÎÀÎ</title>
<para>

    No liability for the contents of this documents can be accepted.
    Use the concepts, examples and other content at your own risk.
    As this is a new edition of this document, there may be errors
    and inaccuracies, that may of course be damaging to your system.
    Proceed with caution, and although this is highly unlikely,
    the author(s) do not take any responsibility for that.

</para><para>

    All copyrights are held by their respective owners, unless
    specifically noted otherwise.  Use of a term in this document
    should not be regarded as affecting the validity of any trademark
    or service mark.

</para><para>

    Naming of particular products or brands should not be seen 
    as endorsements.

</para><para>

    You are strongly recommended to take a backup of your system 
    before major installation and backups at regular intervals.

</para>
 </sect2>

<!-- Section2: newversions-->

<sect2 id="newversions">
<title>½Å±Ô ¹öÀü</title>

    <indexterm>
     <primary>Snort Statistics!news on</primary>
    </indexterm>

<para>
ÀÌ ¹®¼­´Â ÃÖÃÊ ¹öÀüÀÌ´Ù.
</para>

<para>

ÀÌ HOWTO ¹®¼­ÀÇ ¸ÞÀÎ »çÀÌÆ®´Â <ulink url="http://www.lug-burghausen.org/projects/Snort-Statistics/">
http://www.lug-burghausen.org/projects/Snort-Statistics/</ulink> ÀÌ´Ù.

</para><para>

¹Ì·¯ »çÀÌÆ®µé·Î´Â <ulink url="http://www.linuxdoc.org/">Linux Documentation Project</ulink> ¶Ç´Â 
<ulink url="http://www.snort.org/">Snort</ulink> ÀÌ ÀÖ´Ù.

</para><para>

ÀÌ HOWTO ¹®¼­ÀÇ ÃÖ½Å ¹öÀüÀº ´Ã ¸ÞÀÎ »çÀÌÆ®¿¡¼­ ´Ù¾çÇÑ Æ÷¸ËÀ¸·Î ¾òÀ» ¼ö ÀÖ´Ù:

</para><para>

<itemizedlist>
<listitem>
<para>
<ulink url="http://www.lug-burghausen.org/projects/Snort-Statistics/index.html">HTML</ulink>.
</para>
</listitem>

<listitem>
<para>
<ulink url="http://www.lug-burghausen.org/projects/Snort-Statistics/Snort-Statistics-HOWTO.ps.gz">compressed
postscript (A4)</ulink>.
</para>
</listitem>

<listitem>
<para>
<ulink url="http://www.lug-burghausen.org/projects/Snort-Statistics/Snort-Statistics-HOWTO.sgml">SGML
source</ulink>.
</para>
 </listitem>
 </itemizedlist>

</para>
</sect2>

<!-- Section2: credits -->

<sect2 id="credits">
<title>°¨»ç</title>

<para>

    ´ÙÀ½ÀÇ »ç¶÷À» Æ÷ÇÔÇÏ¿© ¸¹Àº »ç¶÷µé¿¡°Ô °¨»çµå¸°´Ù.

</para>

   <para>
    <itemizedlist>

     <listitem>
      <para>
       Martin Roesch <email>roesch at sourcefire.com</email> Author of Snort
      </para>
     </listitem>
     <listitem>
      <para>
       Roman Danyliw <email>roman at danyliw.com</email> Author of ACID
      </para>
     </listitem>
     <listitem>
      <para>
       James Hoagland <email>hoagland at SiliconDefense.com</email> Author of
       SnortSnarf
      </para>
     </listitem>
     <listitem>
      <para>
       Stuart Staniford <email>stuart at SiliconDefense.com</email> Author of
       SnortSnarf
      </para>
     </listitem>
     <listitem>
      <para>
       Joe McAlerney <email>joey at siliconDefense.com</email> Author of
       SnortSnarf 
      </para>
     </listitem>
     <listitem>
      <para>
       John Lim <email>jlim at natsoft.com.my</email> Author of ADODB
      </para>
     </listitem>
     <listitem>
      <para>
       Afan Ottenheimer <email>afan at users.sourceforge.net</email> Author of
       PHPlot
      </para>
     </listitem>
     <listitem>
      <para>
       Andreas ?tling <email>andreaso at it.su.se</email> Author of
       arachnids_upd
      </para>
     </listitem>
     <listitem>
      <para>
       Max Vision <email>vision at whitehats.com</email> "Distributor" of
       vision.rules and maintainer of http://www.whitehats.com/
      </para>
     </listitem>
     <listitem>
      <para>
       Greg Sarsons <email>gsarsons at home.com</email> for proof reading and
       suggestions
      </para>
     </listitem>
     <listitem>
      <para>
       All the peaople on the <emphasis>snort-users</emphasis> mailinglist, they
       helped me and of course they will help YOU >;)
      </para>
     </listitem>
     <listitem>
      <para>
       ...
      </para>
     </listitem>
    </itemizedlist>
   </para>

<para>

    If I missed someone it was not because of not honoring her or his work!

</para>
   
</sect2>

<!-- Section2: feedback -->

<sect2 id="feedback">
<title>ÇÇµå¹é</title>
<para>

ÀÌ ¹®¼­¿¡ ´ëÇÑ ÇÇµå¹éÀº ¾ðÁ¦³ª È¯¿µÇÑ´Ù. ¿©·¯ºÐÀÇ Á¦¾È°ú Á¤º¸°¡ ¾ø¾ú´Ù¸é ÀÌ ¹®¼­´Â
Á¸ÀçÇÏÁö ¾ÊÀ» °ÍÀÌ´Ù. Ãß°¡»çÇ×, °ßÇØ ¹× ºñÆòÀ» ´ÙÀ½ ÀÌ¸ÞÀÏ ÁÖ¼Ò : <email>spoppi at gmx.de</email> ·Î º¸³»ÁÖ±â ¹Ù¶õ´Ù.

</para>
</sect2>

</sect1>

<!-- Section1: intro: END -->

<!-- Section1: structure -->

<sect1 id="structure">
<title>¹®¼­ ±¸Á¶</title>

  <indexterm>
   <primary>Snort-Statistics!structure</primary>
  </indexterm>

<para>

ÀÌ ¹®¼­´Â snort ¹öÀü 1.8.3, MySQL µ¥ÀÌÅ¸º£ÀÌ½º¿Í ±× Áö¿ø ÆÐÅ°Áö PHPlot ¿Í ADODB ¿Í ÇÔ²² snort ÀÇ ½Ç½Ã°£ Åë°è ÀÚ·á¸¦
À§ÇÑ À¥ ±â¹Ý ÇÁ·ÐÆ®¿£µåÀÎ ACID, snort ·Î±×ÆÄÀÏ ºÐ¼®À» À§ÇÑ À¥ ÇÁ·ÐÆ®¿£µå¸¦ °®´Â Åë°è µµ±¸ SnortSnarf, Max Vision ÀÇ
http://www.whitehats.com/ »çÀÌÆ®·ÎºÎÅÍ ´Ã ½ÇÁ¦ ±ÔÄ¢µéÀ» ¾ò±â À§ÇÑ arachnids_upd ¿Í snort °¡ Á¤ÁöÇßÀ» ¶§ snort ¿¡·¯¸¦ º¸°íÇÏ´Â Áö¸¦
°Ë»çÇÏ´Â µ¥ »ç¿ëÇÏ´Â ¿¹Á¦ swatch ¼³Á¤ÀÇ ¼³Ä¡ ¹× ¼³Á¤ ¹æ¹ý¿¡ ´ëÇÑ ´Ü°èº° °¡ÀÌµåÀÌ´Ù.

</para>
</sect1>
<!-- Section1: structure: END -->
<!-- Section1: Technical Overview -->

<sect1 id="technicaloverview">
<title>±â¼úÀûÀÎ °³¿ä</title>

   <indexterm>
    <primary>Snort-Statistics!technicaloverview</primary>
   </indexterm>

<para>

Snort ´Â ³×Æ®¿öÅ© Ä§ÀÔ Å½Áö ½Ã½ºÅÛ (Network Intrusion Detection System, NIDS) À¸·Î ¿ÀÇÂ ¼Ò½ºÀÌ¸ç ¸¶ÀÌÅ©·Î ¼ÒÆ®ÇÁ»Ó¸¸ ¾Æ´Ï¶ó ´Ù¾çÇÑ
À¯´Ð½º ÇÃ·§Æû¿¡¼­ »ç¿ëÇÒ ¼ö ÀÖ´Ù.

</para><para>

NIDS ´Â È£½ºÆ® ±â¹Ý IDS °¡ ´ÜÁö IDS °¡ ½ÇÇàµÇ°í ÀÖ´Â È£½ºÆ®¸¸À» °¨½ÃÇÏ´Â °Í°ú´Â ´Þ¸® ÀüÃ¼ ³×Æ®¿öÅ© ¼¼±×¸ÕÆ®¸¦ °¨½ÃÇÑ´Ù.

</para><para>

NIDS ´Â ´ëºÎºÐ ¹æÈ­º®°ú ÇÔ²² »ç¿ëµÇ±â ¶§¹®¿¡ °ø°Ý ÀÚÃ¼¿¡ Ãë¾àÇÏÁö ¾Ê¾Æ¾ß ÇÏ´Â °ÍÀÌ ÇÊ¼öÀûÀÌ´Ù. µû¶ó¼­ snort ¿Í ¹ÙÀÎµåµÇ¾î 
»ç¿ëµÇ´Â ¸ðµç ÀÎÅÍÆäÀÌ½ºµéÀº ip ÁÖ¼Ò¾øÀÌ ¼³Ä¡µÇ¾î¾ß ÇÑ´Ù. ±×·¯³ª, ÀÌ´Â ¸ðµç ¼³Á¤¿¡¼­ °¡´ÉÇÑ °ÍÀÌ ¾Æ´Ï±â ¶§¹®¿¡, ¿¹¸¦µé¾î snort ¸¦ 
isdn ÀÎÅÍÆäÀÌ½º ippp0 ¿¡ ¹ÙÀÎµåÇÏ·Á´Â °æ¿ì snort ¿¡ ´ëÇØ µ¶¸³ÀûÀÎ ÄÄÇ»ÅÍ¸¦ »ç¿ëÇØ ÀÌ¸¦ ´ÙÀÌ¾ó¾÷ ¿¬°á¿¡ ´ëÇÑ ¹æÈ­º® ¹× 
¶ó¿ìÅÍ·Î ¼³Ä¡ÇÏ´Â °ÍÀ» °í·ÁÇØ¾ß ÇÑ´Ù.

</para><para>

ÀÌ ÁÖÁ¦¿¡ ´ëÇÑ ´õ¿í ÀÚ¼¼ÇÑ Á¤º¸´Â <ulink url="http://www.linuxdoc.org/HOWTO/Firewall-HOWTO.html">
<emphasis remap="it">Firewall-HOWTO</emphasis></ulink> ¶Ç´Â ÀúÀÚÀÇ <ulink url="http://www.lug-burghausen.org/projects/firewall/firewall-masq-diald.html">
<emphasis remap="it">Firewalling+Masquerading+Diald+dynamic IP-HOWTO</emphasis></ulink> ¸¦ º¸¶ó.

</para><para>

Snort ´Â ÇÑ°³ ÀÌ»óÀÇ ³×Æ®¿öÅ© ¼¼±×¸ÕÆ®¸¦ °¨½ÃÇÏ´Âµ¥ »ç¿ëµÉ ¼ö ÀÖÀ¸¸ç ÀÌ´Â µÚ¿¡ ³íÀÇµÉ °ÍÀÌ´Ù.

</para><para>

Snort ´Â ³×Æ®¿öÅ© °ü·Ã ¹®Á¦¸¦ ÇØ°áÇÏ±â À§ÇØ ½º´ÏÆÛ (sniffer, Å½Áö±â) ·Îµµ »ç¿ëÇÒ ¼ö ÀÖÁö¸¸ ÀÌ´Â ÀÌ ¹®¼­ÀÇ ÁÖÁ¦°¡ ¾Æ´Ï´Ù.

</para><para>

ACID (Analysis Console for Intrusion Databases) ´Â AIR-CERT ÇÁ·ÎÁ§Æ®ÀÇ ÀÏºÎºÐÀ¸·Î PHP ¿¡¼­ ±×·¡ÇÁ »ý¼ºÀ» À§ÇÑ ¶óÀÌºê·¯¸®ÀÎ
PHPlot ¿Í PHP ¿Í MySQL ¹× PostgreSQL °ú °°Àº ¿©·¯ µ¥ÀÌÅ¸º£ÀÌ½º ½Ã½ºÅÛÀ» °áÇÕÇÏ±â À§ÇÑ Ãß»ó ¶óÀÌºê·¯¸®ÀÎ ADODB ¸¦ ÀÌ¿ëÇÑ´Ù.
ACID È¨ÆäÀÌÁöÀÇ ³»¿ëÀÌ´Ù:

</para><para>

<emphasis remap="it">"ACID ´Â Ä§ÀÔ Å½Áö ½Ã½ºÅÛ°ú ¹æÈ­º®°ú °°Àº º¸¾È °ü·Ã ¼ÒÇÁÆ®¿þ¾î¿¡ ÀÇÇØ
»ý¼ºµÈ º¸¾È »ç°Ç °ü·Ã µ¥ÀÌÅ¸º£ÀÌ½º °Ë»ö ¹× Ã³¸®¸¦ À§ÇÑ PHP ±â¹Ý ºÐ¼® ¿£ÁøÀÌ´Ù."</emphasis>

</para><para>

Max Vision ÀÇ IDS ±ÔÄ¢ (ÀÌ´Â ´Ù¿î·ÎµåÇÒ ¼ö ÀÖ´Â ÆÄÀÏ¸íÀ¸·Î <emphasis remap="it">vision.rules</emphasis>)
ÀÌ snort ¿¡ ³»ÀåµÇ¾î ÀÖ´Â ±ÔÄ¢µéÀ» ¿Ïº®ÇÏ°Ô ÇÏ±â À§ÇØ »ç¿ëµÈ´Ù.

</para><para>

arachnids_upd ´Â ÀÛÁö¸¸ ÈÇ¸¢ÇÑ ÆÞ ½ºÅ©¸³Æ®·Î <emphasis remap="it">wget</emphasis>¸¦ »ç¿ëÇØ
ÇöÀçÀÇ <emphasis remap="it">vision.rules</emphasis> À» ´Ù¿î·ÎµåÇÏ°í ¾Æ½ºÅ° ÆÄÀÏ³»ÀÇ ±ÔÄ¢µéÀ» ¼±ÅÃÀûÀ¸·Î
»èÁ¦ÇÑ´Ù.

</para>
</sect1>

<!-- Section1: Technical Overview: END -->
<!-- Section1: Configuration -->

<sect1 id="configuration">
<title>¼³Á¤</title>

   <indexterm>
    <primary>Snort-Statistics!configuration</primary>
   </indexterm>

<para>

ÀÌ ÀåÀº snort ¿Í °¢Á¾ µµ±¸µéÀÇ ¼³Ä¡ ¹× ½ÇÇàÀ» À§ÇÑ ¿©·¯ ÅÂ½ºÅ©¸¦ ±â¼úÇÑ´Ù.

</para><para>

ÀúÀÚ´Â ·¹µåÇÞ ¸®´ª½º 7.x À» »ç¿ëÇÏ°í ÀÖ±â ¶§¹®¿¡ ¸ðµç ÁÖ¾îÁø °æ·ÎÀÌ¸§ ¹× ¼³Á¤ ¿É¼ÇÀº °á±¹ ·¹µåÇÞ¿¡ Æ¯Á¤ÀûÀÎ °ÍÀÌ´Ù.
±×·¯³ª ´Ù¸¥ ¹èÆ÷ÆÇ¿¡ ÀÌ ¹®¼­ÀÇ ³»¿ëÀ» Àû¿ëÇÒ ¶§ Å« ¹®Á¦´Â ¾øÀ» °ÍÀÌ´Ù.

</para>

<sect2 id="snort-config">
<title>Snort ¼³Á¤ÇÏ±â</title>

<para>

ÇöÀçÀÇ Å¸¸£º¼À» <ulink url="http://www.snort.org/">http://www.snort.org/</ulink> ¿¡¼­ ¾ò¾î ½º½º·Î ÄÄÆÄÀÏÇÏ°Å³ª ¶Ç´Â 
¹èÆ÷ÆÇ³»ÀÇ ¹ÙÀÌ³Ê¸®¸¦ »ç¿ëÇØ snort ¸¦ ¼³Ä¡ÇÒ ¼ö ÀÖ´Ù.

</para><para>

¹öÀü 1.8.3 ÀÇ °æ¿ì RPM ±â¹Ý ¸®´ª½º ¹èÆ÷ÆÇ, FreeBSD, ¼Ö¶ó¸®½º ¹× À©µµ¿ì ÇÃ·§Æû¿¡ ´ëÇØ 
<ulink url="http://www.snort.org/">www.snort.org</ulink> ¿¡¼­ ¹Ì¸® ÄÄÆÄÀÏµÈ ¹ÙÀÌ³Ê¸®¸¦ ¾òÀ» ¼ö ÀÖ´Ù.

</para><para>

ÀúÀÚ´Â RPM À» ´õÀÌ»ó À¯Áöº¸¼öÇÏ°í ÀÖÁö ¾ÊÁö¸¸ (¹öÀüÀÌ ¹Ù²ð¶§ ¸¶´Ù ÀÛ¾÷À» ÇØ¾ß ÇÏ±â ¶§¹®¿¡) 
<ulink url="http://www.lug-burghausen.org/projects/Snort-Statistics/snortd.multi">
http://www.lug-burghausen.org/projects/Snort-Statistics/snortd.multi</ulink> ¿¡¼­ <emphasis remap="it">
snort.multi</emphasis> initscript ¸¦ Á¦°øÇÒ °ÍÀÌ´Ù.

</para><para>

MySQL À» Áö¿øÇÏ´Â (PostgreSQL Àº Áö¿øÇÏÁö ¾Ê´Â) ÀúÀÚÀÇ 1.8.1 RPM Àº <ulink 
url="http://www.lug-burghausen.org/projects/Snort-Statistics/snort-1.8.1-4.i386.rpm">
http://www.lug-burghausen.org/projects/Snort-Statistics/snort-1.8.1-4.i386.rpm</ulink> ¿¡¼­ ¾òÀ» ¼ö ÀÖ´Ù.
PostgreSQL À» Áö¿øÇÏ´Â ¹öÀüÀ» ¸¸µé±â À§ÇØ¼­´Â <ulink 
url="http://www.lug-burghausen.org/projects/Snort-Statistics/snort-1.8.1-4.src.rpm">¼Ò½º 
RPM</ulink> À» ´Ù¿î·ÎµåÇÑ ÈÄ spec ÆÄÀÏÀ» ÆíÁýÇØ Àç±¸ÃàÇØ¶ó. RPM ÀÛ¼º¿¡ ÀÍ¼÷ÇÏÁö ¾Ê´Ù¸é <ulink 
url="http://www.linuxdoc.org/HOWTO/RPM-HOWTO.html">
<emphasis remap="it">RPM-HOWTO</emphasis></ulink> ¶Ç´Â RPM ¿¡ ´ëÇÑ ¸¹Àº ÁÁÀº ÀÚ·á¿Í ÇÔ²² RPM ¿¡ ´ëÇØ 
´Ù¿î·ÎµåÇÒ ¼ö ÀÖ´Â Ã¥ <emphasis remap="it">Maximun RPM</emphasis> ÀÌ ÀÖ´Â <ulink 
url="http://www.rpm.org/">http://www.rpm.org/</ulink> À» º¸¾Æ¾ß ÇÑ´Ù.

</para>

<sect3 id="snort.conf">
<title>/etc/snort/snort.conf</title>

<para>

RPM À» ¼³Ä¡ÇÑ ÈÄ ¿ä±¸¿¡ ¸Â°Ô <emphasis remap="it">/etc/snort/snort.conf</emphasis> ¸¦ ÆíÁýÇØ¾ß ÇÑ´Ù.
Martin Roesch ´Â snort Å¸¸£º¼°ú RPM ¿¡ Æ÷ÇÔµÇ¾î ÀÖ´Â Snort »ç¿ëÀÚ ¸Þ´º¾óÀ» PDF ¹öÀüÀ¸·Î ÀÛ¼ºÇÏ¿´´Âµ¥ 
ÀÌ ¹®¼­¿¡¼­´Â ¼³Á¤¿¡ ÇÊ¿äÇÑ ¿É¼Çµé¸¸À» ´Ù·ê °ÍÀÌ±â ¶§¹®¿¡ »ç¿ëÇÒ ¼ö ÀÖ´Â ´Ù¸¥ ¿É¼Çµé¿¡ ´ëÇØ¼­´Â ¸Þ´º¾óÀ»
º¸¾Æ¾ß ÇÑ´Ù.

</para><para>

¶ÇÇÑ Å¸¸£º¼/RPM ¿¡ ÀÖ´Â ¿¹Á¦ <emphasis remap="it">/etc/snort/snort.conf</emphasis> ÆÄÀÏ¿¡ ¼¼ºÎÀûÀÎ ¼³¸íÀÌ ÀÖ±â ¶§¹®¿¡
½ÃÀÛÇÏ´Âµ¥ ÀÖ¾î ÁÁÀº Ãâ¹ßÁ¡ÀÌ µÉ °ÍÀÌ´Ù.

</para>

<sect4 id="snort-vars">
<title>Snort º¯¼ö</title>
<para>

¿ì¼± ³×Æ®¿öÅ© À§»óÀ» ¹Ý¿µÇÏ±â À§ÇØ HOME_NET, EXTERNAL_NET °ú DNS_SERVERS ¿Í °°Àº º¯¼öµéÀ» Á¤ÀÇÇØ¾ß ÇÑ´Ù.
Á¤È®ÇÑ ÁÖ¼Ò¸¦ »ç¿ëÇß´ÂÁö È®ÀÎÇØ¶ó ±×·¸Áö ¾ÊÀº °æ¿ì ºÒ°¡»çÀÇÇÑ ¶Ç´Â ´õ¿í ³ª»Ú°Ô´Â ¾î¶°ÇÑ °æº¸µµ ¾òÀ» ¼ö ¾øÀ» °ÍÀÌ´Ù.

</para><para>

º¹ÀâÇÑ È¯°æ¿¡¼­ snort ¸¦ »ç¿ëÇÒ ¶§, °¡·É ÇÑ°³ÀÇ ¼¾¼­·Î ´Ù¼öÀÇ ÀÎÅÍÆäÀÌ½º¸¦ °¨½ÃÇÒ ¶§ HOME_NET °ú EXTERNAL_NET Àº Á¤ÀÇÇÏ±â ¾î·Æ°Å³ª
¶Ç´Â ¸Å¿ì ±ä ¸®½ºÆ®·Î Á¤ÀÇµÉ ¼ö ÀÖ´Âµ¥ ÀÌ °æ¿ì µÎ º¯¼ö¸¦ <emphasis remap="it">any</emphasis> ·Î Á¤ÀÇÇÒ ¼ö ÀÖ´Ù.
Ä¿´Ù¶õ ³»ºÎ ³×Æ®¿öÅ©¿¡ ¾ÆÁÖ ¸¹Àº ³×Æ®¿öÅ© ¹üÀ§¸¦ ³ÖÁö ¾Ê±â À§ÇØ¼­´Â ¾î¶² Á¾·ùÀÇ ¹Ì¸® ÇÊÅÍ¸µµÈ °ÍÀ» ¾ø¾Ö¾ß ÇÑ´Ù. ±×¸®°í
°¢ ÆÐÅ¶¿¡ ´ëÇØ ¸Å¿ì ¸¹Àº ÁÖ¼Ò¸¦ ÅëÇØ snort ¸¦ ½ÇÇà½ÃÅ³ ¶§ ¼º´É¿¡ ´ëÇÑ ¿µÇâÀ» ÃÖ¼ÒÈ­½ÃÄÑ¾ß ÇÑ´Ù.

</para><para>

¸î¸îÀÇ ´Ù·ç±â Èûµç Àß¸øµÈ Æ÷Æ®½ºÄµ ¸Þ½ÃÁö¸¦ ¾ø¾Ö±â À§ÇØ¼­´Â º¯¼ö DNS_SERVERS ¸¦ snort ÀÇ Æ÷Æ®½ºÄµ ¸ðµâÀ» À¯¹ßÇÏ´Â 
³×Æ®¿öÅ© °ü¸® ½ºÅ×ÀÌ¼Ç°ú °°Àº ´Ù¸¥ ³ëµåµé»Ó¸¸ÀÌ ¾Æ´Ï¶ó ¸ðµç dns ¼­¹öµéÀÇ ip ÁÖ¼Ò¸¦ º¸À¯ÇÏµµ·Ï Á¤ÀÇÇØ¾ß ÇÑ´Ù. 
ÀÌ´Â ÇöÀç ÁøÇàÁßÀÎ ÀÛ¾÷ÀÌ´Ù.

</para><para>

¶ÇÇÑ °¢ÀÚ ±ÔÄ¢¿¡¼­ ¾ð±ÞµÉ ¼ö ÀÖ´Â ÀÚ½Å¸¸ÀÇ º¯¼öµéÀ» Á¤ÀÇÇÒ ¼ö ÀÖ´Ù. ÀÌ´Â À¯¿ëÇÑµ¥ ¿¹¸¦µé¾î ÀÚ½ÅÀÇ È¯°æ¿¡ ÀûÇÕÇÏ°Ô
<emphasis remap="it">pass rules</emphasis>¸¦ »ç¿ëÇÒ ¼ö ÀÖ´Ù.

</para><para>

¸ðµç ´Ù¸¥ º¯¼öµéÀ» ÀûÀýÇÑ °ª ¶Ç´Â <emphasis remap="it">/etc/snort/snort.conf</emphasis> ¿¡ Á¤ÀÇµÇ¾î ÀÖ´Â $HOME_NET À¸·Î Á¤ÀÇÇØ¶ó.

</para><para>

     <programlisting>
      var HOME_NET any
      var EXTERNAL_NET any
      # DNS_SERVERS ´Â Æ÷Æ®½ºÄµ½Ã ¹«½ÃµÇ¾îÁö´Â DNS ¶Ç´Â ³×Æ®¿öÅ© °ü¸® ½ºÅ×ÀÌ¼Ç°ú °°Àº noisy ÄÄÇ»ÅÍµéÀÇ ÁÖ¼ÒµéÀÌ´Ù. 
      var DNS_SERVERS [1.1.1.1/32,2.2.2.2/32]
      var SMTP_SERVERS $HOME_NET
      ...
     </programlisting>

</para>
</sect4>
    
<sect4 id="snort-preprocessors">
<title>Snort ÀüÃ³¸®±â</title>
    
<para>

´ÙÀ½Àº »ç¿ëµÇ´Â ÀüÃ³¸®±âµéÀ» ¼³Á¤ÇØ¾ß ÇÑ´Ù. ´õ¿í ¸¹Àº ÀüÃ³¸®±â¸¦ »ç¿ëÇÒ ¼ö·Ï ´õ¿í ¸¹Àº °æº¸¸¦ À¯¹ß½ÃÅ³ ¼ö ÀÖÁö¸¸ ¼º´ÉÀÌ ÀúÇÏµÈ´Ù.
µû¶ó¼­ ÀüÃ³¸®±â¸¦ ¼±ÅÃÇÏ´Âµ¥ ÁÖÀÇÇØ¶ó.

</para><para>

¾î¶² ÀüÃ³¸®±âµéÀº ¹Ý´ëµÇ°í ÀÖ±â¶§¹®¿¡ ¶ÇÇÑ Marty ÀÇ <emphasis remap="it">Snort »ç¿ëÀÚ ¸Þ´º¾ó</emphasis>À» º¸¾Æ¾ß ÇÏ´Âµ¥, 
ÀÌµé¿¡ ´ëÇØ¼­´Â »õ·Ó°Ô µµÀÔµÈ °ÍµéÀ» »ç¿ëÇØ¾ß ÇÑ´Ù.

</para><para>

ÀüÃ³¸®±â <emphasis remap="it">minfrag</emphasis> ¿Í <emphasis remap="it">stream</emphasis> Àº 
<emphasis remap="it">stream4</emphasis> ·Î ÀüÃ³¸®±â <emphasis remap="it">defrag</emphasis> ´Â 
<emphasis remap="it">frag2</emphasis> À¸·Î ´ëÃ¼µÇ¾ú´Ù.

</para><para>

<emphasis remap="it">frag2</emphasis> ´Â snort v1.8 ¿¡ µµÀÔµÈ »õ·Î¿î IP defragmentation 
(´ÜÆíÈ­µÈ Á¶°¢µéÀ» ¿¬¼ÓÀûÀÎ Á¶°¢À¸·Î ¸¸µé¾îÁÜ) Ã³¸®±â·Î <emphasis remap="it">defrag/minfrag</emphasis> º¸´Ù ´õ¿í ¸Þ¸ð¸® È¿À²ÀûÀÌ´Ù.

</para><para>

Snort »ç¿ëÀÚ ¸Þ´º¾ó·ÎºÎÅÍ: <emphasis remap="it">Stream4 ¸ðµâÀº snort ¿¡ TCP ½ºÆ®¸² ÀçÁ¶ÇÕ ¹× »óÅÂ¿¡ ´ëÇÑ ºÐ¼® (stateful analysis) 
´É·ÂÀ» Á¦°øÇÑ´Ù. Snort ´Â °ß°íÇÑ ½ºÆ®¸² ÀçÁ¶ÇÕ ´É·Â¿¡ ÀÇÇØ "»óÅÂ°¡ ¾ø´Â (stateless)" °ø°ÝµéÀ» ¹«½ÃÇÑ´Ù. Stream4 ¸ðµâÀº ¶ÇÇÑ 
»ç¿ëÀÚµé¿¡°Ô 256 °³ ÀÌ»óÀÇ µ¿½ÃÀûÀÎ TCP ½ºÆ®¸²À» ÃßÀûÇÒ ¼ö ÀÖµµ·Ï ÇÑ´Ù. 
Stream4 ´Â 64,000 °³ ÀÌ»óÀÇ TCP Á¢¼ÓÀ» ´Ù·ç±â À§ÇØ È®ÀåµÉ ¼ö ÀÖ¾î¾ß ÇÑ´Ù.</emphasis>

</para><para>

<emphasis remap="it">Stream4</emphasis> ¸ðµâÀº <emphasis remap="it">stream4</emphasis> ¿Í 
<emphasis remap="it">stream4_reassemble</emphasis> 2 °³ÀÇ ÀüÃ³¸®±â·Î ÀÌ·ç¾îÁ® ÀÖ´Âµ¥ µÑ ¸ðµÎ »ç¿ëµÇ¾î¾ß ÇÑ´Ù.

</para><para>

µÎ ÀüÃ³¸®±â¿¡ ´ëÇØ¼­´Â ¿©·¯°¡Áö ¿É¼ÇÀÌ ÀÖÁö¸¸ <emphasis remap="it">stream4</emphasis> ¿¡ ´ëÇØ¼­´Â Æ÷Æ®½ºÄµ ÀÌº¥Æ®½Ã °æº¸¸¦ ÁÖ±â À§ÇÑ
<emphasis remap="it">detect_scans</emphasis> °ú °ø°ÝÀûÀÎ RST ÆÐÅ¶, SYN ÆÐÅ¶¿¡ µ¥ÀÌÅ¸°¡ ÀÖ°í À©µµ¿ì ½ÃÄö½º ³Ñ¹öÀÇ ¹üÀ§¸¦ ³Ñ¾î¼­´Â
°Í°ú °°ÀÌ ½ºÆ®¸² ÀÌº¥Æ®°¡ ÀÏ¾î³¯ ¶§ ¾Ë¸®±â À§ÇØ <emphasis remap="it">detect_state_problems</emphasis> ¿É¼Ç¸¸À» »ç¿ëÇÒ °ÍÀÌ´Ù.

</para><para>

<emphasis remap="it">stream4_reassemble</emphasis> ¿¡ ´ëÇØ¼­´Â ÀçÁ¶ÇÕÀÌ ´ÜÁö ¾à°£ÀÇ ¹Ì¸® Á¤ÀÇµÈ Æ÷Æ®´ë½Å ¸ðµç Æ÷Æ®¸¦ °¨½ÃÇÏµµ·Ï ÇÏ´Â 
<emphasis remap="it">ports all</emphasis> ¿É¼ÇÀ» »ç¿ëÇÑ´Ù. ¼ÖÁ÷È÷ ÀÌ´Â ÀÏÁ¾ÀÇ ÆíÁýÁõÀ¸·Î snort ¼¾¼­ÀÇ cpu ÀÌ¿ë»óÈ²¿¡ ¿µÇâÀ» ³¢Ä£´Ù. 
±×·¯³ª ÀúÀÚ´Â Æò±ÕÀûÀ¸·Î ³·Àº ÀÌ¿ë»óÈ²À» °®´Â ÆæÆ¼¾ö III 800 MHz ÄÄÇ»ÅÍ°¡ ¼¼°³ÀÇ 100Mbit/s full duplex line ¿¡¼­ °¨½ÃÇÏ´Â °æ¿ì 
¾î¶°ÇÑ ³ª»Û °á°úµµ ¾òÁö ¾Ê¾Ò±â ¶§¹®¿¡ ÀÌ ¿É¼ÇÀÌ ´õ¿í ÁÁÀº ÇØ°á ¹æ¹ýÀÌ¶ó°í »ý°¢ÇÑ´Ù.

</para><para>

µÎ°³ÀÇ ´Ù¸¥ ÀüÃ³¸®±âµéÀº <emphasis remap="it">portscan</emphasis> ¿Í <emphasis remap="it">portscan-ignorehosts</emphasis> ·Î
 °¢°¢ Æ÷Æ®½ºÄµ Å½Áö ´ã´ç ¹× Æ÷Æ®½ºÄµ Å½Áö°¡ ¹«½ÃµÇ´Â È£½ºÆ®µéÀÌ´Ù.

</para><para>

<emphasis remap="it">0.0.0.0/0</emphasis> ÇüÅÂ¸¦ »ç¿ëÇÏ¿© <emphasis remap="it">portscan</emphasis>ÀÌ ¸ðµç ³×Æ®¿öÅ©¸¦ Ã£±â À§ÇØ¼­
Á¢±ÙµÇ¾îÁö´Â Æ÷Æ® ³Ñ¹öÀÇ ¼ö¸¦ ¼³Á¤ÇÏ°í ÃÊ´ç Å½Áö ±â°£À» Á¤ÀÇÇÏ¶ó. Ãß°¡ÀûÀ¸·Î Æ÷Æ®½ºÄµ ·Î±× ÆÄÀÏ¿¡ ´ëÇÑ Àý´ë °æ·Î¸¦ Á¦°øÇØ¾ß ÇÑ´Ù.

</para><para>

<emphasis remap="it">portscan-ignorehosts</emphasis> ¸¦ ÀÌ¿ëÇØ ³×ÀÓ ¼­¹ö ¹× ³×Æ®¿öÅ© °ü¸® ½ºÅ×ÀÌ¼Ç°ú °°ÀÌ ³Ê¹« ¸¹ÀÌ ¸»ÇÏ¸ç
 Æ÷Æ®½ºÄµ Å½Áö¸¦ À¯¹ßÇÏ´Â È£½ºÆ®·ÎºÎÅÍÀÇ ¾î¶² ¼ö»óÇÑ °æº¸¸¦ Á¦°ÅÇÑ´Ù (À§ÀÇ º¯¼ö <emphasis remap="it">DNS_SERVERS</emphasis> ¸¦ º¸¶ó).

</para><para>

Marty ÀÇ »ç¿ëÀÚ ¸Þ´º¾ó¿¡ ¾ð±ÞµÇ¾îÀÖÁö ¾ÊÁö¸¸ ¿©±â¼­ »ç¿ëÇÒ ¾î¶² ÀüÃ³¸®±âµéÀÌ ÀÖ´Ù. <emphasis remap="it">unidecode</emphasis> ´Â 
<emphasis remap="it">http_decode</emphasis> ¸¦ ´ëÃ¼ÇÏ´Âµ¥ http ¹× UNICODE °ø°ÝÀ» Á¤±ÔÈ­ÇÑ´Ù (Ç¥ÁØÀûÀÎ »óÈ²À¸·Î ÇØ¼®ÇÑ´Ù). 
<emphasis remap="it">rpc_decode</emphasis> ÁÖ¾îÁø Æ÷Æ®¿¡¼­ÀÇ rpc Æ®·¡ÇÈÀ» Á¤±ÔÈ­ÇÏ¸ç <emphasis remap="it">bo</emphasis> ´Â 
¹é ¿À·¯ÇÇ½º °ø°ÝÀ» °Ë»çÇÏ¸ç <emphasis remap="it">telnet_decode</emphasis> ´Â 
tenlnet Çù»ó ½ºÆ®¸µÀ» Á¤±ÔÈ­ÇÑ´Ù.

</para><para>

SPADE ¿Í °°Àº ´Ù¸¥ ÀüÃ³¸®±âµéÀº ¿©±â¼­ ´Ù·çÁö ¾ÊÁö¸¸ ÃßÈÄ ¹öÀü¿¡¼­´Â ´Ù·ç¾îÁú °ÍÀÌ´Ù.

</para><para>

°á±¹ ¿©±â¼­ ¾ð±ÞÇÑ °ÍµéÀº <emphasis remap="it">/etc/snort/snort.conf</emphasis> ÀÇ ÀüÃ³¸®±â ºÎºÐÀÌ´Ù.

</para><para>

     <programlisting>
      preprocessor frag2
      preprocessor stream4: detect_scans detect_state_problems
      preprocessor stream4_reassemble: ports all
      preprocessor unidecode: 80 8080
      preprocessor rpc_decode: 111
      preprocessor bo: -nobrute
      preprocessor telnet_decode
      preprocessor portscan: 0.0.0.0/0 6 3 /var/log/snort/portscan.log
      preprocessor portscan-ignorehosts: $DNS_SERVERS
     </programlisting>

</para>
</sect4>

<sect4 id="snort-output-modules">
<title>Snort Ãâ·Â ¸ðµâ</title>
<para>

´ÙÀ½Àº Ãâ·Â ¸ðµâµéÀÇ ¼³Á¤À¸·Î ÀÌ Áß¿¡¼­ syslog ¸ðµâÀÎ <emphasis remap="it">alert_syslog</emphasis> ¸¦ »ç¿ëÇØ syslog ¿¡ 
°æº¸¸¦ º¸³¾ °ÍÀÌ¸ç <emphasis remap="it">database</emphasis> ¸ðµâÀ» »ç¿ëÇØ MySQL µ¥ÀÌÅ¸º£ÀÌ½º¿¡ Ãß°¡ÀûÀ¸·Î ±â·ÏÇÒ °ÍÀÌ´Ù.

</para><para>

<emphasis remap="it">alert_syslog</emphasis> ¸ðµâÀº ±â·ÏµÇ¾îÁ®¾ß ÇÏ´Â °Íµé¿¡ ´ëÇØ ¾î¶² ¿É¼ÇÀ» ÇÊ¿ä·ÎÇÑ´Ù.
ÀúÀÚ¿Í °°ÀÌ ·Î±×ÆÄÀÏÀ» ºÐ¼®ÇÏ±â À§ÇØ SnortSnarf À» »ç¿ëÇÑ´Ù¸é <emphasis remap="it">LOG_PID</emphasis> ¿É¼ÇÀ» Ãß°¡ÇØ¾ßÇÑ´Ù. 
±×·¸Áö ¾Ê´Ù¸é SnortSnarf ¸¦ »ç¿ëÇÒ ¶§ ¹®Á¦°¡ ÀÖ´Ù.

</para><para>

¾Õ¿¡¼­ ¸»ÇßµíÀÌ ACID ¸¦ »ç¿ëÇÒ °ÍÀÎµ¥ µû¶ó¼­ µ¥ÀÌÅ¸º£ÀÌ½º¿¡ ±â·ÏÇÏ±â À§ÇØ snort ¸¦ ¼³Á¤ÇÒ ÇÊ¿ä°¡ ÀÖ´Ù.
Æ¯º°ÇÑ ÀÌÀ¯¾øÀÌ MySQL À» ¼±ÅÃÇß´Ù (postgreSQL º¸´Ù MySQL À» ´õ ¸¹ÀÌ µé¾úÀ» »ÓÀÌ´Ù).

</para><para>

<emphasis remap="it">database</emphasis> Ãâ·Â ¸ðµâÀº ´ÙÀ½ º¯¼öµéÀ» ÇÊ¿ä·Î ÇÑ´Ù:

</para><para>

<variablelist>
<varlistentry>
<term>log | alert</term>
<listitem>
<para>

<emphasis>alert</emphasis> ±â´É¿¡ ´ëÇÑ ·Î±×. <emphasis remap="it">log</emphasis> ±â´Éµµ °¡´ÉÇÏ´Ù.
Æ÷Æ®½ºÄµ °æº¸¸¦ µ¥ÀÌÅ¸º£ÀÌ½º¿¡ ÀúÀåÇÏ°í ½Í´Ù¸é <emphasis remap="it">alert</emphasis> ¸¦ »ç¿ëÇØ¾ß ÇÑ´Ù.

</para>
</listitem>
</varlistentry>

<varlistentry>
<term>mysql|postgrsql|odbc|oracle|mssql</term>
<listitem>
<para>µ¥ÀÌÅ¸º£ÀÌ½º Å¸ÀÔ.</para>
</listitem>
</varlistentry>

<varlistentry>
<term>user=&lt;username&gt;</term>
<listitem>
<para>µ¥ÀÌÅ¸º£ÀÌ½º¿¡ »ç¿ëµÉ »ç¿ëÀÚÀÌ¸§À» Á¤ÀÇÇÑ´Ù.</para>
</listitem>
</varlistentry>

<varlistentry>
<term>password=&lt;password&gt;</term>
<listitem>
<para>ÁÖ¾îÁø »ç¿ëÀÚ¿¡ ´ëÇØ ÇÊ¿äÇÑ ÆÐ½º¿öµå.</para>
</listitem>
</varlistentry>

<varlistentry>
<term>dbname=&lt;databasename&gt;</term>
<listitem>
<para>±â·Ï¿¡ »ç¿ëµÇ´Â µ¥ÀÌÅ¸º£ÀÌ½º ÀÌ¸§.</para>
</listitem>
</varlistentry>

<varlistentry>
<term>host=&lt;hostname&gt;</term>
<listitem>
<para>

µ¥ÀÌÅ¸º£ÀÌ½º°¡ ½ÇÇàÁßÀÎ È£½ºÆ®¸¦ Á¤ÀÇÇÑ´Ù. µ¥ÀÌÅ¸º£ÀÌ½º°¡ snort ¼¾¼­¿¡¼­ ½ÇÇàµÇ°í ÀÖ´Ù¸é
localhost ¸¦ »ç¿ëÇØ¶ó.

</para>
</listitem>
</varlistentry>

<varlistentry>
<term>sensor_name=&lt;sensor name&gt;</term>
<listitem>
<para>

ÇÏ³ª ÀÌ»óÀÇ ¼¾¼­°¡ ÇÏ³ªÀÇ µ¥ÀÌÅ¸º£ÀÌ½º¿¡ ±â·ÏÇÏ°í ÀÖ´Ù¸é ¿©·¯ ¼¾¼­¸¦ ±¸º°ÇÏ±âÀ§ÇØ °íÀ¯ÀÇ ÀÌ¸§À» ºÎ¿©ÇÑ´Ù.

</para>
</listitem>
</varlistentry>
</variablelist>

</para><para>

<emphasis remap="it">/etc/snort/snort.conf</emphasis> ÀÇ Ãâ·Â ¸ðµâ ºÎºÐÀ» º¸ÀÚ.

</para><para>

      <programlisting>
       output alert_syslog: LOG_AUTH LOG_ALERT LOG_PID
       output database: alert, mysql, user=snort password=mypassword dbname=snort host=localhost sensor_name=mysensor 
      </programlisting>

</para><para>

ÇÏ³ª ÀÌ»óÀÇ snort ¼¾¼­¸¦ »ç¿ëÇÏ¸ç ÇÏ³ªÀÇ µ¥ÀÌÅ¸º£ÀÌ½º¿¡ ±â·ÏÇÏ°í ½Í´Ù¸é º°µµÀÇ ¸Ó½Å¿¡ Áß¾Ó µ¥ÀÌÅ¸º£ÀÌ½º¸¦ »ç¿ëÇÏ±â ¹Ù¶õ´Ù.
ÀÌ·± °æ¿ì °ø°ÝÀÌ ¹ß°ßµÉ ¶§ °æº¸ µ¥ÀÌÅ¸¸¦ ÇÏ³ªÀÇ ÄÁ¼Ö°ú ¿¬°ü½ÃÅ³ ¼ö ÀÖÀ¸¸ç ´õ¿í ÁÁÀº °³¿ä¸¦ ¾òÀ» ¼ö ÀÖ´Ù.

</para>
</sect4>

<sect4 id="snort-rules">
<title>Snort ±ÔÄ¢ ÁýÇÕ</title>
    
<para>

±ÔÄ¢µéÀº snort ÀÇ ÇÊ¼öÀûÀÎ ºÎºÐÀ¸·Î ´Ù¾çÇÑ Ç×¸ñÀ¸·Î ³ª´©¾îÁ® ÀÖ´Âµ¥ ÀÌµéÀº <emphasis>*.rules</emphasis> ·Î ³¡³ª¸ç 
<emphasis>/etc/snort/</emphasis> ¿¡¼­ Ã£À» ¼ö ÀÖ´Ù. 1.8 ÀÌ»óÀÇ ¹öÀü¿¡¼­´Â ºÐ·ù ÇüÅÂ¸¦ ¹Ý¿µÇÏ±â À§ÇØ Æ÷¸ËÀÌ º¯°æµÇ¾ú´Ù.
¶ÇÇÑ classtype ÀÇ ¿ì¼±±Ç ¼³Á¤À» Á¤ÀÇÇÒ ¼ö ÀÖ´Ù.

</para><para>

¿ø·¡ÀÇ snort tarball À» »ç¿ëÇÏ°í ÀÖ´Ù¸é ¸ðµç ±ÔÄ¢ ÆÄÀÏµé°ú <emphasis>classification.config</emphasis> ÆÄÀÏÀ» º¹»çÇÏ±æ ¹Ù¶õ´Ù.

</para><para>

ºÐ·ù Å¸ÀÔÀÇ ¼³Á¤Àº <emphasis>/etc/snort/classification.config</emphasis> ÆÄÀÏ¿¡¼­ ÇÏ´Âµ¥ ÀÌ ÆÄÀÏÀº ÀûÀçµÈ snort ±ÔÄ¢¿¡ ´ëÇØ ¹Ì¸®
Á¶Á¤µÇ¾î ÀÖ±â ¶§¹®¿¡ ¼Õ´î ÇÊ¿ä´Â ¾ø´Ù. ±×·¯³ª Max Vision ÀÇ <emphasis remap="it">vision.rules</emphasis> ¸¦ »ç¿ëÇÏ·Á ÇÑ´Ù¸é 
classtype ÀÌ ´Ù¸£±â ¶§¹®¿¡ ¾à°£ÀÇ ¶óÀÎµéÀ» Ãß°¡ÇØ¾ß ÇÒ °ÍÀÌ´Ù. ±×Àú ¸ðµç <emphasis remap="it">config classification:</emphasis> 
¶óÀÎÀ» <emphasis remap="it">vision.conf</emphasis> ¿¡¼­ <emphasis remap="it">/etc/snort/classification.config</emphasis> ·Î 
º¹»çÇØ¼­ ºÙ¿©³Ö¾î¶ó. ÀÌÀü ÆÄÀÏÀÌ snort 1.8 ¿¡¼­ µµÀÔµÈ »õ·Î¿î Æ÷¸Ë¿¡ ¸ÂÁö ¾Ê´Â °æ¿ì snort 1.8 ¿¡ ´ëÇÑ 
<emphasis remap="it">vision.rules</emphasis> ¸¦ ÀØÁö¸»°í ¾ò¾î¶ó (<ulink 
url="http://www.whitehats.com/">http://www.whitehats.com/</ulink>¿¡¼­
<emphasis remap="it">vision18.rules</emphasis> ¹× <emphasis remap="it">vision18.conf</emphasis>)

</para><para>

´ÙÀ½Àº <emphasis remap="it">vision.rules</emphasis>À» »ç¿ëÇÑ <emphasis remap="it">/etc/snort/classification.config</emphasis> ÆÄÀÏÀÌ´Ù:

</para><para>

      <programlisting>
       #
       # config classification:°£·«ÇÑ ÀÌ¸§, °£·«ÇÑ ¼³¸í, ¿ì¼±±Ç
       #
       #config classification: not-suspicious,Not Suspicious Traffic,0
       config classification: unknown,Unknown Traffic,1
       config classification: bad-unknown,Potentially Bad Traffic, 2
       config classification: attempted-recon,Attempted Information Leak,3
       config classification: successful-recon-limited,Information Leak,4
       config classification: successful-recon-largescale,Large Scale Information Leak,5
       config classification: attempted-dos,Attempted Denial of Service,6
       config classification: successful-dos,Denial of Service,7
       config classification: attempted-user,Attempted User Privilege Gain,8
       config classification: unsuccessful-user,Unsuccessful User Privilege Gain,7
       config classification: successful-user,Successful User Privilege Gain,9
       config classification: attempted-admin,Attempted Administrator Privilege Gain,10
       config classification: successful-admin,Successful Administrator Privilege Gain,11

       # vision18.conf ¿¡¼­ Ãß°¡µÈ ºÎºÐ
       # classification for use with a management interface
       # low risk
       config classification: not-suspicious,policy traffic that is not suspicious,0
       config classification: suspicious,suspicious miscellaneous traffic,1
       config classification: info-failed,failed information gathering attempt,2
       config classification: relay-failed,failed relay attempt,3
       config classification: data-failed,failed data integrity attempt,4
       config classification: system-failed,failed system integrity attempt,5
       config classification: client-failed,failed client integrity attempt,6
       # middle risk
       config classification: denialofservice,denial of service,7
       config classification: info-attempt,information gathering attempt,8
       config classification: relay-attempt,relay attempt,9
       config classification: data-attempt,data integrity attempt,10
       config classification: system-attempt,system integrity attempt,11
       config classification: client-attempt,client integrity attempt,12
       config classification: data-or-info-attempt,data integrity or information gathering attempt,13
       config classification: system-or-info-attempt,system integrity or information gathering attempt,14
       config classification: relay-or-info-attempt,relay of information gathering attempt,15
       # high risk
       config classification: info-success,successful information gathering attempt,16
       config classification: relay-success,successful relay attempt,17
       config classification: data-success,successful data integrity attempt,18
       config classification: system-success,successful system integrity attempt,19
       config classification: client-success,successful client integrity attempt,20
      </programlisting>

</para><para>

ºÐ·ù ¹× ±ÔÄ¢ ÆÄÀÏµéÀº <emphasis remap="it">/etc/snort/snort.conf</emphasis> ÆÄÀÏ¿¡ Æ÷ÇÔµÇ¾î ÀÖ´Âµ¥ ¿©±â¼­ »ç¿ëµÈ 
¾î¶² ±ÔÄ¢ ÆÄÀÏµéÀº Ç¥ÁØ ¹èÆ÷¿¡ Æ÷ÇÔµÇ¾î ¾Ê±â ¶§¹®¿¡ CVS ¿¡¼­ º¹»çµÇ¾ú´Ù. ¿¹¸¦ µé¸é <emphasis remap="it">virus.rules</emphasis>.

</para><para>

Àü¿¡ ¸»ÇßµíÀÌ <emphasis remap="it">vision.rules</emphasis> ÆÄÀÏÀº µÚ¿¡ ³íÀÇµÇ´Â <emphasis remap="it">arachnids_upd</emphasis> 
µµ±¸¸¦ ÅëÇØ °¡Á®¿Ã °ÍÀÌ´Ù.

</para><para>

Arachnids_upd ´Â <emphasis remap="it">vision18.rules</emphasis> ¿¡¼­ <emphasis remap="it">vision.rules</emphasis> ·Î 
ÀÌ¸§À» º¯°æ½ÃÅ°Áö¸¸ ¹°·Ð ±ÔÄ¢Àº 1.8 ÀÌ»ó ¹öÀü¿¡ ´ëÇØ ÁØºñµÈ °ÍµéÀÌ´Ù.

</para><para>

<emphasis remap="it">vision.rules</emphasis> ¿¡¼­ÀÇ INTERNAL ¹× EXTERNAL ¿¡ ´ëÇÑ º¯¼ö Á¤ÀÇ°¡ snort ±ÔÄ¢°ú µ¿ÀÏÇÏÁö ¾Ê±â ¶§¹®¿¡ 
ÀÌ·¯ÇÑ ÀÌ¸§µéÀ» º¯°æ½ÃÅ°±â À§ÇØ ½ºÅ©¸³Æ®¸¦ »ç¿ëÇÑ´Ù. ¾Æ·¡ÀÇ <emphasis remap="it">arachnids_upd</emphasis> ÀýÀ» ºÁ¶ó.

</para><para>

      <programlisting>
       # Include classification & priority settings
       include /etc/snort/classification.config
       
       include /etc/snort/exploit.rules
       include /etc/snort/scan.rules
       include /etc/snort/finger.rules
       include /etc/snort/ftp.rules
       include /etc/snort/telnet.rules
       include /etc/snort/smtp.rules
       include /etc/snort/rpc.rules
       include /etc/snort/rservices.rules
       include /etc/snort/backdoor.rules
       include /etc/snort/dos.rules
       include /etc/snort/ddos.rules
       include /etc/snort/dns.rules
       include /etc/snort/netbios.rules
       include /etc/snort/web-cgi.rules
       include /etc/snort/web-coldfusion.rules
       include /etc/snort/web-frontpage.rules
       include /etc/snort/web-iis.rules
       include /etc/snort/web-misc.rules
       include /etc/snort/sql.rules
       include /etc/snort/x11.rules
       include /etc/snort/icmp.rules
       include /etc/snort/shellcode.rules
       include /etc/snort/misc.rules
       include /etc/snort/policy.rules
       include /etc/snort/info.rules
       #include /etc/snort/icmp-info.rules
       include /etc/snort/virus.rules
       include /etc/snort/local.rules
     
       # vision.rules will be catched by arachnids_upd
       include /etc/snort/vision.rules
     </programlisting>

</para><para>

<emphasis remap="it">/etc/snort/snort.conf</emphasis> ¼³Á¤À» ¸¶Ä£ ÈÄ <emphasis remap="it">/etc/rc.d/init.d/snortd start</emphasis> 
¸í·ÉÀ» ÅëÇØ snort ¸¦ ½ÇÇà½ÃÅ°°í <emphasis remap="it">/var/log/messages</emphasis> ·Î±× ÆÄÀÏ³»ÀÇ ¸ðµç ¿¡·¯µéÀ» ¼öÁ¤ÇØ¾ß ÇÑ´Ù 
(µ¥ÀÌÅ¸º£ÀÌ½º´Â ¾ÆÁ÷ ¼³Á¤µÇ¾î ÀÖÁö ¾Ê±â ¶§¹®¿¡ µ¥ÀÌÅ¸º£ÀÌ½º¿Í °ü·ÃµÈ ¸ðµç ¸Þ¼¼Áö´Â ¹«½ÃÇØ¶ó).
¸ðµç °ÍÀÌ Àß ÁøÇàµÇ¾ú´Ù¸é ´Ù¸¥ ºÎºÐÀÇ ¼³Á¤À¸·Î °¡ÀÚ.

</para>
</sect4>
</sect3>
   
<sect3 id="snortd-initscript">
<title>/etc/rc.d/init.d/snortd</title>
<para>

<emphasis remap="it">/etc/rc.d/init.d/snortd</emphasis> ¿¡¼­´Â Àû¾îµµ ÀÎÅÍÆäÀÌ½º ºÎºÐÀ» ÆíÁýÇØ¾ß ÇÏ´Âµ¥, 
<emphasis remap="it">INTERFACE="eth0"</emphasis> ¸¦ °¢ÀÚ »ç¿ëÇÏ´Â ÀÎÅÍÆäÀÌ½º·Î ¼öÁ¤ÇØ¶ó. ÀÌ´Â ´Ù¸¥ ÀÌ´õ³Ý 
(<emphasis remap="it">ethx</emphasis>) ¹× <emphasis remap="it">pppx</emphasis> ¶Ç´Â
<emphasis remap="it">ipppx</emphasis> ÀÎÅÍÆäÀÌ½ºÀÏ ¼ö ÀÖ´Ù. ¿¹¸¦ µé¾î ISDN À» »ç¿ëÇÏ°í ÀÖ´Ù¸é ÀÎÅÍÆäÀÌ½º Á¤ÀÇ´Â ´ÙÀ½°ú °°´Ù.

</para><para>

    <programlisting>
     INTERFACE="ippp0"
    </programlisting>

</para><para>

Snort ¼¾¼­°¡ ÇÏ³ªÀÇ ÀÎÅÍÆäÀÌ½º¿¡¼­¸¸ °¨½ÃÇÏ°í ÀÖ´Ù¸é snortd initscript ¸¦ »ç¿ëÇÏ´Â °ÍÀ¸·Î ÃæºÐÇÏ´Ù. ±×·¯³ª ÇÏ³ª ÀÌ»óÀÇ 
ÀÎÅÍÆäÀÌ½º¸¦ °®°í ÀÖ´Ù¸é ÀÌ¿¡ ´ëÇØ ÀúÀÚ°¡ È®ÀåÇÑ ½ºÅ©¸³Æ®¸¦ º¸±â ¹Ù¶õ´Ù. ´ÜÁö ÇÏ³ªÀÇ ÀÎÅÍÆäÀÌ½º¸¦ °®°í ÀÖÁö¸¸ 
ÀúÀÚ¿Í °°ÀÌ swatch ¸¦ »ç¿ëÇÏ°í ½Í´Ù¸é swatch ºÎºÐÀ» snortd ½ºÅ©¸³Æ®·Î º¹»çÇØ¶ó (RPM ¹®¼­ÀÇ contrib ÀýÀ» º¸¶ó).

</para><para>


´ÙÀ½ ÀúÀÚ°¡ È®ÀåÇÑ snortd initscript ´Â snort °¡ ÇÏ³ª ÀÌ»óÀÇ ÀÎÅÍÆäÀÌ½º¸¦ °¨½ÃÇÔÀ» ¾Ë ¼ö ÀÖÀ» °ÍÀÌ´Ù.
ÀÎÅÍÆäÀÌ½º ÀÌ¸§¿¡ <emphasis remap="it">any</emphasis> ¸¦ »ç¿ëÇÒ ¼öµµ ÀÖ´Ù°í ¸»ÇÒ ¼öµµ ÀÖ´Ù. ¿Ö³ÄÇÏ¸é ±âº»ÀûÀÎ 
<emphasis remap="it">libpcap</emphasis> ÀÌ ÀÌ¸¦ °¡´ÉÇÏ°Ô ÇÏ±â ¶§¹®ÀÌ´Ù. ±×·¯³ª snort ¼¾¼­°¡ ¼³Ä¡µÇ¾î ÀÖ´Â ·ÎÄÃ ³×Æ®¿öÅ© °¨½Ã¿¡ 
°ü½ÉÀÌ ¾ø±â ¶§¹®¿¡ ÀÌ´Â ÀúÀÚ°¡ »ç¿ëÇÏ·Á°í ÇÏ´Â ÀÇµµ°¡ ¾Æ´Ï´Ù. ÀÌ ·ÎÄÃ ³×Æ®¿öÅ©´Â ¹æÈ­º® ¼³Ä¡¿Í °°Àº ºÎ°¡ÀûÀÎ º¸¾È ¼³Á¤ÀÌ 
µÇ¾î ÀÖ´Â º°µµÀÇ ³×Æ®¿öÅ© ¼¼Å©¸ÕÆ®·Î º¸¾ÈÀûÀÎ È¯°æ¿¡ ÀÖ¾î¾ß ÇÑ´Ù. µû¶ó¼­ snort ³×Æ®¿öÅ© ÀÚÃ¼¸¦ ¸ñÇ¥·ÎÇÑ °ø°ÝÀÇ Å½Áö¸¦ ¿øÇÏ´Â 
°æ¿ì¸¦ Á¦¿ÜÇÏ°í´Â ½º´ÏÇÎÀº ÀÇ¹Ì°¡ ¾ø´Ù. ÀÌ ¼¼Å©¸ÕÆ®¿¡ ÇÏ³ª ÀÌ»óÀÇ ¼¾¼­¸¦ »ç¿ëÇÑ´Ù¸é ¼¼Å©¸ÕÆ®¸¦ º¸È£ÇÏ±â À§ÇØ ¸ðµç ¼¾¼­°¡ 
¾Æ´Ñ ´ÜÁö ÇÏ³ªÀÇ ¼¾¼­¸¸ ¼³Á¤ÇÒ ÇÊ¿ä°¡ ÀÖ´Ù.

</para><para>


ÀúÀÚ´Â <emphasis remap="it">/etc/rc.d/init.d/functions</emphasis> ³»ÀÇ ·¹µåÇÞ»çÀÇ <emphasis remap="it">daemon</emphasis> ÇÔ¼ö¿¡¼­ ÆÄ»ýµÈ »õ·Î¿î ÇÔ¼ö 
<emphasis remap="it">daemonMult</emphasis> ¸¦ Ãß°¡ÇÏ¿´´Ù. ÀÌ´Â ÇÁ·Î±×·¥À» ÇÑ¹ø ÀÌ»ó ½Ãµ¿½ÃÅ³ ¼ö ÀÖ´Ù. ÀúÀÚ´Â »õ·Î¿î ¿É¼Ç 
<emphasis remap="it">--mult</emphasis> ¸¦ µµÀÔÇÏ±â À§ÇØ ·¹µåÇÞ»ç¿¡ <emphasis remap="it">daemon</emphasis> ÇÔ¼ö¿¡ ´ëÇÑ ÆÐÄ¡¸¦ 
º¸³Â´Ù. ÀÌ Ãß°¡°¡ ÀÌ·ç¾îÁø´Ù¸é <emphasis remap="it">daemonMult</emphasis> ÇÔ¼ö´Â ¾µ¸ð¾ø°Ô µÉ °ÍÀÌ¸ç È£ÃâÀº 
<emphasis remap="it">daemonMult</emphasis> ¿¡¼­ <emphasis remap="it">daemon --mult</emphasis> ·Î º¯°æµÉ °ÍÀÌ´Ù.

</para><para>

¶ÇÇÑ ÀúÀÚ´Â ¸®ºÎÆÃ½Ã ¿¡·¯ ¸Þ¼¼Áö¸¦ ¾ø¾Ö±â À§ÇØ ÇÏºÎ½Ã½ºÅÛ ÀÌ¸§À» snort ¿¡¼­ snortd ·Î º¯°æÇÏ¿´´Ù (·¹µåÇÞ¿¡¼­ killall ½ºÅ©¸³Æ®´Â 
Á¤È®ÇÑ ÀÌ¸§¿¡ ÀÇÁ¸ÇÑ´Ù).

</para><para>

ÀúÀÚÀÇ ½ºÅ©¸³Æ®¸¦ ÀÌ¿ëÇÏ¸é °¨½ÃÇÒ ´Ù¼öÀÇ ÀÎÅÍÆäÀÌ½º¸¦ Á¤ÀÇÇÒ ¼ö ÀÖ´Âµ¥ ¹ØÀÇ ½ºÅ©¸³Æ®¿¡¼­¿Í °°ÀÌ 
<emphasis remap="it">INTERFACE</emphasis> ¿¡ °ø¹éÀ¸·Î ºÐ¸®µÈ ¸ñ·ÏÀ» »ç¿ëÇØ¶ó.

</para><para>

µè°í ÀÖ´Â ÀÎÅÍÆäÀÌ½º°¡ ÀÌ¹Ì ÀÛµ¿ÁßÀÎÁö IP ÁÖ¼Ò°¡ Á¤ÀÇµÇ¾î ÀÖ´ÂÁö¸¦ º¸±â À§ÇØ ¾à°£ÀÇ Á¤»ó¼º °Ë»çµµ ¶ÇÇÑ Æ÷ÇÔµÇ¾î ÀÖ´Ù. 
Á¤ÀÇµÈ IP ÁÖ¼Ò°¡ ÀÖ´Ù¸é ·¹µåÇÞ ¸®´ª½ºÀÇ °æ¿ì <emphasis 
remap="it">/etc/sysconfig/network-scripts/ifcfg-(interface-name)</emphasis> ¿¡ ÀÖ´Â ÇØ´ç config °¡ »ç¿ëµÉ °ÍÀÌ´Ù. 
±×·¸Áö ¾Ê´Ù¸é ÀÎÅÍÆäÀÌ½º´Â promiscuous ¸ðµå¿¡¼­ IP ¾øÀÌ ¼³Á¤µÉ °ÍÀÌ´Ù.

</para><para>


ÀÌ´Â ÀÌ´õ³Ý ÀÎÅÍÆäÀÌ½º¸¦ Á¦¿ÜÇÑ ¾î¶°ÇÑ ÀÎÅÍÆäÀÌ½º¿¡¼­µµ ¾ÆÁ÷ Å×½ºÆ®µÇÁö ¾Ê¾Ò´Ù. ÀúÀÚ´Â °ð ISDN ÀÎÅÍÆäÀÌ½º¿¡ ´ëÇØ 
°ËÅäÇÒ °ÍÀÌ¸ç ¾î¶°ÇÑ Â÷ÀÌ°¡ ÀÖ´Â Áö¸¦ º¸°íÇÒ °ÍÀÌ´Ù.

</para><para>

ÇÏ³ªÀÇ snort ÇÁ·Î¼¼½º°¡ °¢ ÀÎÅÍÆäÀÌ½º¿¡¼­ ½ÃÀÛµÇ¸ç ¶ÇÇÑ <emphasis remap="it">swatch</emphasis>°¡ ±ÔÄ¢ °»½ÅÀ» À§ÇØ snort ¸¦ 
Àç½ÃÀÛÇÒ ¶§ ¿¡·¯¸¦ °Ë»çÇÏ±â À§ÇØ ½ÇÇàµÉ °ÍÀÌ´Ù (¹ØÀÇ <emphasis remap="it">swatch</emphasis> ÀýÀ» º¸¶ó).

</para><para>

snort ¸¦ ¼Ë´Ù¿îÇÒ ¶§ ¸ðµç IP ¾ø´Â ÀÎÅÍÆäÀÌ½º´Â ¼Ë´Ù¿îµÉ °ÍÀÌ´Ù. ±×·¯³ª IP ¼³Á¤ÀÌ µÇ¾î ÀÖ´Â ÀÎÅÍÆäÀÌ½º´Â ¼Ë´Ù¿îµÇÁö ¾ÊÀ» °ÍÀÌ´Ù. 
ÀÌ´Â snort'ed ÀÎÅÍÆäÀÌ½º°¡ snort ¼¾¼­¿¡ ÇÊ¼öÀûÀÎ °æ¿ì Á¢±ÙºÒ°¡¸¦ ¾ß±âÇÒ ¼ö ÀÖ±â ¶§¹®ÀÌ´Ù.

</para><para>

¾Æ¸¶µµ ´õ¿í ÁÁÀº ÇØ°á¹æ¹ýÀº ´ÙÀ½°ú °°Àº ¿£Æ®¸®¿¡ ´ëÇØ ÀÎÅÍÆäÀÌ½ºÀÇ config ÆÄÀÏÀ» °Ë»çÇÏ´Â °ÍÀ¸·Î 

</para><para>

    <programlisting>
     ONBOOT=yes
    </programlisting>

</para><para>

<emphasis remap="it">yes</emphasis> °¡ ¾ø´Â °æ¿ì¿¡¸¸ ÀÎÅÍÆäÀÌ½º°¡ ¼Ë´Ù¿îµÉ °ÍÀÌ´Ù. ±×·¯³ª ÀÌ°ÍÀº ¾ÆÁ÷ ±¸ÇöµÇ¾î ÀÖÁö ¾Ê´Ù.

</para><para>

´ÙÀ½Àº È®ÀåµÈ snort initscript ÀÌ´Ù:

</para><para>

    <programlisting>
#!/bin/sh
#
# snortd         Start/Stop the snort IDS daemon.
#
# chkconfig: 2345 40 60
# ¼³¸í:  Snort ´Â ÇöÀç 1100 °³ ÀÌ»óÀÇ È£½ºÆ® ¹× ³×Æ®¿öÅ© Ãë¾à¼º, Æ÷Æ®½ºÄµ, ¹éµµ¾î µîÀ» Å½ÁöÇÏ´Â
#               °æ·® ³×Æ®¿öÅ© Ä§ÀÔ Å½Áö ½Ã½ºÅÛÀÌ´Ù.
#
# June 10, 2000 -- Dave Wreski Dave Wreski &lt;dave at linuxsecurity.com&gt;
#   - ÃÖÃÊ ¹öÀü
# July 08, 2000 Dave Wreski <&lt;dave at guardiandigital.com&gt;
#   - snort user/group À» Ãß°¡ÇÏ¿´´Ù
#   - 1.6.2 ¹öÀü Áö¿ø
# April 11, 2001 Sandro Poppi &lt;spoppi at gmx.de&gt;
#   - ´ÙÀÌ¾ó ¾÷ ¶óÀÎ ¶Ç´Â ÇÑ°³ ÀÌ»óÀÇ ½º´ÏÆÛ ÀÎÅÍÆäÀÌ½º »ç¿ëÀ» À§ÇØ ´ÙÁß ÀÎÅÍÆäÀÌ½º ¿É¼ÇÀ» Ãß°¡ÇÏ¿´´Ù
#     ÀúÀÚ´Â "-i any" ¸¦ »ç¿ëÇÏ´Â libpcap ¿É¼ÇÀÌ ÁÁÀº ¼±ÅÃÀÌ¶ó°í »ý°¢ÇÏÁö ¾Ê´Â´Ù.
#     ¿Ö³ÄÇÏ¸é snort °¡ ÇÑ°³ÀÌ»óÀÇ ip °¡ ¾ø´Â ÀÎÅÍÆäÀÌ½ºµéÀ» °¨½ÃÇÏµµ·Ï ¼³Á¤µÉ ¼ö ÀÖ±â ¶§¹®ÀÌ´Ù.
#      ±×·¯³ª ¸ð´ÏÅÍ ÀÎÅÍÆäÀÌ½º´Â º¸È£µÇÁö ¾ÊÀº »óÅÂ·Î Á¸ÀçÇÑ´Ù.
#   - ¸®ºÎÆÃÇÒ¶§ÀÇ ¿¡·¯ ¸Þ½ÃÁö¸¦ ¾ø¾Ö±â À§ÇØ ÇÏºÎ½Ã½ºÅÛ ÀÌ¸§À» snort ¿¡¼­ snortd ·Î º¯°æÇÏ¿´´Ù
#      (·¹µåÇÞÀÇ killall ½ºÅ©¸³Æ®´Â Á¤È®ÇÑ ÀÌ¸§¿¡ ÀÇÁ¸ÇÑ´Ù)
#   - snort ÀÇ ´ÙÁß ÀÎ½ºÅÏ½º¸¦ ½ÇÇà½ÃÅ³ ¼ö ÀÖµµ·Ï /etc/rc.d/init.d/functions ³»ÀÇ daemon ÇÔ¼ö¿¡¼­ ÆÄ»ýµÈ 
#      daemonMult ÇÔ¼ö¸¦ Ãß°¡ÇÏ¿´´Ù
#      (°á±¹ ÀÌ´Â ·¹µåÇÞÀÇ daemon ÇÔ¼ö³»·Î ÅëÇÕµÉ ¼ö ÀÖ´Âµ¥ ÀúÀÚ¿¡°Ô ¿¬¶ôÇØ¶ó)
# January 01, 2002 Sandro Poppi &lt;spoppi at gmx.de&gt;
#   - swatch °¡ ¼³Ä¡µÇ¾î ÀÖ´ÂÁöÀÇ °Ë»ç¸¦ Ãß°¡ÇÏ¿´´Ù
#   - ÀÌ´õ³ÝÀÌ¿ÜÀÇ ÀÎÅ×ÆäÀÌ½ºµé¿¡ ´ëÇÑ °Ë»ç¸¦ Ãß°¡ÇÏ¿´´Ù. ÀÌµéÀº ifconfig ·Î ÀÛµ¿µÈ´Ù°í »ý°¢ÇÏ±â ¶§¹®ÀÌ´Ù.
#
# Source function library.
. /etc/rc.d/init.d/functions

# ÇÁ·Î±×·¥À» ÇÑ¹ø ÀÌ»ó ½ÃÀÛÇÏ±â À§ÇÑ ÇÔ¼ö
# /etc/rc.d/init.d/functions ³»ÀÇ µ¥¸ó ÇÔ¼ö¸¦ ÀçÀÛ¼ºÇÑ °ÍÀÌ´Ù
daemonMult() {
        # ±¸¹®À» Å×½ºÆ®ÇÑ´Ù.
        gotbase=
        user=
        nicelevel=0
        while [ "$1" != "${1##-}" -o "$1" != "${1##+}" ]; do
          case $1 in
            '')    echo '$0: Usage: daemon [+/-nicelevel] {program}'
                   return 1;;
            --check)
                   shift
                   base=$1
                   gotbase="yes"
                   shift
                   ;;
            --user)
                   shift
                   daemon_user=$1
                   shift
                   ;;
            -*|+*) nicelevel=$1
                   shift
                   ;;
             *)    nicelevel=0
                   ;;
          esac
        done

        # basename À» ÀúÀåÇÑ´Ù.
        [ -z $gotbase ] && base=`basename $1`

        # ¹Ýµå½Ã ¾î´À °÷¿¡µµ ÄÚ¾î ´ýÇÁÇÏÁö ¾Êµµ·Ï ÇØ¶ó; ÀÌ°ÍÀÌ µ¥¸ó°ú °ü·ÃµÈ
        # ¹®Á¦¸¦ ÀúÁöÇÏ´Â µ¿½Ã¿¡ ¶ÇÇÑ ¾à°£ÀÇ º¸¾È ¹®Á¦¸¦ ¾ø¾Ø´Ù.
        ulimit -S -c 0 >/dev/null 2>&1

        # Echo daemon
        [ "$BOOTUP" = "verbose" ] && echo -n " $base"

        # µ¥¸óÀ» ±¸µ¿½ÃÅ²´Ù.
        if [ -z "$daemon_user" ]; then
           nice -n $nicelevel initlog $INITLOG_ARGS -c "$*" && success "$base startup" || failure "$base startup"
        else
           nice -n $nicelevel initlog $INITLOG_ARGS -c "su $daemon_user -c \"$*\"" && success "$base startup" || failure "$base startup"
        fi
}

# ³×Æ®¿öÅ© ÀÎÅÍÆäÀÌ½º(µé)¸¦ ÁöÁ¤ÇØ¶ó
INTERFACE="eth1 eth2"

# See how we were called.
case "$1" in
start)
        if [ -x /usr/bin/swatch ] ; then
          echo -n "Starting swatch: "
          # swatch ¸¦ »ç¿ëÇÏ±â À§ÇØ ÀúÀÚ°¡ ½á³Ö¾ú´Ù
          # snort ±¸µ¿½ÃÀÇ ¿¡·¯¿¡ ´ëÇÑ Áö½Ã¸¦ ¾ò±â À§ÇØ snort Àü¿¡ ÀÌ¸¦ ½ÇÇà½ÃÅ²´Ù
          # snort ¿É¼Ç -s ¸¦ »ç¿ëÇÑ´Ù¸é /var/log/secure ¸¦ »ç¿ëÇØ¶ó
          # snort.conf ¿¡¼­ alert_syslog: Ãâ·Â ¿É¼ÇÀ» »ç¿ëÇÑ´Ù¸é /var/log/messages ¸¦ »ç¿ëÇØ¶ó
          /usr/bin/swatch --daemon --tail /var/log/messages --config-file /etc/swatch/swatchrc &
          touch /var/lock/subsys/swatch
          echo "done."
          echo
        fi

        # ´ÙÁß ÀÎÅÍÆäÀÌ½º ¿É¼ÇÀ» Ãß°¡ÇÏ¿´´Ù
        for i in `echo "$INTERFACE"` ; do
          echo -n "Starting snort on interface $i: "
          # ½ºÅ©¸³Æ® ±¸µ¿½Ã snort ¿¡ ´ëÇØ ip °¡ ¾ø´Â ½º´ÏÆÛ ÀÎÅÍÆäÀÌ½º¸¦ ±¸ÇöÇÏ±â À§ÇØ »ðÀÌÇÏ¿´´Ù
          # ÀÎÅÍÆäÀÌ½º°¡ ¾ÆÁ÷ ÀûÀçµÇÁö ¾Ê¾Ò°Å³ª ¶Ç´Â ±¸µ¿µÇÁö ¾Ê¾Ò´Ù¸é
          if [ `/sbin/ifconfig $i 2>&1 | /bin/grep -c "Device not found"` = "0" \
               -o `/sbin/ifconfig $i 2>&1 | /bin/grep -c "UP"` = "0" ] ; then

            # ÀÌ´õ³Ý¿ÜÀÇ ´Ù¸¥ ÀÎÅÍÆäÀÌ½º¸¦ °Ë»çÇÑ´Ù
            if [ `echo $i | /bin/grep -c "^eth"` = "1" ] ; then
              # ÁÖ¾îÁø ÀÎÅÍÆäÀÌ½º¿¡ ´ëÇÑ config °¡ ÀÖ´ÂÁö¸¦ °Ë»çÇÑ´Ù
              # º¸Åë ÀÌ´Â ½º´ÏÆÛ ÀÎÅÍÆäÀÌ½º¿¡ ´ëÇØ¼­´Â º¸¾È»óÀÇ ÀÌÀ¯·Î »ý·«µÇ¾î¾ß ÇÑ´Ù
              if [ -s "/etc/sysconfig/network-scripts/ifcfg-$i" ]; then
                # config ¸¦ »ç¿ëÇÑ´Ù
                /sbin/ifup $i
              else
                # ip °¡ ¾ø´Â ½º´ÏÆÛ ÀÎÅÍÆäÀÌ½º
                /sbin/ifconfig $i up promisc
              fi
            fi
          fi
          # À§ÀÇ ÀçÀÛ¼ºµÈ µ¥¸ó ÇÔ¼ö¸¦ ½ÇÇà½ÃÅ²´Ù
          daemonMult /usr/sbin/snort -u snort -g snort -d -D \
                 -i $i -I -l /var/log/snort -c /etc/snort/snort.conf
          echo
        done

        touch /var/lock/subsys/snortd

        ;;
  stop)
        echo -n "Stopping snort: "
        killproc snort
        rm -f /var/lock/subsys/snortd

        # ÀúÀÚ°¡ »ðÀÔÇÏ¿´´Ù
        if [ -x /usr/bin/swatch ] ; then
          echo
          echo -n "Stopping swatch: "
          kill `ps x|grep "/usr/bin/swatch"|grep -v grep|awk '{ print $1 }'`
          rm -f /var/lock/subsys/swatch
        fi

        # ´ÜÁö ip ÁÖ¼Ò°¡ ¾ø´Ù¸é ÀÎÅÍÆäÀÌ½º¸¦ ¼Ë´Ù¿î½ÃÅ²´Ù
        # ÀÌ´õ³Ý ÀÎÅÍÆäÀÌ½º¶ó¸é ÀÎÅÍÆäÀÌ½º¸¦ ¼Ë´Ù¿î½ÃÅ°±æ ¿øÄ¡ ¾Ê±â ¶§¹®¿¡ ´ÙÀ½À» ½ÇÇà½ÃÅ²´Ù
        for i in `echo "$INTERFACES"`; do
          if [`echo $i | /bin/grep -c "^eth"` = "1" -a \
              `/sbin/ifconfig $i 2>&1 | /bin/grep -c "inet addr:"` = "0" ] ; then
            /sbin/ifconfig $i down
          fi
        done
        echo
        ;;
  restart)
        $0 stop
        $0 start
        ;;
  status)
        status snort
        #status swatch
        ;;
  *)
        echo "Usage: $0 {start|stop|restart|status}"
        exit 1
esac
exit 0
    </programlisting>

</para>
</sect3>

<sect3 id="snort-check">
<title>/etc/snort/snort-check</title>
<para>

ÀÌ ½© ½ºÅ©¸³Æ®´Â <emphasis remap="it">smbclient</emphasis> ¸¦ ÅëÇØ À©ÆË¾÷À» »ý¼º½ÃÅ°°Å³ª ÁÖ¾îÁø »ç¶÷¿¡°Ô ÀÌ¸ÞÀÏÀ» º¸³»´Âµ¥ »ç¿ëµÈ´Ù. 
ÀÌ´Â snort È¨ÆäÀÌÁö¿¡ ¹ßÇ¥µÈ Bill Richardson ÀÇ ½ºÅ©¸³Æ®¿¡ °í¹«µÇ¾î ÀÛ¼ºÇÏ¿´´Ù.

</para><para>

À©ÆË¾÷ ºÎºÐÀº snort 1.8 ¿¡ µµÀÔµÈ <emphasis remap="it">smb</emphasis> Ãâ·Â ¸ðµâ·Î ÀÎÇØ ¾µ¸ð¾øÀ»Áöµµ ¸ð¸£¸ç 
ÀúÀÚ´Â ÀÌ¸¦ ¾ÆÁ÷ Å×½ºÆ®ÇÏÁö ¾Ê¾Ò´Ù.

</para><para>

     <programlisting>
#!/bin/sh

# ´Ù¼öÀÇ Æ÷¸ËÀ¸·Î °æº¸¸¦ º¸³»±â À§ÇØ swatch ³»¿¡¼­ ½ÇÇàµÇ´Â ½ºÅ©¸³Æ®
# www.snort.org ¿¡ ÀÖ´Â Bill Richardson ÀÇ ½ºÅ©¸³Æ®¿¡ ¿µ°¨À» ¹Þ¾Ò´Ù
# À©ÆË¾÷À» º¸³»´Â ¿öÅ© ½ºÅ×ÀÌ¼ÇÀÇ ÀÌ¸§À» °®°í ÀÖ´Â "hosts" ÆÄÀÏÀ» ÀÐ¾îµéÀÌµµ·Ï
# È®ÀåµÇ¾ú´Ù. ±¸¹®Àº snortd ¿É¼Ç -M °ú °°´Ù.
# Poppi, 02.05.2001

# ¼±°áÁ¶°Ç:
# Samba °¡ Á¤È®È÷ ¼³Ä¡µÇ¾î ÀÖ¾î¾ß ÇÑ´Ù.
# °¢ÀÚ ½Ã½ºÅÛ¿¡ ¸Â°Ô ´ÙÀ½ º¯¼öµéÀ» º¯°æ½ÃÅ²´Ù (·¹µåÇÞ 7.x À» »ç¿ëÇÑ´Ù¸é ¹«¹æÇÏ´Ù)

# hostfile Àº À©ÆË¾÷À» À§ÇÑ ¿öÅ© ½ºÅ×ÀÌ¼ÇÀ» Æ÷ÇÔÇÏ°í ÀÖ´Â ÆÄÀÏ¸íÀ» °®°í ÀÖ´Ù.
hostfile="/etc/snort/hosts"

# recipientfile Àº ¸ðµç recipient (¼ö·ÉÀÚ) ÀÇ ÁÖ¼Ò¸¦ °®°í ÀÖ´Ù.
# °¢ recipient ´Â ÇÑÁÙ¿¡ ÇÏ³ªÀÌ´Ù.
recipientfile="/etc/snort/recipients"

# recipient ÆÄÀÏÀÌ Á¸ÀçÇÑ´Ù¸é
if [ -s "$recipientfile" ] ; then
  # ÀÌ¸ÞÀÏ ÁÖ¼Ò¸¦ °®´Â recipientlist ¸¦ »ý¼ºÇÑ´Ù
  for i in `cat $recipientfile` ; do
    recipients="$recipients "$i
  done

  echo "$*" | mail -s "Snort-Alert!!!" "$recipients"
fi

# hostfile Á¸ÀçÇÑ´Ù¸é À©ÆË¾÷À» º¸³½´Ù
if [ -s "$hostfile" ] ; then
  for i in `cat $hostfile` ; do
    echo "Snort-Alert! $*" | smbclient -M $i > /dev/null 2>&1
  done
fi
     </programlisting>

</para>
    
<sect4 id="snort-check-hosts">
<title>/etc/snort/hosts</title>
<para>

ÀÌ ÆÄÀÏ¿¡ snort ¸Þ½ÃÁö¸¦ ¹Þ´Â È£½ºÆ®ÀÇ ¿öÅ© ½ºÅ×ÀÌ¼ÇÀÇ ÀÌ¸§À» ÇÑÁÙ¿¡ ÇÏ³ª¾¿ ³Ö¾î¶ó.

</para><para>

      <programlisting>
       ws001
       ws002
       ws003
      </programlisting>

</para>
</sect4>
    
<sect4 id="snort-check-recipients">
<title>/etc/snort/recipients</title>
<para>

<emphasis remap="it">/etc/snort/recipients</emphasis> ¿¡ snort °æº¸¸¦ ¹Þ±æ ¿øÇÏ´Â (¶Ç´Â ¹Þµµ·Ï µÇ¾îÀÖ´Â) ¼ö·ÉÀÚÀÇ ÀÌ¸ÞÀÏ 
ÁÖ¼Ò¸¦ ÇÑÁÙ¿¡ ÇÏ³ª¾¿ ³Ö¾î¶ó.

</para><para>

      <programlisting>
       jane@internal.local.com
       henk@snort.info
       sandro@snort.info
      </programlisting>

</para><para>

µÎÆÄÀÏÁß ÇÏ³ª¶óµµ »ý·«µÈ´Ù¸é ÇØ´ç Æ¯Â¡Àº ±ÝÁöµÈ´Ù.

</para>
</sect4>
    
</sect3>

<sect3 id="snort-int-stat">
<title>Snort ³»ºÎ Åë°èÀÚ·á</title>
<para>

Snort ´Â ¾à°£ÀÇ ³»ºÎ Åë°èÀÚ·á¸¦ Ãâ·ÂÇÒ ¼ö ÀÖ´Â ±â´ÉÀÌ ³»ÀåµÇ¾î ÀÖ´Âµ¥ ÀÌ´Â ´ÙÀ½ ¸í·ÉÀ» »ç¿ëÇÏ¿© ±â·ÏµÉ ¼ö ÀÖ´Ù:

</para><para>

     <command>
      /bin/kill -SIGUSR1 &lt;pid of snort&gt;
     </command>

</para><para>

¶Ç´Â µ¿ÀÏ ¸Ó½Å¿¡ ÇÑ°³ ÀÌ»óÀÇ snort ÇÁ·Î¼¼½º°¡ ÀÖ°í µ¿½Ã¿¡ ¸ðµç Á¤º¸¸¦ ¾ò°í ½Í´Ù¸é ´ÙÀ½ ¸í·ÉÀ» »ç¿ëÇÒ ¼ö ÀÖ´Ù:

</para><para>

     <command>
      /bin/killall -USR1 snort
     </command>

</para><para>

À§ÀÇ ¸í·ÉÀ» »ç¿ëÇÑ °æ¿ì syslog (<emphasis remap="it">/var/log/messages</emphasis>) ¿¡¼­ ´ÙÀ½°ú °°Àº ³»ºÎ Åë°èÀÚ·á¸¦ ¾ò´Â´Ù.

</para><para>

     <programlisting>
Sep 29 07:51:48 ids01 snort[8000]:   ===============================================================================
Sep 29 07:51:48 ids01 snort[8000]: Snort analyzed 27316 out of 27316 packets,
Sep 29 07:51:48 ids01 snort[8000]: dropping 0(0.000%) packets
Sep 29 07:51:48 ids01 snort[8000]: Breakdown by protocol:                Action Stats:
Sep 29 07:51:48 ids01 snort[8000]:     TCP: 27152      (99.400%)         ALERTS: 0
Sep 29 07:51:48 ids01 snort[8000]:     UDP: 0          (0.000%)          LOGGED: 0
Sep 29 07:51:48 ids01 snort[8000]:    ICMP: 164        (0.600%)          PASSED: 0
Sep 29 07:51:48 ids01 snort[8000]:     ARP: 0          (0.000%)
Sep 29 07:51:48 ids01 snort[8000]:    IPv6: 0          (0.000%)
Sep 29 07:51:48 ids01 snort[8000]:     IPX: 0          (0.000%)
Sep 29 07:51:48 ids01 snort[8000]:   OTHER: 0          (0.000%)
Sep 29 07:51:48 ids01 snort[8000]: DISCARD: 0          (0.000%)
Sep 29 07:51:48 ids01 snort[8000]: ===============================================================================
Sep 29 07:51:48 ids01 snort[8000]: Fragmentation Stats:
Sep 29 07:51:48 ids01 snort[8000]: Fragmented IP Packets: 0          (0.000%)
Sep 29 07:51:48 ids01 snort[8000]:     Fragment Trackers: 0
Sep 29 07:51:48 ids01 snort[8000]:    Rebuilt IP Packets: 0
Sep 29 07:51:48 ids01 snort[8000]:    Frag elements used: 0
Sep 29 07:51:48 ids01 snort[8000]: Discarded(incomplete): 0
Sep 29 07:51:48 ids01 snort[8000]:    Discarded(timeout): 0
Sep 29 07:51:48 ids01 snort[8000]:   Frag2 memory faults: 0
Sep 29 07:51:48 ids01 snort[8000]: ===============================================================================
Sep 29 07:51:48 ids01 snort[8000]: TCP Stream Reassembly Stats:
Sep 29 07:51:48 ids01 snort[8000]:         TCP Packets Used: 27152      (99.400%)
Sep 29 07:51:48 ids01 snort[8000]:          Stream Trackers: 1
Sep 29 07:51:48 ids01 snort[8000]:           Stream flushes: 0
Sep 29 07:51:48 ids01 snort[8000]:            Segments used: 0
Sep 29 07:51:48 ids01 snort[8000]:    Stream4 Memory Faults: 0
Sep 29 07:51:48 ids01 snort[8000]: ===============================================================================
     </programlisting>

</para><para>

±×·¯³ª ´ÙÀ½À» ±â¾ïÇØ¶ó: 1.8.3 ÀÌÀü ¹öÀü¿¡¼­´Â »õ·Î¿î Åë°è ÀÚ·á¸¦ ¾ò±âÀ§ÇØ¼­´Â snort ¸¦ Àç±¸µ¿½ÃÄÑ¾ß ÇÑ´Ù. 
µû¶ó¼­ ÀÌÀü ¹öÀüÀÌ¶ó¸é ´Ã <command>kill -SIGUSR1</command> °ú snort restart ¸¦ ÇÔ²² ½ÇÇà½ÃÄÑ¶ó.

</para><para>

¿ì¼± Ã³À½ÀÇ µÎ ¶óÀÎÀ» º¸¾Æ¾ß ÇÑ´Ù. snort °¡ ¹ö·ÁÁö´Â (dropped) ÆÐÅ¶ÀÌ ÀÖ´Ù°í ¸»ÇÑ´Ù¸é snort ¼³Á¤»Ó¸¸ÀÌ ¾Æ´Ï¶ó snort ¹Ú½ºÀÇ ¼³Á¤µµ 
¸Å¿ì ÀÚ¼¼È÷ Á¶»çÇØ¾ß ÇÑ´Ù.

</para><para>

¿¹¸¦ µé¾î ¹Ú½º¿¡ ÇÊ¼öÀûÀÌÁö ¾ÊÀº ¸ðµç ºÒÇÊ¿äÇÑ ¼­ºñ½º¸¦ Á¤Áö½ÃÄÑ¶ó. ±×¸®°í <command>top</command> ¸í·ÉÀÇ Ãâ·ÂÀ» Á¶»çÇØ¶ó. 
À¯ÈÞ Ä«¿îÅÍ°¡ ¸Å¿ì ³·´Ù¸é ¾î¶² ÇÁ·Î¼¼½ºµéÀÌ cpu ½Ã°£À» ¼ÒºñÇÏ¸ç °á±¹ ÇØ´ç ÇÁ·Î±×·¥ ÆÐÅ¶À» outsource ÇÏ°í ÀÖ´ÂÁö ¾Ë¾Æ³»¾ß ÇÑ´Ù. 
ÀÌ´Â ÀûÀº ¸Þ¸ð¸® ¹×/¶Ç´Â »ç¾çÀÌ ³·Àº cpu ¸¦ °®´Â µ¿ÀÏ ¸Ó½Å¿¡¼­ ACID, µ¥ÀÌÅ¸º£ÀÌ½º ¹× snort ¸¦ »ç¿ëÇÒ ¶§¿¡ ÇØ´çµÈ´Ù.

</para><para>

´Ù¸¥ µ¥ÀÌÅ¸ ¶óÀÎµéÀº ÀüÃ³¸®±âµé ¹× ÀÌµéÀÇ ÀÛ¾÷¿¡ ´ëÇÑ °³¿ä¸¦ Á¦°øÇÑ´Ù. ¶ÇÇÑ ¸Þ¸ð¸® fault ºÎºÐÀ» Á¶»çÇØ¾ß ÇÑ´Ù. 
¼ýÀÚ°¡ 0 ÀÌ ¾Æ´Ï¶ó¸é ¸Þ¸ð¸® »ç¿ëÀ» Á¶»çÇØ¾ß ÇÏ¸ç °á±¹ ´õ¿í ¸¹Àº ¸Þ¸ð¸®¸¦ »ç¿ëÇÏµµ·Ï ÀüÃ³¸®±â¸¦ ¼³Á¤ÇØ¾ß ÇÑ´Ù 
(<emphasis remap="it">/etc/snort/snort.conf</emphasis> ³»ÀÇ ÀûÀýÇÑ ºÎºÐÀ» Á¶»çÇØ¶ó).

</para><para>

´ÙÀ½Àº Greg Sarsons ¿¡ ¿µ°¨À» ¹ÞÀº snort ÀÇ ³»ºÎ Åë°èÀÚ·á¸¦ ¾ò±â À§ÇÑ ÂªÀº ½ºÅ©¸³Æ®ÀÌ´Ù. ÀÌ¸¦ ÆÄÀÏ·Î ÀúÀåÇÑ ÈÄ snort ¸¦ Àç½ÃÀÛÇØ¶ó.

</para><para>

Åë°èÀÚ·á ÆÄÀÏÀº <emphasis remap="it">/var/log/snort/archive</emphasis> ¿¡ ÀúÀåµÉ °ÍÀÌ¸ç µû¶ó¼­ ÀÌ µð·ºÅä¸®¸¦ ¿ì¼±ÀûÀ¸·Î »ý¼ºÇØ¾ß ÇÑ´Ù.

</para><para>

     <programlisting>
#!/bin/bash
# syslog ¶Ç´Â kill -USR1 &lt;snort-pid&gt; ½ÇÇà ÈÄ »ý¼ºµÈ ÁÖ¾îÁø ÆÄÀÏ·ÎºÎÅÍ
# Æ¯º°ÇÑ snort Åë°è ÀÚ·á¸¦ »ý¼º ¹× ÃßÃâÇÏ±â À§ÇÑ ½ºÅ©¸³Æ®
#
# ÀÌ ½ºÅ©¸³Æ®´Â pid °¡ ·Î±×ÆÄÀÏ¿¡ ±â·ÏµÊÀ» °¡Á¤ÇÑ´Ù.
# ÀÌ´Â snort.conf ÆÄÀÏ¿¡ ´ÙÀ½ ¶óÀÎÀ» »ç¿ëÇÏ¸é °¡´ÉÇÏ´Ù:
# output alert_syslog: LOG_AUTH LOG_ALERT LOG_PID
#
# (c) Sandro Poppi 2001
# Released under GPL

echo "Starting gathering snort internal statistics. Please be patient..."

if [ "$1." == "." -o ! -e "$1" ] ; then
  # ÁÖ¾îÁø ÆÄÀÏÀÌ ¾ø°Å³ª Á¸ÀçÇÏÁö ¾Ê´Â °æ¿ì ´ÙÀ½ µðÆúÆ® ÆÄÀÏÀ» »ç¿ëÇÑ´Ù
  log_file="/var/log/messages"

else
  # ·Î±×ÆÄÀÏÀÇ À§Ä¡°¡ Ç¥ÁØÀûÀÌÁö ¾ÊÀ»¶§´Â ¹Ýµå½Ã snort °¡ ÀÌ ·Î±× ÆÄÀÏÀ» »ç¿ëÇÏµµ·Ï ÇØ¶ó
  # ±×·¸Áö ¾Ê´Ù¸é USR1 ½Ã±×³ÎÀ» º¸³¾¶§ ÀÌ ½ºÅ©¸³Æ®´Â ÀÛµ¿ÇÏÁö ¾ÊÀ» °ÍÀÌ´Ù
  log_file="$1"
fi

# snort pid ¸¦ ¾Ë¾Æ³½´Ù
snort_pid=`/sbin/pidof snort`

# ¸ðµç snort ÇÁ·Î¼¼½º¿¡ ´ëÇØ ³»ºÎ Åë°èÀÚ·á¸¦ ¾ò´Â´Ù
# ÀÌ¹Ì Á¤·ÄµÈ Ãâ·ÂÀ» ¾ò±âÀ§ÇØ killall À» »ç¿ëÇÏÁö ¾Ê´Â´Ù
for i in `echo $snort_pid` ; do
  kill -USR1 $i
  
  # snort °¡ Åë°èÀÚ·á¸¦ syslog ¿¡ º¸³»µµ·Ï 2ÃÊµ¿¾È ÈÞ¸éÇÑ´Ù
  sleep 2
done
  
# USR1 ½Ã±×³ÎÀ» º¸³½ÈÄ Áï°¢ÀûÀ¸·Î snort ¸¦ Àç½ÃÀÛÇÑ´Ù
# ÀÌ´Â 2001³â 1¿ù 11ÀÏ°æ ÀÌÈÄÀÇ snort CVS ¹öÀü ¶Ç´Â 1.8.2 ¹öÀü ÀÌ»óÀÇ ¸ðµç ¹öÀüÀ»
# »ç¿ëÇÒ ¶§ »ý·«µÉ ¼öµµ ÀÖ´Ù.
/etc/rc.d/init.d/snortd restart

for i in `echo $snort_pid` ; do
  # process logfile

  filename=/var/log/snort/archive/snort.`date "+%Y-%m-%d"`.$i.log
    
  # ±âÁ¸ ÆÄÀÏÀ» °Ë»çÇÏ°í Á¸ÀçÇÑ´Ù¸é ÆÄÀÏ¸íÀ» º¯°æÇÑ´Ù
  if [ -e "$filename" ] ; then
    mv "$filename" "$filename.bak"
  fi
  
  egrep "snort\[$i\]:" $log_file &gt; "$filename"
  
  # ´ÙÀ½ ¶óÀÎ°ú °°Àº ¶óÀÎµéÀ» »ç¿ëÇÏ¿© ¹ö·ÁÁö´Â ÆÐÅ¶ÀÌ ÀÖ´ÂÁö Á¶»çÇÑ´Ù
  # Oct 22 18:02:06 xbgh17183 snort[573]: dropping 0(0.000%) packets 
  if [ "`egrep "dropping" $filename | awk -F "[ (]" '{ print $7 }'`" != "0" -a \
       "`egrep -c "dropping" $filename`" != "0" ] ; then
    echo "Snort's dropping packets!!! Take a look on the configuration and/or the system's performance!!!"
  fi 
  
done

echo "Gathering snort internal statistics finished..."
     </programlisting>

</para>
</sect3>

<sect3 id="snort-test">
<title>Snort Å×½ºÆ®ÇÏ±â</title>
<para>

snort ¸¦ Å×½ºÆ®ÇÏ±â À§ÇØ¼­´Â  <emphasis 
remap="it">/etc/rc.d/init.d/snortd</emphasis> ¸¦ ÆíÁýÇÏ°í ÀÎÅÍÆäÀÌ½º°¡ ·çÇÁ¹é ÀÎÅÍÆäÀÌ½º
<emphasis remap="it">lo</emphasis> ¿¡¼­ µè°Ô ÇØ¾ß ÇÑ´Ù. ³×Æ®¿öÅ© Ä«µå°¡ ¼³Ä¡µÇ¾î ÀÖ´Â »ç¶÷ÀÇ °æ¿ì´Â ´ë½Å 
<emphasis remap="it">eth0</emphasis> ¸¦ »ç¿ëÇÒ ¼ö ÀÖÁö¸¸ snot ¿Í snort °¡ µ¿ÀÏ ¸Ó½Å¿¡¼­ ½ÇÇàµÇ°í ÀÖ´Ù¸é ÀÎÅÍÆäÀÌ½º¸¦ ÅëÇØ 
¾î¶°ÇÑ ÆÐÅ¶µµ Àü¼ÛµÇÁö ¾Ê±â¶§¹®¿¡ snot ¸¦ µÎ¹øÂ° pc ¸¦ »ç¿ëÇØ ½ÇÇà½ÃÄÑ¾ß ÇÑ´Ù.

</para><para>

snort ¸¦ Å×½ºÆ®ÇÏ´Â ¾Æ¸¶µµ °¡Àå °£´ÜÇÑ ¹æ¹ýÀº <ulink url="http://www.sec33.com/sniph/">http://www.sec33.com/sniph/</ulink> ¿¡¼­
Ã£À» ¼ö ÀÖ´Â <emphasis remap="it">snot</emphasis> ¸¦ »ç¿ëÇÏ´Â °ÍÀÌ´Ù.

</para><para>

Snot ¸¦ À§ÇØ libnet ¸¦ ¼³Ä¡ÇØ¾ß ÇÏ´Âµ¥ ·¹µåÇÞ 7.x ¿¡´Â »ç¿ë°¡´ÉÇÑ RPM ÀÌ ¾ø±â ´ë¹®¿¡ 
<ulink url="http://rpmfind.net/">http://rpmfind.net/</ulink> ¹×
¸Çµå·¹ÀÌÅ© »çÀÌÆ® <ulink url="http://www.mandrake.com/">http://www.mandrake.com/</ulink> ¿¡¼­ Ã£À» ¼ö ÀÖ´Â ¸Çµå·¹ÀÌÅ© ¼ÒÇÁÆ®»çÀÇ
 <emphasis remap="it">libnet-1.0.2-6mdk.i586.rpm</emphasis> À» »ç¿ëÇÒ ¼ö ÀÖ´Ù. ´ëºÎºÐÀÇ ¸Çµå·¹ÀÌÅ© RPM µéÀº ·¹µåÇÞ ½Ã½ºÅÛ¿¡¼­ 
 ¾Æ¹« ¹®Á¦¾øÀÌ »ç¿ëÇÒ ¼ö ÀÖ´Ù. ±×·¯³ª ¸Çµå·¹ÀÌÅ©´Â <emphasis remap="it">i386</emphasis> RPM µéÀ» Á¦°øÇÏÁö ¾ÊÀ½¿¡ ÁÖÀÇÇØ¶ó µû¶ó¼­ 
 ¿¹Àü ÆæÆ¼¾ö P5 ÀÌÀü ÇÁ·Î¼¼¼­¿¡´Â ÀÌµéÀ» »ç¿ëÇÒ ¼ö ¾ø´Ù. ÀÌ·± °æ¿ì 
 <ulink url="http://www.packetfactory.net/projects/libnet">http://www.packetfactory.net/projects/libnet</ulink> ¿¡¼­ ¼Ò½º¸¦
¾òÀº ÈÄ ½º½º·Î ÄÄÆÄÀÏÇØ¾ß ÇÑ´Ù.

</para><para>

snot ¸¦ ÄÄÆÄÀÏÇÏ±â À§ÇØ¼­´Â ´ÜÁö tarball À» untar ÇÑ ÈÄ snot µð·ºÅä¸®¿¡¼­ <emphasis remap="it">make</emphasis> ¸í·ÉÀ» ½ÇÇà½ÃÅ°¸é µÈ´Ù.
¿¡·¯¾øÀÌ ÄÄÆÄÀÏÀÌ Á¾·áµÇ¸é ¹Ù·Î snot ¸¦ »ç¿ëÇÒ ¼ö ÀÖ´Ù. ±×·¸Áö ¾Ê´Ù¸é ¾î¶² °³¹ß ÆÐÅ°Áö°¡ ¾ø´Â °æ¿ìÀÌ´Ù.

</para><para>

snot ¸¦ ÁØºñÇÏ±â À§ÇØ <emphasis remap="it">/etc/snort/snort.conf</emphasis> ÆÄÀÏÀ» snot µð·ºÅä¸®·Î º¹»çÇÑ ÈÄ ÇÏ³ª ¶Ç´Â ±× ÀÌ»óÀÇ 
±ÔÄ¢ ÆÄÀÏµéÀ» º¹»çÇÑ <emphasis remap="it">snort.conf</emphasis> ÆÄÀÏÀÇ ³¡ºÎºÐ¿¡ <emphasis remap="it">cat</emphasis> ÇØÁÖ¸é µÈ´Ù:

</para><para>

     <command>
      cat /etc/snort/backdoor.rules >> snort.conf
     </command>

</para><para>

±× ÈÄ ÇÑ ÄÁ¼Ö¿¡¼­ <command>tail -f /var/log/messages</command> À» ½ÇÇà½ÃÅ°°í µ¿½Ã¿¡ ´Ù¸¥ ÄÁ¼Ö¿¡¼­ Å×½ºÆ®¸¦ ÇØ¾ß ÇÑ´Ù.

</para><para>

snortd initscript ¿¡¼­ ÀÎÅÍÆäÀÌ½º ÀÌ¸§¿¡ <emphasis remap="it">lo</emphasis> ¸¦ »ç¿ëÇß´Ù¸é ´ÙÀ½°ú °°ÀÌ snot ¸¦ ½ÇÇà½ÃÅ³ ¼ö ÀÖ´Ù.

</para><para>

     <command>
      ./snot -r snort.conf -d localhost -n 5
     </command>

</para><para>

ÀÌ ¸í·ÉÀº snot ¿¡°Ô º¹»çÇÑ <emphasis remap="it">snort.conf</emphasis> ¸¦ »ç¿ëÇÏ¸ç, ¸ñÀûÁö´Â 
<emphasis remap="it">localhost</emphasis> ÀÌ°í ³Ê¹« ¸¹Àº °æº¸¸¦ À¯¹ßÇÏÁö ¾Êµµ·Ï ÀÌ¸¦ ÃÖ´ë 5·Î Á¦ÇÑÇÏ¶ó°í ÇÑ´Ù.

</para><para>

Ãß°¡ÀûÀÎ º¯¼ö¸¦ ¹«½ÃÇÏ¶ó°í ÇÏ´Â ¾à°£ÀÇ ¸Þ½ÃÁö¸¦ ¾Æ¸¶µµ ¹ÞÀ» °ÍÀÌ´Ù. ÀÌ´Â snot °¡ snort 1.8 ¿¡ µµÀÔµÈ »õ·Î¿î º¯¼ö¸¦ ´Ù·ê ¼ö ¾ø±â 
¶§¹®À¸·Î ÇãµÕµÇÁö ¸»°í ±×Àú ¸Þ½ÃÁö¸¦ ¹«½ÃÇØ¶ó. snot ´Â Àß ½ÇÇàµÇ°í ÀÖ´Ù.

</para><para>

<emphasis remap="it">/var/log/messages</emphasis> ¿¡¼­ ¾à°£ÀÇ snort °æº¸¸¦ º¼ ¼ö ÀÖ´Ù.

</para><para>

     <programlisting>
Sep 10 18:22:33 ids01 snort[1536]: &lt;lo&gt; GateCrasher access: 192.168.213.151:6969 -&gt; 127.0.0.1:3170
Sep 10 18:22:33 ids01 snort[1536]: &lt;lo&gt; GateCrasher access: 192.168.213.151:6969 -&gt; 127.0.0.1:3170
Sep 10 18:22:33 ids01 snort[1536]: &lt;lo&gt; GateCrasher access: 192.168.155.231:6969 -&gt; 127.0.0.1:57580
Sep 10 18:22:33 ids01 snort[1536]: &lt;lo&gt; GateCrasher access: 192.168.155.231:6969 -&gt; 127.0.0.1:57580
Sep 10 18:22:33 ids01 snort[1536]: &lt;lo&gt; Deep Throat access: 192.168.170.42:2140 -&gt; 127.0.0.1:60521
     </programlisting>

</para><para>

ºñ½ÁÇÑ °æº¸¸¦ ¾ò´Â´Ù¸é ÁÁ´Ù. ±×·¸Áö ¾Ê´Ù¸é À§¿Í À¯»çÇÑ °á°ú¸¦ ¾òÀ» ¶§±îÁö ¼³Á¤À» Á¶»çÇÏ±â ¹Ù¶õ´Ù.

</para><para>

ÀÌÁ¦ <emphasis remap="it">/etc/snort/snort.conf</emphasis> ¸¦ ÆíÁýÇØ <emphasis remap="it">INTERFACE</emphasis> º¯¼ö¿¡ Á¤È®ÇÑ °ªÀ» 
³ÖÀº ÈÄ snort ¸¦ Àç½ÃÀÛÇØ¾ß ÇÑ´Ù.

</para>
</sect3>
</sect2>

<sect2 id="MySQL-config">
<title>MySQL ¼³Á¤ÇÏ±â</title>
<para>

Snort °¡ MySQL ¿¡ °æº¸¸¦ º¸³¾ ¼ö ÀÖµµ·Ï ÇÏ±â À§ÇØ¼­´Â ¿ì¼± MySQL À» ¼³Ä¡ÇØ¾ß ÇÑ´Ù.
´ëºÎºÐÀÇ ¸®´ª½º ¹èÆ÷ÆÇ¿¡´Â »ç¿ëÇÒ ¼ö ÀÖ´Â MySQL ÆÐÅ°Áö°¡ ÀÖÀ¸¸ç µû¶ó¼­ ÀÌ¸¦ ÀÌ¿ëÇÏ¸é µÈ´Ù.
±×·¸Áö ¾Ê´Ù¸é ¾Æ¸¶µµ <ulink url="http://www.mysql.org/">http://www.mysql.org/</ulink> ¿¡¼­ Å¸¸£º¼À»
´Ù¿î·Îµå¹Þ¾Æ ½ºÅ©·¡Ä¡·ÎºÎÅÍ ÀÌ¸¦ ÄÄÆÄÀÏ ¹× ¼³Ä¡ÇØ¾ß ÇÒ °ÍÀÌ´Ù. ÀÌ¸¦ ¼³Ä¡ÇÏ±â À§ÇØ¼­ MySQL ¿¡ Æ÷ÇÔµÇ¾î ÀÖ´Â  ¹®¼­¸¦ º¸¶ó.

</para><para>

MySQL µ¥¸óÀ» ½ÇÇà½ÃÅ² ÈÄ (·¹µåÇÞÀÇ °æ¿ì RPM À» ¼³Ä¡ÇÑ ÈÄ <command>/etc/rc.d/init.d/mysql start</command> ¸¦ ½ÇÇà½ÃÅ²´Ù)
snort µ¥ÀÌÅ¸º£ÀÌ½º¸¦ ÃÊ±âÈ­½ÃÄÑ¾ß ÇÑ´Ù. ÀÌ´Â ´ÙÀ½ Àý¿¡ ±â¼úµÇ¾î ÀÖ´Ù:

</para><para>

    <programlisting>
[root@ids01 /root]# mysql -u root
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 133 to server version: 3.23.32

Type 'help;' or '\h' for help. Type '\c' to clear the buffer

mysql>create database snort;
Query OK, 1 row affected (0.00 sec)

mysql> connect snort
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Connection id:    139
Current database: snort

mysql> status
--------------
mysql  Ver 11.12 Distrib 3.23.32, for redhat-linux-gnu (i386)

Connection id:          139
Current database:       snort
Current user:           root@localhost
Current pager:          stdout
Using outfile:          ''
Server version:         3.23.32
Protocol version:       10
Connection:             Localhost via UNIX socket
Client characterset:    latin1
Server characterset:    latin1
UNIX socket:            /var/lib/mysql/mysql.sock
Uptime:                 1 day 2 hours 6 min 21 sec

Threads: 14  Questions: 4272  Slow queries: 0  Opens: 58  Flush tables: 1  Open tables: 18 Queries per second avg: 0.045
--------------

mysql> grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort@localhost;
Query OK, 0 rows affected (0.00 sec)

mysql> exit
Bye
    </programlisting>

</para><para>

ÇÊ¼ö µ¥ÀÌÅ¸º£ÀÌ½º Å×ÀÌºí ±¸Á¶¸¦ »ý¼º½ÃÅ°±â À§ÇØ º»·¡ÀÇ Å¸¸£º¼ ¶Ç´Â ÀúÀÚÀÇ RPMÀÇ contrib ¿¡¼­ Ã£À» ¼ö ÀÖ´Â
<emphasis remap="it">create_mysql</emphasis> ½ºÅ©¸³Æ®¸¦ »ç¿ëÇÑ´Ù.

</para><para>

    <command>
     [root@ids01 /root]# mysql -u root snort < ./contrib/create_mysql
    </command>

</para><para>

µ¥ÀÌÅ¸º£ÀÌ½º¿¡ ´ëÇØ »ç¿ëÀÚ¾ÆÀÌµð/ÆÐ½º¿öµå ½ÖÀ» Ãß°¡ÇÏ°í <emphasis remap="it">xxxx</emphasis> ¸¦ °¢ÀÚÀÇ È¯°æ¿¡ ÀûÇÕÇÑ 
ÆÐ½º¿öµå·Î º¯°æÇÏ´Â °ÍÀ» ±â¾ïÇØ¾ß ÇÒ °ÍÀÌ´Ù.

</para><para>

    <programlisting>
[root@ids01 /root]# mysql -u root mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 148 to server version: 3.23.32

Type 'help;' or '\h' for help. Type '\c' to clear the buffer

mysql> insert into user (User,Password) values('snort',PASSWORD('xxxx'));
Query OK, 1 row affected (0.00 sec)

mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)

mysql> exit
Bye
    </programlisting>

</para><para>


ÆíÀÇ¸¦ À§ÇØ snort Å¸¸£º¼°ú ÀúÀÚÀÇ RPM ÀÇ contrib ¿¡ ÀÖ´Â ¾à°£ÀÇ Æ¯º°ÇÑ Å×ÀÌºíÀ» ´ÙÀ½ ¸í·ÉÀ» »ç¿ëÇÏ¿© Ãß°¡ÇØ¶ó

</para><para>

    <command>
     zcat snortdb-extra.gz | mysql -u root snort
    </command>

</para><para>

ACID ÀÇ ÀúÀå Æ¯Â¡À» »ç¿ëÇÏ·Á¸é <emphasis remap="it">snort</emphasis> µ¥ÀÌÅ¸º£ÀÌ½º¸¦ Á¤ÀÇÇß´ø ¹æ¹ý°ú µ¿ÀÏÇÏ°Ô
´Ù¸¥ µ¥ÀÌÅ¸º£ÀÌ½º <emphasis remap="it">snort_archive</emphasis> (¶Ç´Â ¿øÇÏ´Â ´Ù¸¥ ÀÌ¸§ÀÇ µ¥ÀÌÅ¸º£ÀÌ½º) 
¸¦ »ý¼ºÇØ¾ß ÇÒ °ÍÀÌ´Ù.  

</para><para>

Áö±ÝºÎÅÍ µ¥ÀÌÅ¸º£ÀÌ½º´Â <emphasis remap="it">/etc/snort/snort.conf</emphasis> ¿¡¼­ È°¼ºÈ­½ÃÅ³ ¼ö ÀÖ´Â snort ÀÇ database Ãâ·Â 
¸ðµâÀ» ÅëÇØ ¾ðÁ¦µçÁö ±â·Ï¿¡ »ç¿ëµÉ ¼ö ÀÖ´Ù.

</para>
</sect2>

<sect2 id="ADODB-config">
<title>ADODB ¼³Á¤ÇÏ±â</title>
<para>

ADODB ´Â ACID ÀÇ ÇÊ¼ö ºÎºÐÀ¸·Î ACID ¿Í °°Àº PHP ±â¹Ý ÇÁ·Î±×·¥¿¡ ´ëÇØ µ¥ÀÌÅ¸º£ÀÌ½º ¿¬°áÀ» Áö¿øÇÑ´Ù.

</para><para>

À¥ ¼­¹ö¿¡ »ç¿ëÇÒ ¼ö ÀÖ´Â µð·ºÅä¸®¿¡ ADODB ¸¦ ¼³Ä¡ÇØ¶ó. ·¹µåÇÞÀÇ °æ¿ì ÀÌ´Â <emphasis remap="it">/var/www/html/adodb/</emphasis> ÀÌ´Ù.

</para><para>

ADODB ¹öÀü 1.31 Àº <emphasis remap="it">adodb.inc.php</emphasis> ¿¡ ¹ö±×°¡ ÀÖ´Âµ¥ ´õ¿í »õ·Î¿î ¹öÀü¿¡¼­µµ ¹ö±×°¡ Á¸ÀçÇÒ ¼öµµ ÀÖ´Ù.
°¢ÀÚÀÇ ·ÎÄÃ ¿ä°ÇÀ» ¹Ý¿µÇÏ±â À§ÇØ 40¹øÂ° ÁÙÀÇ °æ·Î¸¦ º¯°æ½ÃÄÑ¾ß ÇÒ °ÍÀÌ´Ù. <command>dirname()</command> ¸í·ÉÀ» ¿ÏÀüÈ÷ Áö¿ì´Â °ÍÀÌ
ÇÊ¼öÀûÀÌ¸ç µû¶ó¼­ ´ÙÀ½°ú °°´Ù:

</para><para>

    <programlisting>
 if (!defined('_ADODB_LAYER')) {
        define('_ADODB_LAYER',1);

        define('ADODB_FETCH_DEFAULT',0);
        define('ADODB_FETCH_NUM',1);
        define('ADODB_FETCH_ASSOC',2);
        define('ADODB_FETCH_BOTH',3);

        GLOBAL
                $ADODB_vers,            // µ¥ÀÌÅ¸º£ÀÌ½º ¹öÀü
                $ADODB_Database,        // »ç¿ëµÈ ¸¶Áö¸· µ¥ÀÌÅ¸º£ÀÌ½º µå¶óÀÌ¹ö
                $ADODB_COUNTRECS,       // ¹ÝÈ¯µÈ ·¹ÄÚµåÀÇ Ä«¿îÆ® ³Ñ¹ö - Á¶È¸¸¦ ´À¸®°Ô ÇÑ´Ù
                $ADODB_CACHE_DIR,       // Ä³½Ã ·¹ÄÚµå¼Â¿¡ ´ëÇÑ µð·ºÅä¸®
                $ADODB_FETCH_MODE;      // DEFAULT, NUM, ASSOC or BOTH. Default follows native driver default...

        $ADODB_FETCH_MODE = ADODB_FETCH_DEFAULT;
        /**
         * ¾Æ·¡ÀÇ °ªÀ» ÀÌ ÆÄÀÏÀÌ ³õÀÌ´Â µð·ºÅä¸®·Î ¼³Á¤ÇØ¶ó
         * ADODB_RootPath ´Â ADODB_DIR ·Î ÀÌ¸§ÀÌ º¯°æµÇ¾ú´Ù
         */
        if (!defined('ADODB_DIR')) define('ADODB_DIR','/var/www/html/adodb');

    </programlisting>

</para><para>

ÀÌ°ÍÀÌ ADODB ¿¡ ÇàÇØÁ®¾ß ÇÏ´Â ¸ðµç °ÍÀÌ´Ù.

</para>
</sect2>

<sect2 id="PHPlot-config">
<title>PHPlot ¼³Á¤ÇÏ±â</title>
<para>

PHPlot À» ´Ù¿î·ÎµåÇÑ ÈÄ À¥ ¼­¹ö°¡ ÀÎ½ÄÇÒ ¼ö ÀÖ´Â µð·ºÅä¸®¿¡ ÆÐÅ°Áö¸¦ ³õ¾Æ¶ó. ·¹µåÇÞ¿¡¼­ ÀÌ´Â 
<emphasis remap="it">/var/www/html/phplot/</emphasis> ÀÌ´Ù. ¿©±â¼­´Â ¼³Á¤ÇÒ °ÍÀÌ ¾Æ¹« °Íµµ ¾ø´Ù.

</para>
</sect2>

<sect2 id="ACID-config">
<title>ACID ¼³Á¤ÇÏ±â</title>
<para>

¾Õ¿¡¼­ ¸»ÇßµíÀÌ ACID ´Â Á¤È®È÷ ÀÛµ¿ÇÏ±â À§ÇØ ¸î°³ÀÇ Ãß°¡ÀûÀÎ ÇÁ·Î±×·¥ÀÌ ¼³Ä¡µÉ ÇÊ¿ä°¡ ÀÖ´Ù.
MySQL ¹öÀü 3.23 ÀÌ»óÀÇ µ¥ÀÌÅ¸º£ÀÌ½º ½Ã½ºÅÛ, PHP ¸ðµâ <emphasis remap="it">mod_php</emphasis> ÀÌ ÀÖ´Â
<emphasis remap="it">apache</emphasis> ¿Í °°ÀÌ PHP 4.0.2 ÀÌ»óÀ» Áö¿øÇÏ´Â À¥ ¼­¹ö¿Í ADODB ¹öÀü 0.93 ÀÌ ÇÊ¿äÇÑ ¹Ý¸é
±×·¡ÇÈ ¶óÀÌºê·¯¸® <emphasis remap="it">gd</emphasis> ¹öÀü 1.8 ÀÌ»ó°ú PHPlot ¹öÀü 4.4.6 ÀÌ»óÀº ¼±ÅÃÀÌÁö¸¸ ÃßÃµµÈ´Ù.
<emphasis remap="it">apache</emphasis>, PHP ¸ðµâ ¹× <emphasis remap="it">gd</emphasis> ´Â ¸ðµç ¸®´ª½º ¹èÆ÷ÆÇ¿¡ ´Ã
Æ÷ÇÔµÇ¾î ¼³Ä¡µÇ¾î ÀÖ±â¶§¹®¿¡ ÀÌ ¹®¼­¿¡¼­´Â ÀÌµéÀ» ´Ù·çÁö´Â ¾Ê´Â´Ù.

</para><para>

Snort 1.8 ÀÌ»ó¿¡ ´ëÇØ¼­´Â Àû¾îµµ ACID 0.9.6b13 ÀÌ ÇÊ¿äÇÒ °ÍÀÌ´Ù. ACID ´Â ÀúÀÚÀÇ RPM ÀÇ contrib ¿¡ ÀÖÁö¸¸ ACID ´Â ºü¸£°Ô 
°³¹ßµÇ°í ÀÖ±â ¶§¹®¿¡ ÀÌÀü ¹öÀüÀÏ ¼öµµ ÀÖ´Ù. µû¶ó¼­ ´õ¿í »õ·Î¿î ¹öÀüÀÌ Á¸ÀçÇÏ´ÂÁö ´Ã ACID ÀÇ È¨ÆäÀÌÁö¸¦ º¸¾Æ¾ß ÇÑ´Ù.

</para><para>

ACID ¸¦ <emphasis remap="it">/var/www/html/acid</emphasis> ¿Í °°ÀÌ À¥ ¼­¹ö¿¡¼­ ÀÎ½ÄÇÒ ¼ö ÀÖ´Â µð·ºÅä¸®¿¡ ¼³Ä¡ÇØ¶ó.

</para><para>

<emphasis remap="it">/var/www/html/acid/acid_conf.php</emphasis> ¿¡¼­ °¢ÀÚÀÇ È¯°æ¿¡ ¸Âµµ·Ï ¾à°£ÀÇ º¯¼öµéÀ» ÆíÁýÇØ¾ß ÇÒ °ÍÀÌ´Ù.

</para><para>

¿ì¼± º¯¼ö <emphasis remap="it">DBtype</emphasis> ¿¡ µ¥ÀÌÅ¸º£ÀÌ½º Å¸ÀÔÀ» Á¤ÀÇÇØ¶ó. ´ÙÀ½ <emphasis remap="it">alert_*</emphasis> ¿Í
<emphasis remap="it">archive_*</emphasis> º¯¼öµéÀ» Á¤ÀÇÇØ¶ó.

</para><para>

<emphasis remap="it">ChartLib_path</emphasis> ¿¡ PHPlot ¿¡ ´ëÇÑ °æ·Î¸¦ Á¤ÀÇÇØ¶ó. ÀÌ ¹®¼­¿¡¼­´Â <emphasis remap="it">
/var/www/html/phplot</emphasis> ÀÌ´Ù.

</para><para>

Á¤ÀÇÇØ¾ß ÇÒ ¸¶Áö¸· º¯¼ö´Â <emphasis remap="it">portscan_file</emphasis> ·Î snort ÀÇ Æ÷Æ®½ºÄµ ·Î±×ÆÄÀÏÀÇ Àý´ë °æ·Î¿Í ÆÄÀÏ¸íÀ» Á¤ÀÇÇØ¶ó.

</para><para>

¸ðµç ´Ù¸¥ º¯¼öµéÀº ´çºÐ°£Àº ÃæºÐÇÏ´Ù. ¹°·Ð ¿ä±¸¿¡ ÀûÇÕÇÏ°Ô ÀÌµéÀ» ÆíÁýÇÒ ¼ö ÀÖ´Ù.

</para><para>

´ÙÀ½Àº ÀúÀÚ°¡ »ç¿ëÇÑ config ÀÌ´Ù:

</para><para>

    <programlisting>
&lt;?php

$ACID_VERSION = "0.9.6b15";

/* DB Ãß»ó ¶óÀÌºê·¯¸®¿¡ ´ëÇÑ °æ·Î
 *  (ÁÖÀÇ: µð·ºÅä¸® ´ÙÀ½¿¡ ¹é½½·¡½¬¸¦ Æ÷ÇÔÇÏÁö ¸¶¶ó)
 *   e.g. $foo = "/tmp"      [OK]
 *        $foo = "/tmp/"     [WRONG]
 *        $foo = "c:\tmp"    [OK]
 *        $foo = "c:\tmp\"   [WRONG]
 */
$DBlib_path = "/var/www/html/adodb";

/* ±âº»ÀûÀÎ °æº¸ µ¥ÀÌÅ¸º£ÀÌ½º Å¸ÀÔ
 *
 *  MySQL       : "mysql"
 *  PostgresSQL : "postgres"
 */
$DBtype = "mysql";

/* Alert DB ¿¬°á º¯¼öµé */
 *   - $alert_dbname   : Snort °æº¸ DB ÀÇ MySQL µ¥ÀÌÅ¸º£ÀÌ½º ÀÌ¸§
 *   - $alert_host     : DB °¡ ÀúÀåµÇ´Â È£½ºÆ®
 *   - $alert_port     : DB ¿¡ Á¢¼ÓÇÏ´Â Æ÷Æ®
 *   - $alert_user     : DB »ç¿ëÀÚ
 *   - $alert_password : DB »ç¿ëÀÚÀÇ ÆÐ½º¿öµå
 *
 *  ÀÌ Á¤º¸´Â Snort µ¥ÀÌÅ¸º£ÀÌ½º Ãâ·Â ÇÃ·¯±×ÀÎ ¼³Á¤¿¡¼­ ¼öÁýµÉ ¼ö ÀÖ´Ù.
 */
$alert_dbname   = "snort";
$alert_host     = "localhost";
$alert_port     = "";
$alert_user     = "snort";
$alert_password = "xxxx";

/* Archive DB ¿¬°á º¯¼öµé */
$archive_dbname   = "snort_archive";
$archive_host     = "localhost";
$archive_port     = "";
$archive_user     = "snort";
$archive_password = "xxxx";

/* »ç¿ëÇÒ DB ¿¬°á Å¸ÀÔ
 *   1  : ¿µ¼ÓÀûÀÎ ¿¬°áÀ» »ç¿ëÇÑ´Ù (pconnect)
 *   2  : Åë»óÀûÀÎ ¿¬°áÀ» »ç¿ëÇÑ´Ù (connect)
 */
$db_connect_method = 1;

/* ±×·¡ÇÈ ¶óÀÌºê·¯¸®¿¡ ´ëÇÑ °æ·Î
 *  (ÁÖÀÇ: µð·ºÅä¸® ´ÙÀ½¿¡ ¹é½½·¡½¬¸¦ Æ÷ÇÔÇÏÁö ¸¶¶ó)
 */
$ChartLib_path = "/var/www/html/phplot";

/* Â÷Æ®ÀÇ ÆÄÀÏ Æ÷¸Ë ('png', 'jpeg', 'gif') */
$chart_file_format = "png";

/* Â÷Æ®ÀÇ µðÆúÆ® ÄÃ·¯
 *    - $chart_bg_color_default    : Â÷Æ®ÀÇ ¹é±×¶ó¿îµå ÄÃ·¯
 *    - $chart_lgrid_color_default : Â÷Æ®ÀÇ ±×¸®µå¶óÀÎ ÄÃ·¯
 *    - $chart_bar_color_default   : Â÷Æ®ÀÇ ¸·´ë/¼± ÄÃ·¯
 */
$chart_bg_color_default     = array(255,255,255);
$chart_lgrid_color_default  = array(205,205,205);
$chart_bar_color_default    = array(190, 5, 5);

/* ±âÁØ ¿ä¼Ò´ç ÃÖ´ë ÁÙ¼ö */
$MAX_ROWS = 20;

/* ¸ðµç Á¶È¸ °á°ú¿¡ ´ëÇØ Ç¥½ÃÇÏ±â À§ÇÑ ÁÙ¼ö */
$show_rows = 50;

/* ½º³À¼¦µ¿¾È¿¡ ¹ÝÈ¯µÇ´Â ¾ÆÀÌÅÛ¼ö 
 *  Last _X_ # of alerts/unique alerts/ports/IP
 */
$last_num_alerts = 15;
$last_num_ualerts = 15;
$last_num_uports = 15;
$last_num_uaddr = 15;

/* ½º³À¼¦µ¿¾È¿¡ ¹ÝÈ¯µÇ´Â ¾ÆÀÌÅÛ¼ö 
 *  °¡Àå ÀÚÁÖ ÀÏ¾î³­ À¯ÀÏÇÑ alerts/IPs/ports
 */
$freq_num_alerts = 5;
$freq_num_uaddr = 15;
$freq_num_uports = 15;

/* Á¶È¸ °á°ú¸¦ Ç¥½ÃÇÒ ¶§ »ç¿ëµÇ´Â ½ºÅ©·Ñ ¹öÆ°ÀÇ ¼ö */
$max_scroll_buttons = 12;

/* µð¹ö±× ¸ðµå - ¾ó¸¶³ª ¸¹Àº µð¹ö±ë Á¤º¸°¡ º¸¿©Áö´Â Áö¸¦ °áÁ¤
 * Å¸ÀÌ¹Ö ¸ðµå - Å¸ÀÌ¹Ö Á¤º¸ Ç¥½Ã
 * SQL trace ¸ðµå - SQL ¹®À» ±â·Ï
 *   0 : Æ¯º°ÇÑ Á¤º¸ ¾øÀ½
 *   1 : µð¹ö±ë Á¤º¸
 *   2 : È®ÀåµÈ µð¹ö±ë Á¤º¸
 *
 * HTML no cache - no-cache Áö½Ã°¡ ºê¶ó¿ìÀú·Î º¸³»Áö´Â Áö¸¦ °áÁ¤
 *                 ÀÍ½ºÇÃ·Î·¯¿¡ ´ëÇØ¼­´Â 1 ÀÌ´Ù
 *
 * SQL trace ÆÄÀÏ - SQL trace ¸¦ ±â·ÏÇÏ±â À§ÇÑ ÆÄÀÏ
 */
$debug_mode = 0;
$debug_time_mode = 1;
$html_no_cache = 1;
$sql_trace_mode = 0;
$sql_trace_file = "";

/* Auto-Screen refresh
 * - Refresh_Stat_Page - ¾î´À Á¤µµÀÇ Åë°è ÀÚ·á ÆäÀÌÁö°¡ »õ·Ó°Ô º¸¿©Á®¾ß ÇÏ´Â°¡?
 * - Stat_Page_Refresh_Time - refresh °£°Ý (ÃÊ´ÜÀ§)
 */
$refresh_stat_page = 1;
$stat_page_refresh_time = 180;

/* °æº¸¿¡ ´ëÇØ Ã³À½/ÀÌÀü/¸¶Áö¸· Å¸ÀÓ½ºÅÆÇÁ¸¦ Ç¥½ÃÇÏ´Â°¡ ¶Ç´Â
 * À¯ÀÏÇÑ °æº¸ ¸ñ·Ï¿¡ ´ëÇØ ±×Àú Ã³À½/¸¶Áö¸· Å¸ÀÓ½ºÅÆÇÁ¸¦ Ç¥½ÃÇÏ´Â°¡
 *    1: yes
 *    0: no
 */
$show_previous_alert = 1;

/* Sets maximum execution time (in seconds) of any particular page.
 * ÁÖÀÇ: ÀÌ´Â PHP ¼³Á¤ ÆÄÀÏ º¯¼ö max_execution_time À» ¹«½ÃÇÑ´Ù.
 *       µû¶ó¼­ ½ºÅ©¸³Æ®°¡ ÃÑ ($max_script_runtime + max_execution_time) ÃÊµ¿¾È ½ÇÇàµÉ ¼ö ÀÖ´Ù
 */
$max_script_runtime = 180;

/* IP ÁÖ¼Ò¿¡ ´ëÇÑ ±âÁØÀÌ °Ë»ö ½ºÅ©¸°¿¡ ¾î¶»°Ô ÀÔ·ÂµÇ¾î¾ß ÇÏ´Â°¡?
 *   1 : °¢ ¿ÁÅÝÀÌ º°µµ ÇÊµåÀÌ´Ù
 *   2 : ÀüÃ¼ ÁÖ¼Ò°¡ ÇÏ³ªÀÇ ÇÊµåÀÌ´Ù
 */
$ip_address_input = 2;

/* IP ¸¦ FQDN (Fully Qualified Domain Name) ·Î ¹Ù²Ü °ÍÀÎ°¡ (¾î¶² Á¶È¸¿¡ ´ëÇØ)?
 *    1 : yes
 *    0 : no
 */
$resolve_IP = 0;

/* summary stats °¡ ¸ðµç Á¶È¸ °á°ú ÆäÀÌÁö¿¡ ´ëÇØ °è»êµÇ¾î¾ß ÇÏ´Â°¡
 * (ÀÌ ¿É¼ÇÀ» Çã°¡ÇÏ´Â °ÍÀº ÆäÀÌÁö ·Îµù ½Ã°£À» ´À¸®°Ô ÇÒ °ÍÀÌ´Ù)
 */
$show_summary_stats = 1;

/* DNS Ä³½Ã À¯È¿±â°£ (ºÐ´ÜÀ§) */
$dns_cache_lifetime = 20160;

/* Whois Á¤º¸ Ä³½Ã À¯È¿±â°£ (ºÐ´ÜÀ§) */
$whois_cache_lifetime = 40320;

/* Snort spp_portscan ·Î±× ÆÄÀÏ */
$portscan_file = "/var/log/snort/portscan.log";

/* ÀÌº¥Æ® Ä³½Ã ÀÚµ¿ °»½Å
 *
 *  ÀÌº¥Æ® Ä³½Ã°¡ ¸ðµç ÆäÀÌÁö ·Î±×¿¡ ´ëÇØ °ËÁõµÇ°í °»½ÅµÇ¾î¾ß ÇÏ´Â°¡?
 *  ±×·¸Áö ¾Ê´Ù¸é Ä³½Ã´Â 'cache and status' ÆäÀÌÁö·ÎºÎÅÍ ¸í½ÃÀûÀ¸·Î °»½ÅµÇ¾î¾ß ÇÒ °ÍÀÌ´Ù.
 *
 *  ÁÖÀÇ: ÀÌ ¿É¼ÇÀ» Çã°¡ÇÏ´Â °ÍÀº Ä³½ÃµÇÁö ¾ÊÀº ¸¹Àº °æº¸°¡ ÀÖÀ»¶§ ÆäÀÌÁö ·Îµù ½Ã°£À»
 *  »ó´çÈ÷ ´À¸®°Ô ÇÒ °ÍÀÌ´Ù. ±×·¯³ª ÀÌ´Â ´ÜÁö ÇÑ¹ø °Þ´Â ºÒÆíÀÌ´Ù.
 *
 *   1 : yes
 *   0 : no
 */
$event_cache_auto_update = 1;

/* ¿ÜºÎ Whois Á¶È¸¿¡ ´ëÇÑ ¸µÅ© */
$external_whois_link = "http://www.samspade.org/t/ipwhois?a=";

?&gt;
    </programlisting>

</para><para>

ÀúÀÚ°¡ ÆÐ½º¿öµå·Î <emphasis remap="it">xxxx</emphasis> ¸¦ »ç¿ëÇß´ÂÁö ÀÇ¾ÆÇØÇÒÁö ¸ð¸¥´Ù.
ÁÁ´Ù ¿©·¯ºÐÀº ¼¼»óÀÇ ¸ðµÎ°¡ »ç¿ëÇÒ ¼ö ÀÖ´Â ÆÐ½º¿öµå¸¦ ÁÁ¾ÆÇÏ´Â°¡?

</para><para>

ºê¶ó¿ìÀú·Î ACID ¸¦ Ã³À½ ºÒ·¯¿Ã ¶§ ¼±ÅÃµÈ µ¥ÀÌÅ¸º£ÀÌ½º¿¡ ACID Áö¿øÀ» ¼³Ä¡ÇØ¾ß ÇÑ´Ù´Â Áö½Ã¸¦ ¾òÀ» °ÍÀÌ´Ù.
<emphasis remap="it">Setup</emphasis> ¸¦ Å¬¸¯ÇØ¶ó ±×·¯¸é ACID °¡ µ¥ÀÌÅ¸º£ÀÌ½º¿¡ ÇÊ¼ö ¿£Æ®¸®¸¦ »ý¼ºÇÒ °ÍÀÌ´Ù.
¸ðµç °ÍÀÌ Á¤È®È÷ ¼³Á¤µÇ¸é Áö±Ý µ¥ÀÌÅ×º£ÀÌ½º¿¡ ÀÖ´Â ¸ðµç Á¤º¸¸¦ ¾òÀ» °ÍÀÌ´Ù. ÀÏ¹ÝÀûÀ¸·Î ÀÌ¶§¿¡´Â ¾Æ¹« °Íµµ ¾øÀ» °ÍÀÌ´Ù.

</para><para>

<emphasis remap="it">snot</emphasis>(À­ ÀýÀ» º¸¶ó) ¶Ç´Â <emphasis remap="it">nmap</emphasis> (
<ulink url="http://www.nmap.org/">http://www.nmap.org/</ulink>, ¸Å¿ì ¸¹Àº ´É·ÂÀ» °®°í ÀÖ´Â Æ÷Æ®½ºÄ³³Ê) 
¶Ç´Â <emphasis remap="it">nessus</emphasis> (<ulink url="http://www.nessus.org/">http://www.nessus.org/</ulink>,
½Ã½ºÅÛÀÇ Ãë¾à¼ºÀ» Ã£±â À§ÇÑ ½ºÄ³³Ê) ¸¦ »ç¿ëÇØ ¾î¶² snort ±ÔÄ¢µéÀ» À¯¹ßÇØ º¸¶ó.

</para><para>

ÀÌ°ÍÀÌ ÀÏ¾î³¯ ¶§¸¶´Ù ¹Ù·Î ACID ¿¡¼­ ¸ðµç °æº¸¸¦ ¾òÀ» °ÍÀÌ´Ù.

</para>
</sect2>

<sect2 id="SnortSnarf-config">
<title>SnortSnarf ¼³Á¤ÇÏ±â</title>
<para>

SnortSnarf ´Â µ¥ÀÌÅ¸º£ÀÌ½º´ë½Å snort ÀÇ ·Î±×ÆÄÀÏÀ» ºÐ¼®ÇÏ´Â ´Ù¸¥ µµ±¸ÀÌ´Ù.

</para><para>

SnortSnarf ¸¦ ¿øÇÏ´Â µð·ºÅä¸®¿¡ tar ÇÑ ÈÄ ¼³Ä¡ÇØ¶ó. ÀúÀÚÀÇ °æ¿ì´Â <emphasis remap="it">/opt/SnortSnarf</emphasis> ¿¡
¼³Ä¡Çß´Ù.

</para><para>

ÇÊ¼ö ÆÞ ¸ðµâÀ» SnortSnarf ¿¡ »ç¿ëÇÒ ¼ö ÀÖµµ·Ï <emphasis remap="it">/opt/SnortSnarf/Time-modules/lib/Time</emphasis> ¸¦ 
<emphasis remap="it">/opt/SnortSnarf/include/SnortSnarf/Time</emphasis> ¿¡ º¹»çÇØ¶ó.

</para><para>

´ÙÀ½ ¶óÀÎµéÀ» À¥ ¼­¹öÀÇ <emphasis remap="it">cgi-bin</emphasis> ¿¡ º¹»çÇØ¶ó (¿¹, <emphasis remap="it">/var/www.cgi-bin/</emphasis>):

</para><para>

    <programlisting>
     /opt/SnortSnarf/cgi/*
     /opt/SnortSnarf/include/ann_xml.pl
     /opt/SnortSnarf/include/web_utils.pl
     /opt/SnortSnarf/include/xml_help.pl
    </programlisting>

</para><para>

SnortSnarf ¿¡¼­ »ç°í¿¡ ´ëÇÑ ¸Þ¸ð¸¦ »ý¼ºÇÒ ¼ö ÀÖ´Â annotation Æ¯Â¡À» »ç¿ëÇÏ°í ½Í´Ù¸é
¿ì¼± <emphasis remap="it">/var/www/html/SnortSnarf/annotations</emphasis> µð·ºÅä¸®¸¦ »ý¼ºÇØ¾ßÇÑ´Ù.
´ÙÀ½ <emphasis remap="it">/opt/SnortSnarf/new-annotation-base.xml</emphasis> ¸¦
<emphasis remap="it">/var/www/html/SnortSnarf/annotations</emphasis> ¿¡ º¹»çÇÑ ÈÄ 
<emphasis remap="it">/opt/SnortSnarf/utilities</emphasis> ¿¡ ÀÖ´Â ´ÙÀ½ ¸í·ÉÀ» ½ÇÇà½ÃÅ²´Ù.

</para><para>

    <command>./setup_anns_dir.pl -g apache /var/www/html/SnortSnarf/annotations</command>

</para><para>

<emphasis remap="it">/var/www/html/SnortSnarf/annotations</emphasis> ÀÇ ±ÇÇÑÀ» °Ë»çÇØ¼­ ´ÙÀ½°ú °°µµ·Ï ÇØ¶ó.

</para><para>

    <programlisting>
[root@ids01 SnortSnarf]# ll -a /var/www/html/SnortSnarf/annotations/
total 16
drwxrwx---    2 root     apache       4096 May 23 14:31 .
drwxr-xr-x    8 root     root         4096 May 23 14:17 ..
-rw-r--r--    1 apache   apache        478 May 23 14:31 new-annotation-base.xml
    </programlisting>

</para><para>

ÀúÀÚ´Â ´Ù·ç±â Èûµç @INC ¿¡·¯ (ÆÞ¿¡ ´ëÇØ ´õ¿í ¸¹Àº Áö½ÄÀ» °®°í ÀÖ´Â ´©±º°¡°¡ ÀÌ ¿¡·¯µéÀ» ¾ø¾Ö´Â ¹æ¹ý¿¡ ´ëÇÑ ÈùÆ®¸¦ ÀúÀÚ¿¡°Ô ÁÙ ¼ö ÀÖ´Ù) 
µéÀ» ¾ø¾Ö±â À§ÇØ <emphasis remap="it">/opt/SnortSnarf/snortsnarf.sh</emphasis> wrapper ½ºÅ©¸³Æ®¸¦ 
¸¸µé¾ú´Ù. ÀúÀÚ´Â ¿ÀÀü 6 ½ÃºÎÅÍ ¿ÀÈÄ 6 ½Ã±îÁö ¸Å½Ã°£ cron À» ÅëÇØ <emphasis remap="it">/opt/SnortSnarf/snortsnarf.sh</emphasis> 
À» ½ÇÇà½ÃÅ°°í ÀÖ´Ù.

</para><para>

ÀúÀÚÀÇ crontab ¿£Æ®¸®´Â ´ÙÀ½°ú °°´Ù:

</para><para>

    <programlisting>
# ¿ÀÀü 6½ÃºÎÅÍ ¿ÀÈÄ 6½Ã±îÁö ¸Å½Ã°£ SnortSnarf Åë°è ÀÚ·á¸¦ »ý¼ºÇÑ´Ù
0 6,7,8,9,10,11,12,13,14,15,16,17,18 * * * /opt/SnortSnarf/snortsnarf.sh
    </programlisting>

</para><para>

SnortSnarf ´Â ´Ù¼¸°³ÀÇ ·Î±×ÆÄÀÏ <emphasis remap="it">/var/log/messages*</emphasis> À» ºÐ¼®ÇÏ±â À§ÇØ È£ÃâµÇ¸ç »ý¼ºµÈ
HTML ÆÄÀÏµéÀ» <emphasis remap="it">/var/www/html/SnortSnarf</emphasis> µð·ºÅä¸®³»¿¡ ³ÖÀº ÈÄ À§¿¡ ±â¼úµÈ annotation Æ¯Â¡À» 
ÀÌ¿ëÇÑ´Ù.

</para><para>

´ÙÀ½Àº <emphasis remap="it">/opt/SnortSnarf/snortsnarf.sh</emphasis> ÆÄÀÏ ³»¿ëÀÌ´Ù:

</para><para>

    <programlisting>
#!/bin/sh
# @INC ¹®Á¦¸¦ ¾ø¾Ö±â À§ÇØ crontab °ú ÇÔ²² »ç¿ëÇÏ±â À§ÇÑ wrapper
# Poppi, 22.05.2001
cd /opt/SnortSnarf
./snortsnarf.pl -d /var/www/html/SnortSnarf -db /var/www/html/SnortSnarf/annotations/new-annotation-base.xml -dns -rulesfile /etc/snort/snort.conf -ldir "file://var/log/snort/" /var/log/messages /var/log/messages.1 /var/log/messages.2 /var/log/messages.3 /var/log/messages.4
    </programlisting>

</para><para>

<emphasis remap="it">snortsnarf.sh</emphasis> À» ½ÇÇà½ÃÄÑ¼­ SnortSnarf ¸¦ Å×½ºÆ®ÇÏ°í ºê¶ó¿ìÀú·Î
<emphasis remap="it">/var/www/html/SnortSnarf/</emphasis> ¸¦ Á¶»çÇØº¸¶ó.

</para>
</sect2>

<sect2 id="Arachnidsupd-config">
<title>Arachnids_upd ¼³Á¤ÇÏ±â</title>
<para>

°æ°í: ¾î¶°ÇÑ ¾ÏÈ£È­ ¶Ç´Â ÀÎÁõ¾øÀÌ ±ÔÄ¢µéÀ» ÀÚµ¿ °»½ÅÇÏ´Â °ÍÀº °ø°ÝÀÚ°¡ IDS ¿¡¼­ Á¸Àç°¡ ¹ß°¢µÇÁö ¾ÊÀ» ¼ö ÀÖµµ·Ï ±ÔÄ¢µéÀÌ 
¼Õ»óµÉ ¼ö ÀÖ±â¶§¹®¿¡ ¹éµµ¾î¸¦ ¸¸µé ¼ö ÀÖ´Ù. µû¶ó¼­ ÀÌ¸¦ Á¶½ÉÇØ¼­ »ç¿ëÇØ¾ß ÇÑ´Ù.

</para><para>

´Ù¸¥ ¹®Á¦´Â wwww.whitehats.com ÀÌ Á¾Á¾ ¿ÀÇÁ¶óÀÎÀÌ¶ó´Â °ÍÀÌ¸ç µû¶ó¼­ ¾î¶°ÇÑ ±ÔÄ¢µéµµ ´Ù¿î·Îµå¹ÞÀ» ¼ö ¾ø´Ù.

</para><para>

arachnids_upd ÆÐÅ°Áö¸¦ ¼±ÅÃÇÑ µð·ºÅä¸®¿¡ ¾ÐÃàÇØÁ¦ÇØ¶ó. ÀúÀÚ´Â <emphasis remap="it">/opt/arachnids_upd/</emphasis> ¸¦ »ç¿ëÇÑ´Ù.

</para><para>

Snort 1.8 ÀÌ»ó¿¡ ´ëÇØ <emphasis remap="it">/opt/arachnids_upd/arachnids_upd.pl</emphasis> ¸¦ ÆíÁýÇØ¼­ ´Ù¿î·ÎµåÇÒ ÆÄÀÏ¸íÀ» 
º¯°æÇØ¾ß ÇÒ °ÍÀÌ´Ù:

</para><para>

    <programlisting>
     my $url = "http://www.whitehats.com/ids/vision18.rules.gz";   # Default URL.
    </programlisting>

</para><para>

Arachnids_upd ´Â <emphasis remap="it">wget</emphasis> ¸¦ »ç¿ëÇÏ±â ¶§¹®¿¡ °¢ÀÚÀÇ ½Ã½ºÅÛ¿¡ ¼³Ä¡µÇ¾î¾ß ÇÏ¸ç ÀÎÅÍ³Ý ¿¬°á°ú 
ÀÛµ¿µÇµµ·Ï ¼³Á¤µÇ¾î¾ß ÇÑ´Ù.

</para><para>

»ç¿ëÀÚ ÀÎÁõÀ» ÇÏ´Â ÇÁ¶ô½Ã ¼­¹ö¸¦ ÅëÇÑ ¿¬°áÀÇ °æ¿ì .wgetrc ¿¹Á¦ ÆÄÀÏÀÌ´Ù:

</para><para>

    <programlisting>
     proxy_user = user
     proxy_passwd = xxxx
     http_proxy = &lt;proxy&gt;:&lt;port&gt;
     ftp_proxy = &lt;proxy&gt;:&lt;port&gt;
     use_proxy = on
    </programlisting>

</para><para>

&lt;proxy&gt; ¿Í &lt;port&gt; ¸¦ °¢°¢ °¢ÀÚÀÇ ÇÁ¶ô½Ã ÀÌ¸§ ¶Ç´Â ip ÁÖ¼Ò¿Í ÇÁ¶ô½Ã°¡ »ç¿ëÇÏ´Â Æ÷Æ® ³Ñ¹ö·Î ´ëÃ¼ÇØ¶ó.
ÇÁ¶ô½Ã¸¦ »ç¿ëÇÏÁö ¾Ê´Â´Ù¸é ÀÌ ¿£Æ®¸®µé Áß ¾Æ¹«°Íµµ ÇÊ¿äÇÏÁö ¾Ê´Ù.

</para><para>

ÀúÀÚ´Â »õ·Î¿î ±ÔÄ¢À» ¾ò°í <emphasis remap="it">/etc/snort/snort.conf</emphasis> ÀÇ Á¤ÀÇ¿¡ ¸Â°Ô º¯¼ö ÀÌ¸§ 
<emphasis remap="it">vision.rules</emphasis> À» º¯°æÇÏ¸ç »õ·Î¿î ±ÔÄ¢µéÀÌ À¯È¿ÇÏµµ·Ï snort ¸¦ Àç½ÃÀÛ½ÃÅ°´Â ½© ½ºÅ©¸³Æ®¸¦ ÀÛ¼ºÇß´Ù.

</para><para>

    <programlisting>
#!/bin/sh
# arachnids_upd.pl À» »ç¿ëÇÏ¿© vision.rules ÆÄÀÏÀ» Á¤È®È÷ °»½ÅÇÏ±â À§ÇÑ ½ºÅ©¸³Æ®
# Poppi 22.05.2001

# »õ·Î¿î ±ÔÄ¢À» ¾ò´Â´Ù (~/.wgetrc °¡ ÀÎÅÍ³Ý¿¡ Á¢¼ÓÇÒ ¼ö ÀÖµµ·Ï ¼³Á¤µÇ¾î¾ß ÇÑ´Ù)
/opt/arachnids_upd/arachnids_upd.pl -o /opt/arachnids_upd/vision.rules -b /opt/arachnids_upd/rules.backup/ -c

# /etc/snort/snort.conf ÆÄÀÏ³»¿¡ »ç¿ëµÈ º¯¼öÀÌ¸§À¸·Î º¯°æÇÏ°í »õ·Î¿î ÆÄÀÏÀ» Á¤È®ÇÑ °÷À¸·Î º¹»çÇÑ´Ù
cat /opt/arachnids_upd/vision.rules | sed s/EXTERNAL/EXTERNAL_NET/g | sed s/INTERNAL/HOME_NET/g > /etc/snort/vision.rules

# ±ÔÄ¢µéÀÌ À¯È¿ÇÏµµ·Ï snort ¸¦ Àç½ÃÀÛÇÑ´Ù
/etc/rc.d/init.d/snortd restart
    </programlisting>

</para><para>

Arachnids_upd ´Â ¶ÇÇÑ ´Ù¿î·ÎµåÇÏ´Â µ¿¾È <emphasis remap="it">vision.rules</emphasis> ³»ÀÇ ±ÔÄ¢µéÀ» »èÁ¦ÇÒ ¼ö ÀÖ±â ¶§¹®¿¡ 
¿øÇÑ´Ù¸é <emphasis remap="it">/opt/arachnids_upd/arachnids.ignore</emphasis> ¸¦ ÆíÁýÇØ ¹«½ÃµÇ¾î¾ß ÇÏ´Â IDS ³Ñ¹ö¸¦ ³ÖÀ» ¼ö ÀÖ´Ù.

</para><para>

    <programlisting>
     # ±ÔÄ¢µéÀÌ ±ÝÁöµÇ¾î¾ß ÇÏ´Â IDS ³Ñ¹ö¸¦ ³Ö¾î¶ó.
     # ÇÑÁÙ¿¡ ÇÑ°³ÀÇ IDS ³Ñ¹ö.

     # Examples:

     1      # Ignore IDS1
     2      # Ignore IDS2
     3      # Ignore ISD3
     
     # I think you get it now :)
    </programlisting>

</para>
</sect2>

<sect2 id="Swatch-config">
<title>Swatch ¼³Á¤ÇÏ±â</title>
<para>

Swatch ´Â ¸ðµç ·Î±×ÆÄÀÏÀ» ´Ù·ç´Â ¿ì¼öÇÑ ÆÐÅ°Áö·Î °ø°Ý°ú °ü·ÃµÈ ¾î¶°ÇÑ °ÍÀÌ ·Î±×ÆÄÀÏ¿¡ ±â·ÏµÈ´Ù¸é °æ°íÇØÁÖµµ·Ï Á¤±Ô Ç¥ÇöÀ» ÀÌ¿ëÇØ
¼³Á¤µÉ ¼ö ÀÖ´Ù.

</para><para>

Swatch ´Â ´ÙÀ½ ÆÞ ¸ðµâÀÌ ¼³Ä¡µÇ¾î¾ß ÇÑ´Ù:

</para><para>

    <programlisting>
     perl-TimeDate
     perl-Date-Calc
     perl-Time-HiRes
     perl-File-Tail
    </programlisting>

</para><para>

Swatch ´Â ÀúÀÚÀÇ ¼Ò½º RPM <ulink
url="http://www.lug-burghausen.org/projects/Snort-Statistics/swatch-3.0.2-1.src.rpm">http://www.lug-burghausen.org/projects/Snort-Statistics/swatch-3.0.2-1.src.rpm</ulink>
 °ú ÇÔ²² <ulink
url="http://www.lug-burghausen.org/projects/Snort-Statistics/swatch-3.0.2-1.noarch.rpm">http://www.lug-burghausen.org/projects/Snort-Statistics/swatch-3.0.2-1.noarch.rpm</ulink>
¿¡¼­ RPM À¸·Î ¾òÀ» ¼ö ÀÖ´Ù.

</para><para>

Swatch ´Â <emphasis remap="it">/etc/swatch/swatch.conf</emphasis> ¼³Á¤ ÆÄÀÏÀ» ÅëÇØ ¼³Á¤µÈ´Ù.


</para><para>

ÀúÀÚ´Â ¿ø·¡ swatch ÆÐÅ°ÁöÀÇ ¾à°£ÀÇ ´Ù¸¥ ¿¹¿Í ÇÔ²² ¹Ø¿¡ º¸ÀÌ´Â snort ¸Þ½ÃÁö¿Í ¿¡·¯¿¡ ´ëÇÑ µÎ ±ÔÄ¢À» Æ÷ÇÔÇÏ°í ÀÖ´Â µ¥¸ð
<emphasis remap="it">swatch.conf</emphasis> ¸¦ °®´Â ¼Ò½º RPM À» ÀÛ¼ºÇÏ°í ÀÖ´Ù.

</para><para>

    <programlisting>
# global swatch.conf file
# * Poppi, 30.04.2001
# - ÃÖÃÊ¹öÀü
#
# * Poppi, 08.06.2001
# - ¿¡·¯ Áö¿øÀ» Ãß°¡ÇÏ¿´´Ùt; ¹Ýµå½Ã snort º¸´Ù swatch ¸¦ ¸ÕÀú ½ÇÇà½ÃÄÑ¶ó;)
#
# Poppi, 19.09.2001
# - µ¿ÀÏ »ç°Ç¿¡ ´ëÇØ ³Ê¹« ¸¹Àº °æº¸¸¦ ¾òÁö ¾Êµµ·Ï throttle ¿É¼ÇÀ» Ãß°¡ÇÏ¿´´Ù

# PID °¡ ÀÖ´Â Á¤»óÀûÀÎ snort ¸Þ½ÃÁö
# 10ÃÊµ¿¾È µÎ°³°¡ ÀÖ´Â °æº¸¸¦ Á¦°ÅÇØ¶ó (¿¹ pings)
watchfor /snort\[/
        bell
        exec /etc/snort/snort-check $0
        throttle 00:00:10

# snort ¿¡·¯ ¸Þ½ÃÁö´Â [!] indicator °¡ ÀÖÀ» ¼öµµ ÀÖ°í ¾øÀ» ¼öµµ ÀÖ´Ù
watchfor /snort: (\[\!\])* ERROR/
        bell
        exec /etc/snort/snort-check $0
    </programlisting>

</para><para>

Ã¹¹øÂ° ±ÔÄ¢Àº Ãâ·Â ¸ðµâ <emphasis remap="it">alert_syslog</emphasis> ¸¦ ÅëÇØ »ý¼ºµÈ ¸ðµç °æº¸¸¦ ¾ò±â À§ÇÑ °ÍÀÌ°í
µÎ¹øÂ° ±ÔÄ¢Àº (±ÔÄ¢ ÆÄÀÏ¿¡¼­ÀÇ ¿¡·¯µé°ú °°ÀÌ) ¹«¾ùÀÎ°¡ Àß¸øµÈ °æ¿ì snort °¡ »ý¼ºÇÏ´Â ¸ðµç ¿¡·¯ ¸Þ½ÃÁöµéÀ» ¾ò±â À§ÇÑ °ÍÀÌ´Ù.

</para><para>

µÎ ±ÔÄ¢Àº pc ¿¡ ½ÅÈ£¸¦ º¸³» ¾Ë¸®¸ç (¸¸¾à ¼¾¼­°¡ ¿î¿µÀÚ°¡ ¾ø´Â ¹æ¿¡¼­ »ç¿ëµÇ°í ÀÖ´Ù¸é ¾Æ¹« ÀÇ¹Ìµµ ¾ø´Ù) ÁÖ¾îÁø »ç¶÷¿¡°Ô °æ°íÇÏ±â 
À§ÇØ ¾Õ¿¡¼­ ±â¼úÇÑ <emphasis remap="it">snort-check</emphasis> ½ºÅ©¸³Æ®¸¦ ÀÌ¿ëÇÑ´Ù. <emphasis remap="it">&0</emphasis> ³»¿¡  
swatch ´Â swatch ¸¦ À¯¹ßÇÑ ·Î±×ÆÄÀÏ³»ÀÇ ¸ðµç ¿£Æ®¸®¸¦ Á¦°øÇÑ´Ù.

</para><para>

Swatch ´Â snort º¸´Ù ¸ÕÀú ½ÃÀÛµÇ¾î¾ß ÇÑ´Ù. Á¤È®ÇÑ <emphasis remap="it">chkconfig</emphasis> dates ¸¦ °®´Â swatch ÀÚ½ÅÀÇ 
initscript ¸¦ »ý¼ºÇÏ´Â ´ë½Å ÀúÀÚ´Â ÀÌ¸¦ <emphasis remap="it">/etc/rc.d/init.d/snortd</emphasis> ¿¡ Æ÷ÇÔÇÏ¿´´Ù. ¿Ö³ÄÇÏ¸é 
ÀúÀÚ°¡ »ç¿ëÇÏ´Â swatch ÀÇ ÀÇÁ¸¼º¶§¹®¿¡ ÀÌ·¸°Ô ÇÏ±â·Î °áÁ¤Çß´Ù. ÀúÀÚ´Â ÁÁÀº ¹æ½ÄÀÌ ¾Æ´Ï¸ç swatch ºÎºÐÀÌ ºñ±³Àû ½±°Ô 
initscript ³»¿¡¼­ ÀÛ¼ºµÉ ¼ö ÀÖÀ½À» ¾Ë°í ÀÖ´Ù. ¾Æ¸¶µµ ÃßÈÄ¿¡ ÀÌ¸¦ º¯°æÇÒ °ÍÀÌ´Ù.

</para>
</sect2>
</sect1>

<!-- Section1: implement: END -->


<!-- Section1: adv-issues -->

<sect1 id="security-issues">
<title>º¸¾È ¹®Á¦</title>

   <indexterm>
    <primary>Snort Statistics!security issues</primary>
   </indexterm>

<para>

Snort ´Â ÀÚ½ÅÀÇ userid/group ½ÖÀÎ <emphasis remap="it">snort/snort</emphasis> ÇÏ¿¡¼­ ½ÇÇàµÈ´Ù. ÀÌ´Â ¾ÆÁ÷²¯ ¼öÁ¤µÇÁö ¾ÊÀº
¸ðµç ¹öÆÛ ¿À¹öÇÃ·Î¿ì°¡ ´ÜÁö snort »ç¿ëÀÚ°¡ °®´Â ±ÇÇÑ¸¸À» °®À½À» È®ÀÎÇÑ´Ù. ÀÌ°ÍÀÌ ÃæºÐÇÏÁö ¾ÊÀº »ç¶÷µéÀÇ °æ¿ì´Â snort ÀÇ 
Ä¿¸Çµå ¶óÀÎ ¿É¼Ç <emphasis remap="it">-t</emphasis> ¸¦ »ç¿ëÇØ chroot µÈ È¯°æÀ» »ç¿ëÇÒ ¼öµµ ÀÖ´Ù. ±×·¯³ª ÀúÀÚ¿¡°Ô ÀÌ ¹æ¹ýÀ» 
¹¯Áö ¸»¾Æ¶ó. ÀúÀÚ´Â ÇØº»ÀûÀÌ ¾øÀ¸¸ç ¾Æ¸¶µµ ÇÏÁö ¾ÊÀ» °ÍÀÌ´Ù.

 </para><para>

¸ðµç º¸¾È °ü·Ã ½Ã½ºÅÛ¿¡¼­¿Í °°ÀÌ ÇÊ¿äÀÌ»óÀÇ ¼­ºñ½º¸¦ Çã¿ëÇÏÁö ¸¶¶ó. ¸ðµç ¸®´ª½º ¹èÆ÷ÆÇÀÇ Ç¥ÁØ ¼³Ä¡¸¦ ÇÑ °æ¿ì ¹èÆ÷ÆÇÀÌ 
¿¹Àü inetd ¸¦ »ç¿ëÇÏ°í ÀÖ´Ù¸é <emphasis remap="it">/etc/inetd.conf</emphasis> ¸¦ <emphasis remap="it">xinetd</emphasis> ±â¹Ý 
½Ã½ºÅÛÀÌ¶ó¸é <emphasis remap="it">/etc/xinetd.d/*</emphasis> ¸¦ Á¶»çÇØ¼­ ½Ã½ºÅÛ¿¡ ½ÇÁ¦·Î ÇÊ¼öÀûÀÌÁö ¾ÊÀº ¸ðµç ¼­ºñ½º¸¦ ±ÝÁöÇØ¾ß ÇÑ´Ù. ¿¹¸¦ µé¾î ÅÚ³Ý »ç¿ëÀ» ¿øÇÏÁö ¾Ê´Â´Ù¸é ÀÌ¸¦ ssh ·Î ´ëÃ¼ÇØ¶ó.

</para><para>

¶ÇÇÑ ·¹µåÇÞ°ú °°ÀÌ System V ±â¹Ý ½Ã½ºÅÛ¿¡¼­ <emphasis remap="it">/etc/rc.d/init.d/*</emphasis> ¿¡ ÀÖ´Â initscript µéÀ» Á¶»çÇØ¶ó.
<emphasis remap="it">nfs</emphasis> ¿Í <emphasis remap="it">portmap</emphasis> ¿Í °°ÀÌ »ç¿ëÇÏÁö ¾Ê´Â ¼­ºñ½º°¡ ÀÖ´Ù¸é ÇØ´ç 
ÆÐÅ°Áö¸¦ ¿ÏÀüÈ÷ Á¦°ÅÇØ¶ó.

</para><para>

<emphasis remap="it">Security-HOWTO</emphasis>, <emphasis remap="it">½Ã½ºÅÛ °ü¸®ÀÚ °¡ÀÌµå</emphasis> ¶Ç´Â
<emphasis remap="it">³×Æ®¿öÅ© °ü¸®ÀÚ °¡ÀÌµå</emphasis> ¿Í °°Àº ¸¹Àº º¸¾È °ü·Ã ¹®¼­µéÀ» ÀÐ¾î¾ß ÇÑ´Ù.

</para><para>

¶Ç´Â <ulink url="http://www.securityfocus.com/">http://www.securityfocus.com/</ulink>,
<ulink url="http://www.linuxsecurity.org/">http://www.linuxsecurity.org/</ulink> ¶Ç´Â 
<ulink url="http://www.insecure.org/">http://www.insecure.org/</ulink> ¿Í °°Àº ¿©·¯ º¸¾È °ü·Ã À¥ »çÀÌÆ®¸¦ Á¶»çÇØ¶ó.

</para>
</sect1>

<!-- Section1: adv-issues: END -->


<!-- Section1: help -->

<sect1 id="help">
<title>µµ¿ò¾ò±â</title>

   <indexterm>
    <primary>Snort-Statistics!assistance, obtaining</primary>
   </indexterm>

 <para>
 
°á±¹ ÀÚ½ÅÀÇ ¹®Á¦¸¦ ÇØ°áÇÒ ¼ö ¾ø¾î ´©±º°¡ÀÇ µµ¿òÀ» ÇÊ¿ä·Î ÇÒ ¼öµµ ÀÖ´Ù. °¡Àå È¿°úÀûÀÎ ¹æ¹ýÀº
°¡±î¿î °÷ ¶Ç´Â °¡Àå °¡±î¿î ¸®´ª½º »ç¿ëÀÚ ±×·ì³»ÀÇ ´©±º°¡¿¡°Ô ¹¯°Å³ª À¥À» °Ë»öÇÏ´Â °ÍÀÌ´Ù.

</para><para>

±×·¯³ª ¿ì¼±ÀûÀ¸·Î <ulink url="http://www.snort.org/">http://www.snort.org/</ulink> °ú snort ¸ÞÀÏ¸µ ¸®½ºÆ®¸¦ »ìÆìº¸µµ·Ï ÇØ¶ó.
ÀúÀÚ´Â ÀÌ°÷ÀÇ »ç¶÷µé¿¡°Ô ¸Å¿ì ¸¹Àº µµ¿òÀ» ¹Þ¾Ò´Ù.

</para><para>

¶Ç´Ù¸¥ ¹æ¹ýÀº ¸Å¿ì ¸Å¿ì ¸¹Àº ´º½º±×·ìÁß¿¡¼­ Usenet New ¿¡ Áú¹®À» ÇÏ´Â °ÍÀÌ´Ù. ¹®Á¦´Â Áú¹®¿¡ ´ëÇÑ ´äº¯ÀÌ ¾øÀ» Á¤µµ·Î
ÀÌ°÷Àº ¸Å¿ì ¸¹Àº »ç¶÷µéÀÌ ÀÖ°í È¥¶õ½º·´´Ù.

</para><para>

¾î´À °÷¿¡ Áú¹®À» ÇÏ´øÁö Á¶¸®ÀÖ°Ô Áú¹®ÇÏ´Â °ÍÀÌ Áß¿äÇÏ´Ù ±×·¸Áö ¾ÊÀ¸¸é ¿©·¯ºÐÀÇ Áú¹®Àº ½ÅÁßÈ÷ ´Ù·ïÁöÁö ¾ÊÀ» °ÍÀÌ´Ù. ´Ü¼øÈ÷
<emphasis remap="it">snort °¡ ÀÛµ¿ÇÏÁö ¾Ê´Â´Ù</emphasis> ¶ó°í ¸»ÇÏ´Â °ÍÀº µµ¿òÀÌ µÇÁö ¾ÊÀ¸¸ç ´ë½Å ºÒÄèÇÑ ´äº¯¸¸ ´õ¿í Áõ°¡ÇÒ °ÍÀÌ´Ù.
¹°·Ð ¿îÁÁ´Ù¸é ´©±º°¡°¡ ¼³¸íÇØ ÁÙ °ÍÀÌ´Ù.

</para><para>

´ë½Å »ç¶÷µéÀÌ ¿©·¯ºÐÀ» µµ¿ï ¼ö ÀÖµµ·Ï ¾à°£Àº ¼¼ºÎÀûÀ¸·Î ¹®Á¦¸¦ ±â¼úÇØ¶ó. ¿©·¯ºÐÀÌ ¿¹»óÇÏÁö ¸øÇß´ø °÷¿¡ ¹®Á¦°¡ ÀÖÀ» ¼öµµ ÀÖ´Ù. µû¶ó¼­ 
¿©·¯ºÐÀÇ ½Ã½ºÅÛ¿¡ ´ëÇØ ´ÙÀ½ Á¤º¸¸¦ ¿­°ÅÇÏ¶ó°í Ãæ°íÇÑ´Ù.

</para><para>

<variablelist>
<varlistentry>
<term>¼ÒÇÁÆ®¿þ¾î</term>

<listitem>
<para>
<itemizedlist>

<listitem>
<para>/etc/snort/snort.conf</para>
</listitem>

<listitem>
 <para>/etc/swatch/swatch.conf (»ç¿ëÇÏ´Â °æ¿ì)</para>
</listitem>

<listitem>
 <para>
 /var/log/messages ³»¿¡¼­ ´ÜÁö ¿¬°üÀÖ´Â ¿£Æ®¸®µéÀÇ ¹ßÃé
 </para>
</listitem>

<listitem>
<para>
»ç¿ëÇÏ´Â ¸®´ª½º ¹èÆ÷ÆÇ ¶Ç´Â ¿î¿µÃ¼Á¦¿Í ¹öÀü
</para>
</listitem>

<listitem>
<para>
¿¡·¯°¡ ÀÖ´Â ¼ÒÇÁÆ®¿þ¾î (¹öÀü ³Ñ¹ö ¶Ç´Â ³¯Â¥)
</para>
</listitem>

</itemizedlist>
</para>
</listitem>
</varlistentry>
</variablelist>

</para><para>

ÀúÀÚ¿¡°Ô Á÷Á¢ÀûÀ¸·Î Áú¹®ÇÒ ¼öµµ ÀÖ´Ù. ±×·¯³ª ±â¾ïÇÏ±â ¹Ù¶õ´Ù: ÀúÀÚ´Â ÄÄÇ»ÅÍ ÀÛ¾÷¿Ü¿¡ ´Ù¸¥ ÀÏµµ ÇÏ°í ÀÖÀ¸¸ç ±×¸® ÇÑ°¡ÇÑ ÆíÀÌ ¾Æ´Ï´Ù. 
ÀúÀÚ´Â °ÅÀÇ ¾ðÁ¦³ª ÀÌ¸ÞÀÏ¿¡ ´äÀåÇÒ °ÍÀÌÁö¸¸ ¾à°£ ½Ã°£ÀÌ °É¸± ¼ö ÀÖ´Ù. ¶ÇÇÑ ÀúÀÚ´Â snort ¸ÞÀÏ¸µ ¸®½ºÆ®¿¡ °¡ÀÔÇßÀ¸¸ç µû¶ó¼­ ÀÌ¸¦ ÅëÇØ
ÀúÀÚ¿¡°Ô ¿¬¶ôÇÒ ¼ö ÀÖ´Ù.

</para>   
 </sect1>

<!-- Section1: help: END -->



<!-- Section1: faq -->

 <sect1 id="faq">
  <title>Áú¹®°ú ´äº¯</title>

   <indexterm>
    <primary>Snort-Statistics!FAQ</primary>
   </indexterm>
   <indexterm>
    <primary>Snort-Statistics!frequently asked questions</primary>
   </indexterm>

<para>
   This is just a collection of what I believe are the most common
   questions people might have. Give me more feedback and I will turn
   this section into a proper FAQ.
</para>

  <para>
   <comment>
    This part needs tweeking. As questions and answers arrive I will put them in
    here. Contributions are welcome.
   </comment>
  </para>
    
<para>
   <itemizedlist>
    <listitem>
     <para>
      Q: 
     </para>

     <para>
      A: 
     </para>
    </listitem>

   </itemizedlist>

   <emphasis>(rest deleted.)</emphasis>
  </para>

 </sect1>

<!-- Section1: faq: END -->


<!-- Section1: md5 

 <sect1 id="md5">
  <title>MD5 checksums of the RPMs</title>

   <indexterm>
    <primary>Snort-Statistics!MD5</primary>
   </indexterm>
   <indexterm>
    <primary>Snort-Statistics!checksum</primary>
   </indexterm>

  <para>
   Here you find the MD5 checksums of the RPMs I created. You can check this
   with the command
  </para>

  <para>
   <command>???</command>
  </para>
    
  <para>
   swatch-3.0.2-1.noarch.rpm ???
  </para>

  <para>
   swatch-3.0.2-1.src.rpm ???
  </para>

  <para>
   snort-1.8.1-4.i386.rpm ???
  </para>

  <para>
   snort-1.8.1-4.src.rpm ???
  </para>

 </sect1>

 Section1: md5: END -->

</article>

<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-namecase-general:t
sgml-general-insert-case:lower
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:1
sgml-indent-data:nil
sgml-parent-document:nil
sgml-exposed-tags:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
End:
-->

