Ubuntu server 24 (Linux) Snort3 3.2.1.0 Guardian IPtables 联动实战主动防御系统(ids+ips)

tonyhi6

于 2024-05-31 20:45:11 发布

阅读量1.1k

点赞数 25

分类专栏：交换路由安全文章标签： linux Guardian iptables snort ips Ubuntu ids联动

本文链接：https://blog.csdn.net/tonyhi6/article/details/139301056

版权

一 Snort3 安装配置，参考:Ubuntu server 24 安装配置 snort3 3.2.1.0 网络入侵检测防御系统配置注册规则集-CSDN博客

二安装主动防御程序Guardian

1 下载，解压

tar zxvf guardian-1.7.tar.gz
cd  guardian-1.7/

2 配置

#拷贝文件
sudo cp guardian.pl /usr/local/bin/
sudo cp scripts/iptables_block.sh /usr/local/bin/guardian_block.sh
sudo cp scripts/iptables_unblock.sh  /usr/local/bin/guardian_unblock.sh
sudo  touch /var/log/snort/guardian.log
sudo touch /usr/local/snort/etc/snort/guardian.ignore
sudo touch /usr/local/snort/etc/snort/guardian.target
sudo cp guardian.conf  /usr/local/snort/etc/snort/
#修改配置文件
sudo vim /usr/local/snort/etc/snort/guardian.conf
Interface       ens