ClamAv
yum install clamav /usr/bin/freshclam nice -n 19 clamscan --exclude-dir="(/dev|/sys|/usr/share/doc/clamav-0.97/test)" -i -r /
chkrootkit
mkdir -p /backup/bin/ cp -p `which --skip-alias awk cut echo egrep find head id ls netstat ps strings sed uname` /backup/bin/ yum install chkrootkit
chkrootkit
snort
rpm -ivh http://vscojot.free.fr/dist/snort/snort-2.9.0.4/RHEL5/i386/libpcap1-1.1.1-9.el5.i386.rpm rpm -ivh http://vscojot.free.fr/dist/snort/snort-2.9.0.4/RHEL5/i386/libdnet-1.12-7.el5.i386.rpm rpm -ivh http://vscojot.free.fr/dist/snort/snort-2.9.0.4/RHEL5/i386/daq-0.5-8.el5.i386.rpm rpm -ivh http://vscojot.free.fr/dist/snort/snort-2.9.0.4/RHEL5/i386/snort-2.9.0.4-11.el5.i386.rpm rpm -ivh http://vscojot.free.fr/dist/snort/snort-2.9.0.4/RHEL5/i386/snort-mysql-2.9.0.4-11.el5.i386.rpm service snortd start
tripwire
http://sourceforge.net/projects/tripwire/files/tripwire-src/wget http://downloads.sourceforge.net/project/tripwire/tripwire-src/tripwire-2.4.2-src/tripwire-2.4.2-src.tar.bz2?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Ftripwire%2Ffiles%2Ftripwire-src%2Ftripwire-2.4.2-src%2F&ts=1303841362&use_mirror=jaist tar -jxvf tripwire-2.4.2-src.tar.bz2 cd tripwire-2.4.2-src/ ./configure vim ./install/install.cfg ------------------------------------ LOOSEDIRECTORYCHECKING =false ▼ (ファイル変更時の親ディレクトリをチェックしない) LOOSEDIRECTORYCHECKING =true ------------------------------------ make make install
install時にパスフレーズを入力するため、checkinstallでRPMの生成とかはむりっぽいです。
初期化でいくつかコマンドを・・・最後のはスペックによっては結構時間かかります。
twadmin --create-polfile -S /usr/local/etc/site.key /usr/local/etc/twpol.txt twadmin --create-cfgfile -S /usr/local/etc/site.key /usr/local/etc/twcfg.txt tripwire --init
スキャン実行・・・これも結構時間かかります。
tripwire --check
スキャン実行後、「Error Report」にファイルが見つからない旨エラーが出る場合は
「/usr/local/etc/twpol.txt」を編集して不要なパスをコメントアウトして再度初期化します。
twadmin --create-polfile -S /usr/local/etc/site.key /usr/local/etc/twpol.txt tripwire --init
蛇足 snortをソースからインスコする手順途中まで（挫折して上のRPMをさがしました）
rpmforge導入(http://rpmrepo.org/RPMforge/Using)
wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.i386.rpm rpm -ivh rpmforge-release-0.5.2-2.el5.rf.i386.rpm
ビルドツール諸々 インストール
yum --enablerepo=rpmforge install gcc gcc-c++ rpm-build checkinstall vim /usr/lib/checkinstall/checkinstallrc =============== # Comma delimited list of files/directories to be ignored EXCLUDE="/selinux" =============== vim /usr/lib/checkinstall/checkinstallrc =============== # Comma delimited list of files/directories to be ignored EXCLUDE="/selinux" ===============
snort
yum install autoconf automake flex bison wget http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz tar -zxvf libpcap-1.1.1.tar.gz cd libpcap-1.1.1 ./configure /usr/sbin/checkinstall --fstrans=no rpm -Uvh /usr/src/redhat/RPMS/i386/libpcap-1.1.1-1.i386.rpm
wget http://www.snort.org/downloads/860 tar -zxvf daq-0.5.tar.gz\?AWSAccessKeyId\=AKIAJJSHU7YNPLE5MKOQ\&Expires\=1303836479\&Signature\=y%2FsqPtdlaAmo4vnGfE618JKIEcU\= cd daq-0.5 ./configure -with-libpcap_includes=/usr/local/include -with-libpcap_libraries=/usr/local/lib /usr/sbin/checkinstall --fstrans=no rpm -Uvh /usr/src/redhat/RPMS/i386/daq-0.5-1.i386.rpm yum install pcre-devel libdnet-devel mysql-devel wget http://www.snort.org/downloads/867 tar -zxvf snort-2.9.0.5.tar.gz\?AWSAccessKeyId\=AKIAJJSHU7YNPLE5MKOQ\&Expires\=1303837814\&Signature\=6uJfY+ZLlfvwAj5zUmY0OvbIZ9Y\= cd snort-2.9.0.5 ./configure --with-mysql=yes /usr/sbin/checkinstall --fstrans=no rpm -Uvh /usr/src/redhat/RPMS/i386/snort-2.9.0.5-1.i386.rpm /usr/sbin/groupadd snort /usr/sbin/useradd -g snort -s /bin/false snort mkdir /var/log/snort chown snort:snort /var/log/snort # rules mkdir /etc/snort
参考リンク: http://www.geocities.jp/gronlijus/skill/linux/centos5-tripwire.html
