This is suited for CPanel servers, although will work for ENsim and likely any other RedHat Servers with only minor changes.
##########################################
EDITED 11/11/2003:
Replaced snort version 2.0.3 with 2.0.4
Edited line:
#### Edit line 69 to look like this: $ChartLib_path = "/var/www/html/jpgraph";
To show:
#### Edit line 69 to look like this: $ChartLib_path = "/var/www/html/jpgraph/src";
As this was an overlooked error that I did not notice because I had not attempted to graph any alerts.
Also have confirmed that this How-To will work for Ensim Webppliance 3.1.X and 3.5.X with the following requirement:
cd /usr/lib
ls -lah | grep mysql
ln -s libmysqlclient.so.10.0.0 libmysqlclient.so
##libmysqlclient.so.10.0.0 may need to be modified to match what you see in this directory as libmysqlclient.so.*##
Also no need to add the Alias /acid line to httpd.conf as /var/www/html/acid will already be reachable by the URL:
https://[server name or IP]/acid (Ensim Only)
##########################################
(Most of these lines can be pasted directly into SSH)
mkdir /root/installs
cd /root/installs
mkdir snort
cd snort/
wget http://www.snort.org/dl/snort-2.0.4.tar.gz
tar zxf snort-2.0.4.tar.gz
wget http://www.tcpdump.org/release/libpcap-0.7.2.tar.gz
tar zxf libpcap-0.7.2.tar.gz
cd libpcap-0.7.2
./configure
make
make install
cd ..
wget http://phplens.com/lens/dl/adodb390.tgz
wget http://acidlab.sourceforge.net/acid-0.9.6b23.tar.gz
wget http://flow.dl.sourceforge.net/sourceforge...ib-1.1.4.tar.gz
wget http://www.aditus.nu/jpgraph/downloads/jpg...aph-1.13.tar.gz
tar zxf acid-0.9.6b23.tar.gz
tar zxf adodb390.tgz
tar zxf zlib-1.1.4.tar.gz
tar zxf jpgraph-1.13.tar.gz
cd snort-2.0.4
./configure --with-mysql
mkdir /etc/snort
mkdir /var/log/snort
groupadd snort
useradd -g snort snort
passwd snort ## then enter password you would like to use for snort twice
make
make install
cd rules
cp * /etc/snort
cd ../etc
cp snort.conf /etc/snort
cp *.config /etc/snort
vi /etc/snort/snort.conf
#### to go to a specific line number hit [escape]:## (##= number such as 102)
#### edit line 102 to look like this: var RULE_PATH /etc/snort
#### edit line 448 to look like this:
#### output database: log, mysql, user=snort password=[your_password_for_snorts_DB_user] dbname=snort host=localhost
cd ..
cp contrib/S99snort /etc/init.d/snort
vi /etc/init.d/snort
#### edit line 11 to look like this: CONFIG=/etc/snort/snort.conf
#### edit line 17 to look like this: SNORT_GID=snort
cd /etc/init.d
chmod 755 snort
cd /etc/rc3.d
ln -s ../init.d/snort S99snort
ln -s ../init.d/snort K99snort
cd /etc/rc5.d
ln -s ../init.d/snort S99snort
ln -s ../init.d/snort K99snort
mysql -u root -p #enter password for root
#### Enter the following at the mysql> prompt:
#### create database snort;
#### grant INSERT,SELECT on root.* to snort@localhost;
#### SET PASSWORD FOR snort@localhost=PASSWORD('[your_password_for_snorts_DB_user]');
#### grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort@localhost;
#### grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort;
#### exit
cd /root/installs/snort/snort-2.0.4/
mysql -u root -p < contrib/create_mysql snort #enter password for root
zcat contrib/snortdb-extra.gz | mysql -p snort #enter password for root
mysql -u root -p #enter password for root
#### Enter the following at the mysql> prompt:
#### SHOW DATABASES; #### You should see a list of all DB's. Make sure snort is there.
#### use snort
#### SHOW TABLES; #### You should see a list of 19 tables.
#### exit
vi /etc/httpd/conf/httpd.conf
#### Add the following in below the section where "Alias"'s are listed:
Alias /acid /var/www/html/acid
AuthType Basic
AuthName "SnortIDS"
AuthUserFile /var/www/.htpasswd
Require user acid
#### Exit and save using [escape]:wq
service httpd restart
cd /root/installs/snort/
cp -Rf jpgraph-1.13 /var/www/html/jpgraph
cp -Rf acid /var/www/html/
cp -Rf adodb /var/www/html/
cd /var/www/html/acid/
vi acid_conf.php
#### Edit line 12 to look like this: $DBlib_path = "/var/www/html/adodb";
#### Edit line 32 to look like this: $alert_dbname = "snort";
#### Edit line 35 to look like this: $alert_user = "snort";
#### Edit line 36 to look like this: $alert_password = "[your_password_for_snorts_DB_user]";
#### Edit line 69 to look like this: $ChartLib_path = "/var/www/html/jpgraph/src";
/etc/rc.d/init.d/snort restart ## twice to make sure
cd ../..
htpasswd -c .htpasswd acid ## then enter password you would like to use for acid twice
Now go to the URL https://YOUR-IP-ADDRESS/acid/ (make sure you put the trailing slash)
You should be able to login with the username acid and the password you specified in the htpasswd command.
When logged in you should see:
#################
The underlying database snort@localhost appears to be incomplete/invalid.
The database version is valid, but the ACID DB structure (table: acid_ag) is not present.
Use the Setup page to configure and optimize the DB.
#################
Click on the words "Setup page" in the second line as it is a link to the page that will add the Acid tables into the snort DB.
Click on the button "Create ACID AG" to proceed with adding the needed tables.
Click on the "Home" link in the Banner at the top right of the page to proceed to the main page of your ACID console.
You should see data specified such as the amount of alerts and percentage of alerts that are from ICMP packets.
It should show a red bar if you have had any alerts so far.
You have now completed the entire basic setup of Snort with ACID Monitoring Console!
For any additional information see the following:
http://www.snort.org (SNORT home page)
http://www.internetsecurityguru.com/docume...rt_acid_rh9.pdf (PDF File used to guide me in setting this up)
