quinta-feira, 31 de maio de 2012

SURICATA


"Suricata is a multi-threaded intrusion detection/prevention engine."

Build Requirements:
gcc
make
g++

Library Requirements:
libpcre
libnet 1.1.x
libyaml
libpcap
libnetfilter-queue and libfnetlink (optional for use with
./configure --enable-nfq)
libpthread  (should be part of most glibc's)
libpfring >= 4.0   (optional for use with ./configure --enable-pfring see INSTALL.PF_RING for install instructions)
libcap-ng (used for dropping privileges *linux only)
libz
htp

Installing:
wget http://www.openinfosecfoundation.org/download/suricata-1.2.1.tar.gztar -zxvf suricata-1.2.1.tar.gz
cd suricata-1.2.1/
cat doc/INSTALL | more
./configure
mkdir /var/log/suricata/
make
make install

Source:
https://redmine.openinfosecfoundation.org/projects/suricata

OSSEC

Maybe the best HIDS.

Installing:
wget http://www.ossec.net/files/ossec-hids-2.6.tar.gz
wget http://www.ossec.net/files/ossec-hids-2.6_checksum.txt
md5sum ossec-hids-2.6.tar.gz
sha1sum ossec-hids-2.6.tar.gz
tar -zxvf ossec-hids-2.6.tar.gz
cd ossec-hids-2.6/
cat INSTALL | more
cat install.sh | more
./install.sh
/var/ossec/bin/ossec-control start

Source:
http://www.ossec.net/main/about