网络攻防实验五

甘肃政法学院本科生实验报告（五）姓名:米小莉学院:计算机科学学院专业:计算机科学与技术班级:09计本班实验课程名称:网络攻击与防御技术实验日期:2012 年 6月 14日指导教师及职称:武光利实验成绩:开课时间：2011-2012学年第二学期甘肃政法学院实验管理中心印制2.AppServ（1）安装AppServ启动AppServ安装文件后，出现如图所示的设置服务器信息界面：在Server Name中输入域名localhost：Administrator's Email Address 中输入邮箱地址：694046703@ 监听端口设为8080点击next，进入下一界面：在出现的界面中输入密码（123）："Character Sets and Collations"选择"GB 2312Simplified Chinese",下图所示：然后单击"Install",进入安装过程，出现下图：安装完成后将C:\Appserv\php5目录下的php.ini-dist 文件改名为php.Ini，并启动Apache和MySql。

（控制面板—管理—服务确保Apache和MySql已启动）安装完成后可以查看（MySQL启动如下图）在浏览器中输入http://localhost :8080 出现：表示安装成功！（2）测试AppServ首先查看"控制面板"/"管理"/"服务",确保Apache和MySQL已经启动，然后，在浏览器中输入http://localhost :8080/phpinfo.php,（下图）可以了解php的一些信息。

最后打开浏览器，输入http://localhost :8080/phpMyAdmin/index.php,下图）输入用户名root和密码，可以浏览数据库内容（3）配置AppServ第一步，编辑Apache服务器配置文件。

打开Apache2.2\conf文件中的httpd.conf,检查相应的一些值进入Apache服务器配置文件需要检查一下一些值：LoadModule php5_module C:/AppServ\php5\php5apache2_2.dll# ServerName gives the name and port that the server uses to identify itself.# This can often be determined automatically, but we recommend you specify# it explicitly to prevent problems during startup.# If your host doesn't have a registered DNS name, enter its IP address here.ServerName localhost:8080# DocumentRoot: The directory out of which you will serve your# documents. By default, all requests are taken from this directory, but# symbolic links and aliases may be used to point to other locations.DocumentRoot "C:/AppServ/www"第二步，编辑phpMyAdmin中的关键文件。

打开C:\AppServ\www\phpMyAdmin\libraries目录下的config.default.php文件设置phpMyadmin的URL，$cfg['PmaAbsoluteUri'] = 'http://localhost:8080/phpmyadmin/'$cfg['blowfish_secret'] = '123'$cfg['DefaultLang'] = 'zh-gb2312'$cfg['DefaultCharset'] = 'gb2312'$cfg['Servers'][$i]['auth_type'] = 'cookie'第三步，为安全起见，还必须删除Mysql安装后默认的any@%、any@localhost和root@%帐号。

delete from db where user='' and host='%'delete from tables_priv where user='' and host='%'delete from columns_priv where user='' and host='%'delete from user where user='' and host='localhost'delete from db where user='' and host='localhost'delete from tables_priv where user='' and host='localhost'delete from columns_priv where user='' and host='localhost'delete from user where user='root' and host='%'delete from db where user='root' and 'host'='%'delete from tables_priv where user='root' and host='%'delete from columns_priv where user='root' and 'host'='%'注意，上面的''是两个单引号而不是一个双引号。

这样只允许root从localhost连接。

第四步，配置php.ini。

打开C:\WINDOWS|php.ini文件。

修改后的值如下图：第五步，对Mysql进行修改。

首先需要建立Snort运行必需的Snort 库和Snort_archive库：修改前修改后错误是因为没有启动mysql,,第二次是因为）；被#，屏蔽了，修改后如下图：程序第一次运行就生成了event表和schema表，需要删除错误的表后才能重新创建表。

经过多次排错，终于运行成功：第六步，使用C:\Snort\schemas目录下的create_MySQL脚本建立Snort运行必需的数据表。

在此，可以通过MySQL提示符下运行SQL语句show tables来检验配置的正确性其中c:\Snort为Snort的安装目录，打开命令提示符，运行以下命令：mysql -D Snort -u root -p < c:\Snort\schemas\create_mysqlmysql -D Snort_archive -u root -p < c:\Snort\schemas\create_Mysql每次提示输入root的密码，输入密码即可建立所需要的表。

通过MySQL提示符下运行SQL语句show tables来检验配置的正确性第七步，必须在Appache服务器主机上建立ACID和Snort用户，并且设置权限和密码（主要是根据课本步骤修改代码）代码：mysql> grant usage on *.* to "acid"@"localhost" identified by "acidtest"; mysql> grant usage on *.* to "snort"@"localhost" identified by "snorttest"; mysql> grant select,insert,update,delete,create on *.* to "snort"@"localhost" id entified by "snorttest";mysql> grant select,insert,update,delete,create,alter on snort. * to "acid"@"loc alhost";mysql> grant select,insert on snort. * to "snort"@"localhost";mysql> grant select,insert,update,delete,create,alter on snort_archive. * to "a cid"@"localhost";mysql> set password for "snort"@"locahost"=password('123');mysql> set password for "acid"@"locahost"=password('123');在Appache服务器主机上建立ACID和Snort用户设置权限和密码设置结果如图所示：（3）、安装Adodb,jpGraph和ACID移动文件adodb jpgraph acid 得到：Adodb生成目录：C:\AppServ\php5\adodb jpgraph生成目录：C:\AppServ\php5\jpgraphacid 生成目录：C:\AppServ\www\acid修改C:\AppServ\www\acid中的acid-conf.php文件$DBlib_path = "C:\AppServ\php5\adodb";$alert_dbname = "snort";$alert_host = "localhost";$alert_port = "3306";$alert_user = "acid";$alert_password = "123";$archive_dbname = "snort_archive";$archive_host = "localhost";$archive_port = "";$archive_user = "acid";$archive_password = "123";$ChartLib_path = "C:\AppServ\php5\jpggraph\src";打开acid_conf.php文件修改并保存，结果如下图：在mysql命令端输入如下命令并回车，出现如下所示，表明运行成功：最后在浏览器中输入http://localhost :8080/acid/acid-db-setup.php 出现如下界面：说明安装成功（4）、配置snort修改C：\snort\etc\snort.conf 主要改绝对路径：修改前修改后然后还需要修改引用路径：dynamicpreprocessor directory C:/snort/lib/snort_dynamicpreprocessor/dynamicengine C:/snort/lib/snort_dynamicengine/libsf_engine.dll设置snort 输出alert 到mysql server1>把“# var HOME_NET 10.1.1.0/24”改成“var HOME_NET 192.168.0.4/24”你自己LAN内的地址，把前面的#号去掉。