-
Jun25
PIX Logging Architecture 2 安装教程
Posted in Linux, 964 views
-
PIX Logging Architecture 是一款开源的Cisco PIX、Cisco FWSM、Cisco ASA防火墙的日志分析工具。
PLA能方便地对日志进行统计分析、绘制图表、信息挖掘,便于管理员更清楚地了解网络状况。系统需求:
- Syslogd
- Perl (version >= 5.6.0)
--> Perl is used to run the scripts associated with PLA. - MySQL Database Server (version >= 3.23.42)
- Apache Web Server
Perl Modules
--> Perl::DBI (version >= 1.20)
--> Perl::CGI (version >= 1.19)
--> DBD::Mysql (version >= 3.0008)
--> Net::Whois::IP (version >= 0.50)
--> Date::Manip (version >= 5.44)
--> File::Tail (version >= 0.99.3)
--> GD::Graph (version >= 1.4308)
--> Socket (This should be standard in Perl)
--> POSIX (This should be standard in Perl)1、安装mysql & apache
2、安装perl modules
通过CPAN安装perl modules,亦可从CPAN下载相关modules自行编译#perl -MCPAN -e "shell"
这里会提一大堆问题,一律取默认值就可以,最后进入cpan提示符
cpan>
Install Bundle::CPAN
install Test::More
install CPAN
install DBI
install CGI
install Net::Whois::IP
install Date::Manip
install File::Tail
install GD::Graph3、建立数据库
用mysql的root用户执行pla的sql
mysql ‐u root ‐p < 'scripts/pla_database.sql'以root登录mysql
#/usr/bin/mysql ‐u root –p切换到pix库
mysql>use pix;
建立pix数据库用户并授权
mysql> GRANT ALL ON pix.* TO 'yourplauser'@'localhost' IDENTIFIED BY 'putyourpasswordhere';从PLA2网站下载最新版本的syslog_message.sql,这个会写在http://www.logging-architecture.net/pla2/release/supportedmessages.html.
将syslog_message导入mysql
# mysql -u root -p < syslog_message-YYYYMMDD.sql.txt
4、安装Parsing脚本
将scripts/parsing目录下的pla_parsed脚本copy到/usr/sbin
将scrpits/parsing目录下的rc.pla_parsed脚本copy到/etc/init.d
加可执行属性
#chmod +x /usr/sbin/pla_parsed
#chmod +x /etc/init.d/rc.pla_parsed
配置开机启动
#ln -s /etc/init.d/rc.pla_parsed /etc/rc3.d/S99pla_parsed
5、配置Syslog
编辑/etc/syslog.conf
添加 local6.* /var/log/pix.log
这里指定通过local6来接收日志,将日志写入pix.log中UNIX和CISCO的logging facility对比
Unix Logging Facility / Cisco Logging Facility
local0 16
local1 17
local2 18
local3 19
local4 20
local5 21
local6 22
local7 23这里我们用到local6,在配PIX时,就需要指定Facility为22
重启syslog
#/sbin/service syslogd stop
#syslogd -m -0 -r
注意,现在必须以-r参数启动,来指定开启远程监听,否则syslog不会接收来自防火墙的日志6、配置Pix防火墙
登录防 火墙,进入config模式
pix(config)# logging on
pix(config)# logging timestamp
pix(config)# logging trap debugging
pix(config)# logging facility 22 (与上一步指定的local6匹配)
pix(config)# logging host inside <logging host>(这里指定接收日志的syslog服务器ip)pix(config)# ip audit name info info action alarm
pix(config)# ip audit name attack attack action alarm drop reset
pix(config)# ip audit interface outside info
pix(config)# ip audit interface outside attack
pix(config)# ip audit info action alarm
pix(config)# ip audit attack action drop6、配置Apache
将PLA2的frontend目录复制到apache发布目录
# mkdir -p /usr/local/apache2/htdocs/pla2
#cp -R pla_v2.00b1/scripts/frontend/* /usr/local/apache2/htdocs/pla2
设定pla2目录的CGI执行属性和pla2/images的普通目录属性
# Define Executable Scripts directory for "/usr/local/apache2/htdocs/pla2" and subsequent lower level directories.
<Directory /usr/local/apache2/htdocs/pla2>
Options ExecCGI
SetHandler cgi-script
</Directory># Exclude "/usr/local/apache2/htdocs/pla2" from being an Executable Scripts Directory.
<Directory /usr/local/apache2/htdocs/pla2/images>
Options MultiViews -ExecCGI
SetHandler default-handler
</Directory>这里需要注意的是,官方文档中这一段有错误,将2个Directory都写成/htdocs/pla2,这将导致第一个目录设定被覆盖,pla2变成普通无CGI权限的目录,需要将第二个Directory更正为pla2/images
#vi pla2/conf.pl
填写mysql相关信息7、配置Parsing守护脚本
#vi /usr/sbin/pla_parsed
填写mysql设定段,主机、端口、pix库用户名、密码、pix数据库名、pix日志路径(在/etc/syslog.conf中指定的)至此,PAL2就配置完成了,运行
#/etc/init.d/rc.pla_parsed start 启动守护进程
浏览 http://127.0.0.1/pla2/pix_traffic_logs 查看防火墙解析日志Blogged with the Flock BrowserTags: PIXLogging Architecture, pla2, pix, syslog
Related posts:

Leave a comment | Trackback 这篇文章还没有评论.