untitled

Size: px

Start display at page:

Download "untitled"

てるえじゅふく
5 years ago
Views:

2 POSTGRESQL POSTGRESQL DB UNIX POSTGRESQL DB WINDOWS XML XINDICE (NATIVE XML DATABASE) XINDICE CONFIG/DB.PROPERTIES JAMES (JAVA APACHE MAIL ENTERPRISE SERVER)... 14

3 SQL XML TCPDUMP Authoring APs Packet aggregator Perl JAVA as_pasth_d AS/Country analyzer IODEF Perl Alert aggregator IODEF sender AlertReceiver SNORT PostgreSQL IODEF receiver Apache James Aapche Xindice DB manager Analyzer AS map JFreeChart DB manager AP and Analyzer AP 1 JAVA Apache James Apache Xindice JFreeChart Cyber Solutions Inc., All rights reserved 1

4 PostgreSQL Perl 1 SNMP SNORT Wide area tracker Perl JAVA SNORT AlertReceiver AS map IODEF/RID composer IODEF-RID GUI Perl Apache Axis RID query AS/Country analyzer as_pasth_d HTTP RID server Apache Axis Jakarta Tomcat SNMP Packet Chaser Local PacketChaser Packet Print Agent Packet Print Agent Packet Print Agent 2 JAVA Apache Axis Perl Cyber Solutions Inc., All rights reserved 2

5 Apache Axis Jakarta Tomcat 2 SNMP SNORT 1.2. x 1 (Windows XP) 1 Linux/BSD JAVA 1.5 Perl 5.6/5.8 IP::Country::Fast; (Ver. 2.20) Geography::Countries; (Ver.1.4) SNORT 2.3.3SNMP PostgreSQL 8 Apache Xindece 1.0 Apache Axis Apache James Jakarta Tomcat JFreeChart JCommon Roman API cysol_roman.jar as_path_d Cyber Solutions Inc., All rights reserved 3

7 2. PostgreSQL PostgreSQL DB PostgreSQL (BSD ) PostgreSQL /usr/local/pgsql postgres 2.1. PostgreSQL DB Unix UNIX DB (1) PostgreSQL $ cd /usr/local/pgsql "postgres" (2) DB "data/postgresql.conf" ---- "tcpip_socket = true" ---- DB "postmaster" "i" ("-i" postmaster TCP/IP ) (3) DB DB sida sida77 DB $./bin/createuser -P -E sida Enter password for user "sida": Cyber Solutions Inc., All rights reserved 5

8 Enter it again: Shall the new user be allowed to create databases? (y/n) n Shall the new user be allowed to create more new users? (y/n) n CREATE USER (4) DB DBsidaAlertDB DB $./bin/createdb -O sida -E EUC_JP sidaalertdb CREATE DATABASE NOTE: "E" UNIX PostgreSQL EUC_JP (5) "data/pg_hba.conf" $ vi./data/pg_hba.conf "sida","sidaalertdb" # TYPE DATABASE USER IP-ADDRESS IP-MASK METHOD host sidaalertdb sida md "sidaalertdb""sida" / "md5" PostgreSQL (6) DB(postmaster) Cyber Solutions Inc., All rights reserved 6

9 (7) PostgreSQL:psql DB $./bin/psql -U sida -W -h <DB Server> sidaalertdb Password: Welcome to psql 7.3.4, the PostgreSQL interactive terminal. sidaalertdb=> <DB Server>=DB IP DB(sida) SQL CREATE "tools/postgresql_sidaalerttable_create.sql" SQL $./bin/psql -U sida -W -h <DB Server> sidaalertdb < PostgreSQL_sidaAlertTable_create.sql CREATE SQL "psql" sidaalertdb SidaAlertDB=> dt List of relations Schema Name Type Owner public sidaalerttable table sida Cyber Solutions Inc., All rights reserved 7

10 2.2. PostgreSQL DB Windows Windows DB PostgreSQL8.0 pgadmin PostgreSQL DB OK PostgreSQL OK OK Sida Sida77 OK SidaAlertDB Sida EUC_JP pgadmin pg_hba.conf Pg_hba.conf PostgreSQL data/ Cyber Solutions Inc., All rights reserved 8

11 OK host SidaAlertDB Sida IP /24 md5 SidaAlertDBSida /24md5 trust pg_hba.conf PostgreSQL data/ pg_hba.conf # TYPE DATABASE USER CIDR-ADDRESS METHOD # IPv4 local connections: host all all /32 trust host SidaAlertDB Sida /24 md5 # IPv6 local connections: # host all all ::1/128 md5 PostgreSQL TCP/IP Cyber Solutions Inc., All rights reserved 9

12 pgadmin postgres.conf postgres.conf PostgreSQL data/ listen_addresses OK PostgreSQL PostgreSQL Sida OK Sida Sida77 -SidaAlertDB -tool/ PostgreSQL_sidaAlertTable_create.sql Cyber Solutions Inc., All rights reserved 10

14 3. XML XML XML 3.1. xindice (Native XML Database) xindice external/j2se v1.3 Java xindice README docs/installdocs/install.windows Windows Unix 1. xindice bin/ PATH 2. J2SE JAVA_HOME 3. xindice XINDICE_HOME XINDICE_HOME/ # XINDICE_HOME/startup # XINDICE_HOME/bin/xindiceadmin shutdown -c /db 3.2. xindice xindice XML Document Document ID Collection iodef Collection Cyber Solutions Inc., All rights reserved 12

15 xindice (Native XML Database) db Collection Document iodef IncidentID incident1 IncidentID incident2 IncidentID incident3... db Collection db /db/iodef Collection # XINDICE_HOME/bin/xindiceadmin ac -c /db -n iodef Created : /db/iodef 3.3. config/db.properties IODEF Receiver/Archiver XML DB Mailet DB HOSTIPxindice DBPORT4080DB DATABASEdb Collection COLLECTIONiodefIODEF Collection Cyber Solutions Inc., All rights reserved 13

16 3.4. James (Java Apache Mail Enterprise Server) IODEF James Mailet IODEF XML James James (1) apps/james/sar-inf/config.xml <config> <James> <servernames> <servername> DNS <dnsserver> <servers> <server> Windows XP dnsserver audodiscovery false <remotemanager> <handler> <administrator_accounts> <account> (2) James James /usr/local/iodef_center/ Windows run.bat SMTP POP Unix # /usr/local/iodef_center/bin/run.sh Using PHOENIX_HOME: /usr/local/iodef_center Using PHOENIX_TMPDIR: /usr/local/iodef_center/temp Using JAVA_HOME: /usr/local/java Running Phoenix: Phoenix James Remote Manager Service started plain:4555 POP3 Service started plain:110 Cyber Solutions Inc., All rights reserved 14

17 SMTP Service started plain:25 NNTP Service Disabled Fetch POP Disabled FetchMail Disabled (3) iodef 4555 telnet ( Remote Manager Service ) (1) root # telnet <HOST ADDRESS> 4555 Trying 1<HOST ADDRESS>... Connected to <HOST ADDRESS>. Escape character is '^]'. JAMES Remote Administration Tool Please enter your login and password Login id: Password: Welcome root. HELP for a list of commands adduser iodef iodef listusers adduser iodef iodef User iodef added listusers Existing accounts 1 Cyber Solutions Inc., All rights reserved 15

untitled

untitled 2004 1094 1.... 1 1.1. SIDA IODEF RECEIVER / ARCHIVER...1 1.2. SIDA IODEF GENERATOR...2 1.3. MANUAL AUTHORING...4 1.4. IODEF SENDER...4 1.5. IODEF RECEIVER / ARCHIVER...5 1.6. IODEF ANALYZER...9 2....