BASE Installation - White paper network ids and ips deployment Strategies Nicholas Pappas

© SANS Institute 200
8
,
Author retains full rights.
© SANS Institute 200
8
, Author retains full rights.
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Network IDS & IPS Deployment Strategies
Create your server key:
openssl genrsa -out /etc/ssl/private/server.key 1024
Next create a signing request:
openssl req -new -key /etc/ssl/private/server.key -out /etc/ssl/private/server.csr
You will be prompted to answer some questions on this step.
Now generate a self-
signed certificate:
openssl x509 -req -days 365 -in /etc/ssl/private/server.csr \
-signkey /etc/ssl/private/server.key -out /etc/ssl/server.crt
If you would like to reboot again, you can then test the SSL functionality with
opening the following url up with a browser on the trusted network.
https://
The result should show Apache's garden variety "It Worked" page. Now remove test
web content from your filesystem (you don't need it).
rm -r /var/www/htdocs/*
Installed required packages from OpenBSD's ports. NOTE: Some of these may have
been installed by steps noted above. Even if they have been installed, it doesn't hurt
to (re)build each of these packages as shown below.
cd /usr/ports/databases/p5-DBI
make install
cd /usr/ports/databases/p5-DBD-mysql
make install
cd /usr/ports/print/freetype
make install
cd /usr/ports/devel/gettext
make install
Nicholas Pappas
56
@ 2021 SANS Institute
Author Retains Full Rights
© SANS Institute 200
8
,
Author retains full rights.
© SANS Institute 200
8
, Author retains full rights.
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Network IDS & IPS Deployment Strategies
pear install --alldeps channel://pear.php.net/Numbers_Words-0.15.0
pear install --alldeps channel://pear.php.net/Image_Graph-0.7.2
cp -r /var/www/pear/Image /var/www/pear/lib/Image/
Install ADODB
cd /var/www/htdocs/
wget http://superb-east.dl.sourceforge.net/sourceforge/adodb/adodb495a.tgz
tar -xvzf adodb495a.tgz
rm adodb495a.tgz
Install JPGraph
cd /var/www/htdocs/
wget http://hem.bredband.net/jpgraph/jpgraph-1.22.tar.gz
tar -xvzf jpgraph-1.22.tar.gz
rm jpgraph-1.22.tar.gz
mkdir /var/www/tmp
chown -R www /var/www/tmp
Now is a good time to restart httpd
/usr/sbin/apachectl stop
/usr/sbin/apachectl startssl
Now create the ACID database so that barnyard starts up successfully. From the
trusted network, you need to open the link shown below.
Open a browser and go to
https://
/base/base_db_setup.php
Then click the button labeled "Create BASE AG" in the "Status" column. Now create a
user by going to the web interface and clicking on "Administration" and then click
"Create a user". After filling in the dialog boxes, choose the appropriate role and
click "Submit Query". Now make one last modification to the file at
/var/www/htdocs/base/base_conf.php and change the following from:
Nicholas Pappas
59
@ 2021 SANS Institute
Author Retains Full Rights
© SANS Institute 200
8
,
Author retains full rights.
© SANS Institute 200
8
, Author retains full rights.
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
Network IDS & IPS Deployment Strategies
$Use_Auth_System = 0;
to
$Use_Auth_System = 1;
This simple step enables some very basic authentication and provides yet another
layer for the bad guys to go through if they want to help monitor your traffic.