BASE Installation on Ubuntu

About

BASE is php frontend application for Snort. BASE let you check and analyze your Snort events and alerts from a web browser.

 

Prerequisite

• Snort installation
• Barnyard installation

 

Install BASE

• Install apache php and prerequisite packages

apt-get install apache2 libapache2-mod-php5 php5 php5-mysql php5-common php5-gd php5-cli php-pear unzip -y

• Install pear Image_Graph

pear install -f Image_Graph

• Download ADODB

cd /usr/local/src/snort wget http://sourceforge.net/projects/adodb/files/adodb-php5-only/adodb-514-for-php5/adodb514.zip cd /var/ unzip /usr/local/src/snort/adodb514.zip mv adodb5 adodb

• Download and extract BASE

cd /usr/local/src/snort wget http://sourceforge.net/projects/secureideas/files/BASE/base-1.4.5/base-1.4.5.tar.gz cd /var/www/ tar zxvf /usr/local/src/snort/base-1.4.5.tar.gz mv base-1.4.5 base

• Configure BASE

cd /var/www/base cp base_conf.php.dist base_conf.php vi base_conf.php

....
$BASE_urlpath = '/base';
...
$DBlib_path = '/var/adodb/';
...
$alert_dbname   = 'snort';
$alert_host     = 'localhost';
$alert_port     = '';
$alert_user     = 'snort'; 
$alert_password = 'snort';
...

• Set permissions on base directory

chown -R www-data:www-data /var/www/base

• Restart apache

service apache2 restart

• Browse to snort_ip_address/base/index.php and click on “setup page” link
• Click on “Create BASE AG” button on the upper right of the page
• Click on the “Main page” line

Thats all. Now you can work with your new BASE system to analyze Snort data.

Please visit http://www.snort.org/ for more information about Snort configuration and usage