Installation

Monitor Intrusion Detection and Administration System

Requirements - Lists the requirements needed by MIDAS to function properly
Installing MIDAS - Installation steps for installing the MIDAS Daemons/Services
Upgrading - Shows the steps to upgrade from previous versions of MIDAS to current

Requirements

NOTE: All compiled applications require GCC and stdlibs

MIDASa

MySQL Library (http://www.mysql.com)

MIDASb

None

MIDASc

None

MIDASd

MySQL Library (http://www.mysql.com)

MIDASn

LibPCap (http://www.tcpdump.org) *Tested with v0.8.1

MIDASs

Snort (http://www.snort.org) *Tested with 1.9.0

WebView

Apache (http://www.apache.org)

PHP v4.1 or higher (http://www.php.net) with support for:

MySQL (http://www.mysql.com)

GD with PNG support (http://www.boutell.com/gd) (http://www.libpng.org/pub/png) (http://www.gzip.org/zlib)

Installing MIDAS

NOTE: Please make sure you have the Requirements needed for each service you plan to run.

Compiling the MIDAS Applications:

The compile procedure is pretty straight forward. Simply run the configure script located in the root dist path (ie /usr/src/MIDAS2/configure in our example).

NOTE: If you MySQL Lib path is not in a standard location, you may need to add the argument --with-mysql=<path/to/mysql/libs>. Also, if the host you are installing MIDAS on is to be the Web Interface server, add the argument --with-web=<path/to/web/folder> to copy the interface files to the path specified.

After doing the above you can either just do a 'make' or a make on a specific application (ie. 'make MIDASc' or 'make MIDASd' etc.). All should compile straight out of the box.

Installing the Applications

Simply do a 'make install' in the MIDAS source directory. It will then create the installation directory tree under /usr/local/MIDAS. It will then copy the executables under /usr/local/MIDAS/bin and copy the distribution config files into the /usr/local/MIDAS/etc directory.

MIDAScNT Installation

Download the MIDAScNT from here and run the EXE file. At the end of the installation, there will be a README explaining how to configure and use the MIDAScNT program.

RPM Based Installation

RPM Installation is pretty straight forward, but things to know:

1) The MIDAS-server RPM will install MIDASa, MIDASb and MIDASd. Also with this installation will be the SQL files needed for the MIDAS database creation/update.
2) The MIDAS-client RPM will install MIDASc, MIDASn and MIDASs.
3) The MIDAS-webview will install the WebView files and the SQL files needed for the MIDAS database creation/update.

NOTE: It is not a mistake on having the SQL files in two (2) different RPM installs. We wanted to make sure the two (2) installations that required the database had the SQL files. This just makes it easier if someone wants WebView and the database on one server and the MIDAS server Applications on another, or visa-versa.

Also the RPM installs are still pretty new to MIDAS, so if you have any problems installing them, please let us know, and we will work to get those problems corrected. Thanks you...

WebView Installation

We will assume that the apache IP address is 192.168.1.80 on default port 80, and that you installed the WebView interface in the directory MIDAS off of your htdocs directory. You will need to change this to reflect your own setup.

To access the installation web interface use the URL : http://192.168.1.80/MIDAS/install/install.php. (See Figure 2.1)

Figure 2.1 - WebView Installer Screen

Site Configuration Sanity Checks:

Site Config Exists - Verifies that there is not already a config.php file located in $MIDAS_WEBVIEW_DIR$/inc/config. If there is, it will verify that file is writable.

WARNING: config.php exists, but is writable

ERROR: config.php is not writeable, or the directory does not exist.

Site Config Template Exists - Verifies that the config.template file exists in $MIDAS_WEBVIEW_DIR$/inc/config.

ERROR: config.template does not exist

/inc/config directory is Writable - Verifies that the $MIDAS_WEBVIEW_DIR$/inc/config directory can be written to.

ERROR: directory does not exist or is not writable

/php-graph directory is Writable - Verifies that the $MIDAS_WEBVIEW_DIR$/php-graph directory is writable.

ERROR: directory does not exist or is not writable

PHP with MySQL Support - Verifies that PHP has MySQL support.

ERROR: PHP is not compiled with MySQL support.

PHP with GD+PNG Support - Verifies that PHP has GD with PNG support.

WARNING: PHP is not compiled with GD+PNG support. Without this support WebView will be unable to create Graphing Stats Images.

NOTE: If any of the sanity checks come back as an ERROR, you will have to fix the problem before continuing.

Site Configuration:

Absolute directory - The absolute directory to the WebView interface files. (In our example, this would be /MIDAS
URL Directory - The document root of your WebView interface (In our example, this would be /MIDAS)
PHP Graphics URL - Relative location to the php-graph directory. (Already set)
MySQL Server - Hostname/IP address of your mySQL server to use for WebView.
MySQL user - User to use for the initial setup.
MySQL passwd - Initial User's password.
MIDAS MySQL allowed hosts - This is a comma separated list of hosts allowed to connect to the MySQL service using the new MIDAS MySQL User.
MIDAS MySQL user - User to create and use for MIDAS WebView.
MIDAS MySQL passwd - Password to use for new MySQL User.
MIDAS dB SQL file - Location of the MIDAS sql file (This file is normally found in the sql/ directory off of the MIDAS source directory).
SNORT Default Rules SQL file - Location of the Default SNORT sql file (This file is normally found in the sql/ directory off of the MIDAS source directory).
Create inc/config/config.php - Creates the site config file for WebView (Includes path information, sql user & password, etc).
Create MIDAS dB user - Creates the user WebView will use in accessing the MySQL Server
Install MIDAS SQL - Process the MIDAS dB SQL file on the mySQL Server listed above (Warning: If you currently have data in your MIDAS database, please back it up before continuing).
Install SNORT Default Rules SQL file - Sames as above, except this option uses the SNORT Default Rules listed above.

NOTE:Please be advised that all of the data in this form will be sent to the webserver in cleartext (This includes any/all passwords).

Once you have filled in the form, click on 'INSTALL' and watch for FAILED Items (See Figures 2.2).

Figure 2.2 - Install Completed Successfully

Once this is complete you should be able to access the MIDAS web interface by using the URL on the Install Completed screen or by going to: http://192.168.1.80/MIDAS.

Accessing and Configuring the WebView interface can be found here.

Upgrading

PLEASE NOTE: MySQL v3.x.x support was removed from v2.2a through 2.2d but is now supported again in version >= v2.2e

NOTE: Before starting the upgrade, you will want to backup your MIDAS application directories and MIDAS database.

Compiling the MIDAS Applications:

Please follow the steps located under Installing MIDAS - Compiling the MIDAS Applications

Installing the Applications

Please follow the steps located under Installing MIDAS - Installing the Applications MIDASn.cf CONFIG.MAIN.SESSIONS and MIDASa.cf CONFIG.TMPEXTERN

Host Check Options (From 2.2e to 2.2f)

SNMP.FORMAT

used to specify how the result should be formated. Currently supports TIMETICKS and BYTES. TIMETICKS is used for Uptime style counters and BYTES is used for formating results into Byte strings (ie 12345 -> 12.30KB).

SNMP.TYPE

Now supports COUNTER32 objects

Application configuration changes (From 2.2d to 2.2e)

MIDASa

CONFIG.TMPEXTERN - Specifies the file/path for the temp file used in the external alert

MIDASn

CONFIG.MAIN.SESSIONS - Specifies the expire time (in days) for Network sessions

Application configuration changes (From 2.1a to 2.2a)

MIDASb

CONFIG.BBCHECK.NAME - BigBrother service name to match
CONFIG.BBCHECK.NAME.CID - MIDAS Check ID to match NAME to

MIDASc

CMD.LOG - Need to add @[LOG]@ to the command (ie /usr/bin/tail -1000 @[LOG]@)

MIDASd

CONFIG.MAINT.INTERVAL - Maint Cycle interval time (in seconds)
CONFIG.MAINT.MAKEBLUE - Minutes from last status update before a check is moved to BLUE status
CONFIG.MAINT.CHECKEVENTS - Expire check event records older then X days (0 to disable)
CONFIG.MAINT.IDSEVENTS - Expire IDS event records older then X days (0 to disable)
CONFIG.MAINT.MACIP - Expire MAC/IP records that are older then X hours (0 to disable)

MIDASn

CONFIG.USER - Run MIDASn with this user (User is switched after NIC is configured)
CONFIG.PROCMISC - Toggles if MIDASn should attempt to set NIC to promiscuous mode on startup
CONFIG.SENDINTERVAL - # of seconds between sending stat updates

Host Check Options (From 2.1a to 2.2a)

Network Monitoring

Please check the WebView: Network Monitoring section for changes in the Network Monitoring Options

WebView Installation

Please follow the steps located under Installing MIDAS - WebView Installation, but with the following changes:

If you currently have a MySQL user you are using for the old interface, please make sure you do not have the installer try and create the user.
Depending on your version you are upgrading to, you will need to run the installer on each MySQL dB file to upgrade it to the new current version

Example: If your current version is v2.0f, and you are upgrading to v2.2a, you will need to run the installer using /path/to/MIDAS/source/sql/v2.0f-to-v2.0g.sql, then /path/to/MIDAS/source/sql/v2.0i-to-v2.1a.sql, and finally /path/to/MIDAS/source/sql/v2.1a-to-v2.2a.sql (During the SQL upgrade, make sure you are only running the Install MySQL SQL option).

(Skip if upgrading from a version >=2.1a) Once the v2.0i-to-v2.1a.sql runs, there will be a few things that happen to your current install:

All MIDAS users will have their passwords changed to 'password', and will be set as 'Super Users', so make sure you changes these after the upgrade has finished.

There should be no reason to have the install run the Install Default SNORT Rules file.

NOTE: If you are upgrading from a version < v2.2d you will want to have the install script rebuild the config/config.php file as well. This is needed to add support for HTTPS sessions.

last modified: Fri Mar 09 11:50 PM CST 2004