427 Botnet fm qxd

www.syngress.com
234
Chapter 6 • Ourmon: Overview and Installation
427_Botnet_06.qxd 1/8/07 3:14 PM Page 234

---

■
RRDtool. RRDtool Perl libraries are needed by the Web server soft-
ware.You can get it from Tobia Oetiker’s RRDtool site
(http://oss.oetiker.ch/rrdtool).
T
IP
For FreeBSD, a port for ourmon itself exists that can be found on our
ourmon site. The Web page for the release mentioned in this book is:
http://ourmon.cat.pdx.edu/ourmon/distros/fbsd.port.27. Files found
there can be used to automatically install ourmon. The port deals with
dependency issues (barring Apache).
For Linux, see the /home/mrourmon/ubuntudep.sh shellscript in the
base ourmon directory, which uses the Debian 
getapt
utility to install
the needed dependencies. After running this script, you can go ahead
and run 
configure.pl
.
Now we can run 
configure.pl
, but first it is wise to be aware of what it will
try to do and of the questions it will ask you. In general, when it asks a ques-
tion you can go with the default ( just press Enter), but sometimes you may
want to change the answer to get things right.There are a couple of important
questions that you want to get right. If 
configure.pl
can’t find a compile-time
dependency (like libpcap) for the probe, it will complain and stop. However, it
doesn’t care if RRDtool is installed or not (you want to make sure that
RRDtool does get installed). We will, however, give you a tip below for
checking the RRDtool install. Roughly,
configure.pl 
does the following things:
1. It compiles and installs the ourmon probe in the bin directory.
2. It creates a bin/ourmon.sh script for running the probe.
3. It installs a copy of the ourmon.sh script in whatever system direc-
tory is needed so that ourmon will start at system boot time.
4. It modifies /home/mrourmon/etc/ourmon.conf with a home het-
work net/mask and also may modify the back-end graphics software
so that all the ourmon system knows the difference between home
network IP addresses and remote IP addresses.