Requirements
============

You will need root to install this package.

IPAUDIT was developed on i686 system running Red Hat 6.2.  You can 
probably install it ok on any any Red Hat 6.x.  Make sure you have the
following packages installed (exact versions are for 6.2, any version
will probably be fine)

   apache-1.3.9-4
   gnuplot-3.7.0.1-4
   libpcap-0.4-16

and gcc installed.  



Basic Installation
==================

There must be many ways to install IPAUDIT, but this is what
I'm familiar with.



As root ...

(1)  Make a user called  ipaudit  with home directory /home/ipaudit

         adduser ipaudit

(2)  Add a directory under you web server's cgi-bin directory and make
     it owned by ipaudit.
         
         mkdir /home/httpd/cgi-bin/ipaudit
         chown ipaudit.ipaudit /home/httpd/cgi-bin/ipaudit

     NOTE:  You can choose another directory instead of 
            /home/httpd/cgi-bin/ipaudit, but set the
            variable CGI_BIN in the ipaudit.cfg to reflect
            the URL of that directory.  And don't forget
            to alter steps (3) and (7) below accordingly.

(3)  Edit the apache configuration file   

        vi /etc/httpd/conf/httpd.conf

     and add the following clause
       
       <Directory "/home/httpd/cgi-bin/ipaudit">
           AllowOverride AuthConfig
           Options ExecCGI
       </Directory>

(4)  Restart the web server

        /etc/rc.d/init.d/httpd restart



Then as the ipaudit user ...

(5)  From the ipaudit home directory untar the archive and move
     everything from /home/ipaudit/ipaudit-0.93b1 to /home/ipaudit

         cd
         tar xzf ipaudit-0.93b1.tgz
         cd  ipaudit-0.93b1
         mv * ..

(6)  From the ipaudit home directory compile ipaudit and other 
     programs (total, ipstrings)

         cd
         make 


(7)  In the /home/httpd/cgi-bin/ipaudit/ directory, untar the file, 
     make sure the the files are executable and owned by ipaudit
 

         cd /home/httpd/cgi-bin/ipaudit
         tar xzf /home/ipaudit/ipaudit-reports-cgi.tgz
         chmod ugo+x *
         chown ipaudit.ipaudit *

(8)  To make your ipaudit web page readable, make sure
     you make the /home/ipaudit directory world readable,executable:

         chmod ugo+rx /home/ipaudit

(9)  Edit the file ~/ipaudit.cfg.  Follow the instructions
     in the file.


As root again ..

(10)  Make ipaudit suid root
         chown root    /home/ipaudit/bin/ipaudit
         chgrp ipaudit /home/ipaudit/bin/ipaudit
         chmod 4750    /home/ipaudit/bin/ipaudit

As ipaudit again ..

(11)  As ipaudit, run cron command

        crontab /home/ipaudit/cron/crontab.install



That should do it.  You should now be able to open your
browser at
   
   http:(your-machine-address)/~ipaudit

and see ipaudit-reports front page.  It will take about
an hour before reports become created, and graphs
start to show data.



Security - Securing cgi-scripts with passwords using Apache
===========================================================

If you want to restrict who can see your reports, you can
use Apache's password system as follows.

As root ...

(1)  Create a file  /home/httpd/cgi-bin/ipaudit/.htaccess 
     with the following content:

         AuthType Basic
         AuthName IPAUDIT
         AuthUserFile /home/httpd/passwd
         require user   myself friend boss

     This tells Apache to only let users 'myself', 'myfriend'
     and 'myboss' to run the ipaudit-report scripts.  You can
     place the encrypted passwords for these users using the
     command

         htpasswd -c /home/httpd/passwd myself
         htpasswd    /home/httpd/passwd friend
         htpasswd    /home/httpd/passwd boss

     The htpasswd command (which comes with Apache) will
     prompt you for the users passwords and store the
     encrypted version in the file /home/httpd/passwd.



Recommendations
===============
If you save raw pcap data files (controlled by the 
PORT_LIST option in the ipaudit.cfg file - the default 
is not to save raw data) you may want the following 
programs to help read them.  The package

    tcpdump-3.4-19

and the program ethereal from http://www.zing.org.  But
remember that  ipstrings  included with ipaudit can
also read these files.  See the man page.

You might also want to install the xntpd package
to insure that your machine has the correct time.

You might find the included program 'total' useful
for performing some simple queries on ipaudit's output 
files.  See the total man page.
