Cfxtrjtrk

I am a newbie to Linux environment. I am trying to install snort on my Ubuntu machine, while I am installing it, it often gets stuck in middle and says: libnet, zlib, daq are not found. So I tried to download these packages. Then I started installing snort again and this time is saying that pcre is not found. In windows if I install some software it will ask these package are needed to install and it will download that to perform the installation. Likewise is there any commands or something else to know what files are needed before the installation starts.

Snort is a signature based intrusion detection system, it either drops or accepts the packets coming on a certain interface depending on the rules you have used. Follow the below steps to install it properly:

Section - I: Preparing your System

Before actually installing Snort, run these commands to install all the required pre-requisites:

sudo apt-get update

sudo apt-get dist-upgrade

• Reboot your system after running the above commands



• 
  

  Open the command-line interface again and run these commands:

  
  
  

  sudo apt-get install build-essential
  
  sudo apt-get install -y libpcap-dev libpcre3-dev libdumbnet-dev
  
  sudo apt-get install -y zlib1g-dev liblzma-dev openssl libssl-dev
  
  sudo apt-get bison flex
  
  

  
  



• Now your system is ready to install Snort

Section - II: Installing Daq

Snort requires "Daq" to run. You can create a separate folder for all your downloads mkdir ~/snort. It will keep all your downloads in one place. Download and Extract "Daq" using the commands:

cd ~/snort

wget https://www.snort.org/downloads/snort/daq-2.0.6.tar.gz

tar -xvzf daq-2.0.6.tar.gz

cd daq-2.0.6

./configure

make

sudo make install

• Above commands will download the "daq" source code and then install it properly.

Section - III: Installing Snort

You are now ready to download the Snort source code. Run the following commands:

cd ~/snort

wget https://www.snort.org/downloads/snort/snort-2.9.8.3.tar.gz

tar -xvzf snort-2.9.8.3.tar.gz

cd snort-2.9.8.3

./configure

make

sudo make install

sudo ldconfig

sudo ln -s /usr/local/bin/snort /usr/sbin/snort

Snort is now installed on your system, but you will still have to configure it properly to use it. Run the snort -V command to ensure Snort is properly installed on your system.

Section - IV: Creating some required Directories

"Snort" need some folder and files to place its logs, errors and rules files. If you are good with bash script, create it, or else run these commands at once or you can just execute them one by one:

sudo groupadd snort

sudo useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort



sudo mkdir /etc/snort

sudo mkdir /etc/snort/rules

sudo mkdir /etc/snort/rules/iplists

sudo mkdir /etc/snort/preproc_rules

sudo mkdir /usr/local/lib/snort_dynamicrules

sudo mkdir /etc/snort/so_rules





sudo touch /etc/snort/rules/iplists/black_list.rules

sudo touch /etc/snort/rules/iplists/white_list.rules

sudo touch /etc/snort/rules/local.rules

sudo touch /etc/snort/sid-msg.map



sudo mkdir /var/log/snort

sudo mkdir /var/log/snort/archived_logs





sudo chmod -R 5775 /etc/snort

sudo chmod -R 5775 /var/log/snort

sudo chmod -R 5775 /var/log/snort/archived_logs

sudo chmod -R 5775 /etc/snort/so_rules

sudo chmod -R 5775 /usr/local/lib/snort_dynamicrules





sudo chown -R snort:snort /etc/snort 

sudo chown -R snort:snort /var/log/snort 

sudo chown -R snort:snort /usr/local/lib/snort_dynamicrules



cd ~/snort/snort-2.9.8.3/etc/ 

sudo cp *.conf* /etc/snort 

sudo cp *.map /etc/snort 

sudo cp *.dtd /etc/snort 

cd ~/snort/snort-2.9.8.3/src/dynamic-preprocessors/build/usr/local/lib/snort_dynamicpreprocessor/ 

sudo cp * /usr/local/lib/snort_dynamicpreprocessor/

CAUTION: Please do not ignore these commands.

Section - VI: Editing Snort configuration files

We also need to modify some configuration files to run Snort in network intrusion detection mode. For this, we would need to comment out all the rules in snort configuration file. Here's the command:

sudo sed -i "s/include $RULE_PATH/#include $RULE_PATH/" /etc/snort/snort.conf

Once you have commented out all the rules, it is time to test Run the Snort.

Section - VII: Testing Snort

To make sure that Snort is running in network intrusion detection mode, we need to insert a rule in our Rules file. So, open it and run the following rule:

alert ip any any -> any any (msg:"ATTACK RESPONSES id check returned root"; content: "uid=0(root)"; classtype:bad-unknown;

sid:498; rev:3;)

• Now run Snort using: sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i ens3
  

Note: It will start listening on interface ens3, so, make sure you replace it with your interface name. After running Snort, open another SSH Connection to the server and run this command: ping -b 255.255.255.255 -p "7569643d3028726f6f74290a" -c3

You should now be able to see alerts on SSH where you have started Snort.