How To Install Snort On An Ubuntu 18

How to Install Snort on an
Ubuntu 18.04 VPS or

Dedicated Server
Introduction
Intrusion detection systems are software that serves to monitor the network
traffic for any suspicious activity and sends alerts or takes actions when
discovered.
With the increasing sophistication of attacks, having firewalls and network
perimeter security is not enough as we need to detect the threats before they
cause a significant impact.
Some of the intrusion detection systems like Cisco’s IDS are unfortunately too
expensive to purchase for some organizations.
Luckily Snort came to the rescue as being arguably one of the best open
source intrusion detection systems in the market, running on almost all Linux,
Unix, and Mac Os platforms.
Some of the features offered by Snort include:
 Network intrusion detection system
 Packet sniffer
 Packet logger
Prerequisites
 A VPS/Dedicated server running Ubuntu 18.04
 A non-root user with sudo privileges
Steps
Update system packages
1. $ sudo apt update && sudo apt upgrade
We will be installing a number of source files so you would want to create a
folder to hold these packages.
1. $ mkdir snort_src && cd snort_src
Install Snort dependencies

Install the snort prerequisites in the created folder
1. $ sudo sudo apt install -y build-essential autotools-dev libdumbnet-dev libluajit-5.1-dev libpcap-dev \
2. > libpcre3-dev zlib1g-dev pkg-config libhwloc-dev
Install cmake library
1. $ sudo apt install -y cmake
We will then want to install some optional but highly recommended libraries.
1. $ sudo apt install -y liblzma-dev openssl libssl-dev cpputest libsqlite3-dev uuid-dev
Since snort will be installed from Github, we definitely want to get the required
tools to work with that.
1. $ apt install -y libtool git autoconf
Snort’s Data Acquisition Library has to have its dependencies installed:
1. $ sudo apt install -y bison flex
Install the Safe C library for buffer overflow prevention checks at runtime
(caused by legacy C-library calls)
1. $ wget \ >https://downloads.sourceforge.net/project/safeclib/libsafec-10052013.tar.gz
2. $ tar -xzvf libsafec-10052013.tar.gz
3. $ cd libsafec-10052013
4. $ ./configure
5. $ make
6. $ sudo make install
For performance optimization on high memory usage, we are going to install
google performance tools (gfpertools):
1. $ cd ~/snort_src/
2. $ wget \ >https://github.com/gperftools/gperftools/releases/download/gperftools-2.7/gperftools-2.7.tar.gz
3. $ tar xzvf gperftools-2.7.tar.gz
4. $ cd gperftools-2.7
5. $ ./configure
6. $ make
For faster pattern matching, we will install Ragel and Boost which are
dependencies of Hyperscan that will assist us in faster multiple regex
matching during scans.
Download and install Ragel library:
2. $ wget http://www.colm.net/files/ragel/ragel-6.10.tar.gz
3. $ tar -xzvf ragel-6.10.tar.gz
4. $ cd ragel-6.10
5. $ ./configure
6. $ make
Download the Boost C++ libraries but do not install it.
2. $ wget https://dl.bintray.com/boostorg/release/1.67.0/source/boost_1_67_0.tar.gz
3. $ tar -xvzf boost_1_67_0.tar.gz
Download and install Hyper scan while referencing the location of the location
of the boost headers source:
1. $ ~/snort_src/
2. $ wget https://github.com/intel/hyperscan/archive/v4.7.0.tar.gz
3. $ tar -xvzf v4.7.0.tar.gz
4. $ mkdir ~/snort_src/hyperscan-4.7.0-build
5. $ cd hyperscan-4.7.0-build/
6. $ cmake -DCMAKE_INSTALL_PREFIX=/usr/local \ >-DBOOST_ROOT=~/snort_src/boost_1_67_0/ ../hyperscan-4.7.0
7. $ make
To test whether the hyper-scan works:
1. $ cd ~/snort_src/hyperscan-4.7.0-build/
2. $ ./bin/unit-hyperscan
We then need to install a memory serialization library called flatbuffers which
is more efficient:
1. $ cd ~/snort_src
2. $ wget https://github.com/google/flatbuffers/archive/v1.9.0.tar.gz -O flatbuffers-v1.9.0.tar.gz
3. $ tar -xzvf flatbuffers-1.9.0.tar.gz
4. $ mkdir flatbuffers-build && cd flatbuffers-build
5. $ cmake ../flatbuffers-1.9.0
6. $ make
Install Snort
We first need to install the Data Acquisition Library (DAQ) from snort’s
website:
1. $ cd ~/snort_src
2. $ wget https://www.snort.org/downloads/snortplus/daq-2.2.2.tar.gz
3. $ tar -xzvf daq-2.2.2.tar.gz
4. $ cd daq-2.2.2
5. $ ./configure
6. $ make
Update the shared libraries
1. $ sudo ldconfig
Finally, download snort source code and install it:
1. $ cd ~/snort_src
2. $ git clone git://github.com/snortadmin/snort3.git
3. $ cd snort3
4. $ ./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc
5. $ cd build
6. $ make
You can check whether snort has been installed:
1. $ /usr/local/bin/snort -V
Conclusion
If you have received the same output like the one above, it means you have
successfully installed snort on your VPS/Dedicated host. The next step would
be to permanently configure the global variables needed to run snort.

How To Install Snort On An Ubuntu 18

Uploaded by

Copyright:

Available Formats

How To Install Snort On An Ubuntu 18

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

How To Install Snort On An Ubuntu 18

Uploaded by

Copyright:

Available Formats

How to Install Snort on an

Ubuntu 18.04 VPS or

Install Snort dependencies

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.