Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

The Snort version available for Lucid is 2.8.5.2, for which snort rules are not available anymore. Is there a ppa for the updated version of snort or are there any good tutorials for installing snort from source.

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

Install via PPAs

The linked PPA has snort v2.9:

sudo add-apt-repository ppa:ebf0/gamelinux
sudo apt-get update

From my reading of the rules - any v2.9.x meets the rule standards - the .x are just stability updates.

Another PPA I've found is ppa:hurricanedefense/testing which contains v2.9.1 of snort.

As with all PPAs - these are for testing purposes and may make your system unstable. Have a full image backup available. You can also install ppa-purge to remove PPAs. N.B. enable the backports software source to install ppa-purge

Install via compilation

Data AcQuisition library

Download some prerequisites:

sudo apt-get install flex bison  build-essential checkinstall libpcap0.8-dev libnet1-dev

Now download and extract the latest daq source code from snort.org

cd daq-0.6.1/
./configure
make
sudo checkinstall
sudo dpkg -i daq_0.6.1-1_i386.deb

Libdnet

wget http://libdnet.googlecode.com/files/libdnet-1.12.tgz
tar xvfz libdnet-1.12.tgz
cd libdnet-1.12/
./configure
make
sudo checkinstall
sudo dpkg -i libdnet_1.12-1_i386.deb
sudo ln -s /usr/local/lib/libdnet.1.0.1 /usr/lib/libdnet.1

Snort

sudo apt-get install libpcre3-dev libmysqlclient15-dev

Now download and extract the latest snort source code from snort.org

cd snort-2.9.1
./configure --with-mysql --enable-build-dynamic-examples  --enable-gre --enable-reload --enable-linux-smp-stats --enable-zlib
make
sudo checkinstall
sudo dpkg -i snort_2.9.1-1_i386.deb

sudo ldconfig

At this point you need to configure the snort.conf file according to your environment.

source

share|improve this answer
    
The snort available at ppa:ebf0/gamelinux doesn't have ncurses based configuration tool. And I couldn't get snort work with multiple interfaces. –  nixnotwin Sep 18 '11 at 11:45
    
I added the second ppa with the commands you provided above. But it installs only the old snort from thr main repository. –  nixnotwin Sep 18 '11 at 13:24
    
I got this error while startng snort: ERROR: parser.c(5260) Could not stat dynamic module path "/usr/lib/snort_dynamicpreprocessor/": No such file or directory. Fatal Error, Quitting.. –  nixnotwin Sep 20 '11 at 8:50
    
make sure you remove the old snort package first before compiling and installing the new snort. –  fossfreedom Sep 20 '11 at 8:55
    
I had purged the old one. But I solved this error by changing the path to: /usr/local/lib/snort_dynamicpreprocessor/. Antother error appeared now. It says there are some errors in the rules. So trying to get the new rules. –  nixnotwin Sep 20 '11 at 10:06
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.