snort 설치 (Centos6)

snort 다운로드

wget https://www.snort.org/downloads/snort/daq-2.0.4.tar.gz wget https://www.snort.org/downloads/snort/snort-2.9.7.0.tar.gz  압축풀기 tar xvfz daq-2.0.4.tar.gz tar xvfz snort-2.9.7.0.tar.gz

패키지 설치

yum install gcc flex bison libpcap-devel pcre* wget http://dl.fedoraproject.org/pub/epel/6/x86_64/libdnet-1.12-6.el6.x86_64.rpm wget http://dl.fedoraproject.org/pub/epel/6/x86_64/libdnet-devel-1.12-6.el6.x86_64.rpm  yum install libdnet*

snort 설치

tar xvfz daq-2.0.4.tar.gz cd daq-2.0.4 ./configure; make; make install tar xvfz snort-2.9.7.0.tar.gz cd snort-2.9.7.0 ./configure --enable-sourcefire; make; make install

커뮤니티 정책 다운로드

wget https://www.snort.org/rules/community.tar.gz tar xvfz community.tar.gz

시그니쳐 다운로드

: 압축을 풀어보면 시그니처에 대한 설명 등등이 나와있음

wget https://www.snort.org/downloads/community/opensource.tar.gz

cd 

되게는 /etc/snort 라는 디렉토리를 생성해서 일괄 관리하는듯 하다

vim /etc/snort.conf

var RULE_PATH /etc/snort/rules

ipvar HOME_NET 192.168.1.0/24 

ipvar EXTERNAL_NET !$HOME_NET

var SO_RULE_PATH /etc/snort/so_rules

var PREPROC_RULE_PATH /etc/snort/preproc_rules

var WHITE_LIST_PATH /etc/snort/rules

var BLACK_LIST_PATH /etc/snort/rules

snort 실행 옵션

-D : 데몬으로 실행 -c : 설정파일 지정  -v : Snort를 패킷 Sniffing 모드로 동작(TCP) -d : 모든 네트워크 계층을 포함 -e : 데이터 링크 계층 헤더를 포함

실행

snort -T -i eth0 -c /etc/snort/snort.conf

error)

ERROR: /etc/snort/snort.conf(254) Could not stat dynamic module path "/usr/local/lib64/snort_dynamicrules": No such file or directory.

mkdir -p /usr/local/lib/snort_dynamicrules

chown -R snort:snort /usr/local/lib/snort_dynamicrules

chmod -R 700 /usr/local/lib/snort_dynamicrules

자료참조

https://www.snort.org/#documents