centos中snort安装配置

 

1 .安装依赖包

#yum install gcc flex bison zlib libpcap tcpdump gcc-c++ pcre* zlib* libdnet libdnet-devel  

2.安装libdnet

#tar zxvf libdnet-1.12.tgz

#cd libdnet-1.12

#./configure && make && make install

3.安装libpcap

 #tar zxvf libpcap-1.7.4.tar.gz

 #cd libpcap-1.7.4

 #./configure && make && make install

4.安装DAQ

#yum  install  https://www.snort.org/downloads/snort/daq-2.0.6-1.centos7.x86_64.rpm

5.安装snort

 #rpm  -ivh snort-2.9.7.5-1.centos7.x86_64.rpm

6.配置snort

创建需要的文件和目录

#mkdir /usr/local/lib/snort_dynamicrules

#touch /etc/snort/rules/white_list.rules /etc/snort/rules/black_list.rules

#touch /etc/snort/rules/protocol-other.rules

7.编辑配置文件

#vi /etc/snort/snort.conf

定义路径变量

ipvar HOME_NET 10.1.1.0/24

ipvar EXTERNAL_NET !$HOME_NET

 var RULE_PATH /etc/snort/rules          104行

 var SO_RULE_PATH /etc/snort/so_rules     105行

 var PREPROC_RULE_PATH /etc/snort/preproc_rules

 var WHITE_LIST_PATH /etc/snort/rules

 var BLACK_LIST_PATH /etc/snort/rules

 设置log目录

 config logdir:/var/log/snort  去掉# 182行

 配置输出插件

 output unified2:filename snort.log,limit 128  516行

8.配置规则

#tar zxvf snortrules-snapshot-2975.tar.gz -C /etc/snort/

#cp  /etc/snort/etc/sid-msg.map  /etc/snort

9.测试snort

#snort -T -i eth0 -c /etc/snort/snort.conf

出现success设置成功！

10 运行snort

systemctl restart snortd.service

snort -c /etc/snort/snort.conf  -i em1 -D