wget https://www.snort.org/downloads/snort/snort-2.9.12.tar.gz
tar xvfz snort-2.9.12.tar.gz
cd snort-2.9.12
./configure --enable-sourcefire && make && sudo make install
,,_ –> Snort! – o” )~ Version 2.9.2 IPv6 GRE (Build 78) ”” By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team Copyright (C) 1998-2011 Sourcefire, Inc., et al. Using libpcap version 1.1.1 Using PCRE version: 8.12 2011-01-15 Using ZLIB version: 1.2.3.4
//-----------------
//安装一些依赖包,为后面的图形化做准备
安装apache
apt-get install apache2
安装mysql
apt-get install mysql-server
安装php
apt-get install php5
第六步:为snort创建一个数据库,和一个用户
$ mysql –u root –p
mysql> CREATE DATABASE snort;
mysql> grant CREATE, INSERT, SELECT, UPDATE on snort.* to snort@localhost;
mysql> grant CREATE, INSERT, SELECT, UPDATE on snort.* to snort;
mysql> SET PASSWORD FOR snort@localhost=PASSWORD('yourpassword');
mysql> exit
第七步:修改snor配置文件
snort的配置文件在/etc/snort/snort.conf
打开该文件将 HOME_NET 有关项注释掉,然后将 HOME_NET 设置为本机 IP 所在网络,将 EXTERNAL_NET 相关项注释掉,设置其为非本机网络,如下所示:
ipvar EXTERNAL_NET any > ipvar EXTERNAL_NET!$HOME_NET
第八步:试运行
snort -T -i eth0 -u snort -g snort -c /etc/snort/snort.conf
若出现如下错误
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!! WARNING: The database output plugins are considered deprecated as
!! of Snort 2.9.2 and will be removed in Snort 2.9.3.
!! The recommended approach to logging is to use unified2 with
!! barnyard2 or similar.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
database: must enter database name in configuration file
解法:
搞了好长时间,发现snort.conf配置文件549行左右有一条
include database.conf
注释掉