{"id":2371,"date":"2015-12-08T10:13:55","date_gmt":"2015-12-08T08:13:55","guid":{"rendered":"https:\/\/upcloud.com\/global\/us\/resources\/tutorials\/installing-snort-on-centos\/"},"modified":"2015-12-08T10:13:55","modified_gmt":"2015-12-08T08:13:55","slug":"installing-snort-on-centos","status":"publish","type":"tutorial","link":"https:\/\/upcloud.com\/global\/resources\/tutorials\/installing-snort-on-centos\/","title":{"rendered":"How to install Snort on CentOS"},"content":{"rendered":"\n

Snort is a popular choice for running a network intrusion detection system or NIDS. It monitors the package data sent and received through a specific network interface. NIDS can catch threats targeting your system vulnerabilities using signature-based detection and protocol analysis technologies. NIDS software, when installed and configured appropriately, can identify the latest attacks, malware infections, compromised systems, and network policy violations. In this guide, you will find instructions on how to install Snort on CentOS 7. The install guide is also available for cloud servers running Debian 9<\/a> and Ubuntu 16<\/a>.<\/p>\n\n\n

\n
\"Snort<\/figure>\n<\/div>\n\n\n

Snort is one of the most commonly used network-based IDS<\/a>. It is lightweight, open source, available on a multitude of platforms, and can be comfortably installed even on the smallest of cloud server instances. Although Snort is capable of much more than just network monitoring, this guide shows how to configure and run Snort in NIDS mode with a basic setup that you can later expand as needed.<\/p>\n\n\n\n

Preparing your server<\/h2>\n\n\n\n
\n
Test hosting on UpCloud!<\/a><\/div>\n<\/div>\n\n\n\n

Setting up a basic configuration of Snort on CentOS is fairly simple but takes a few steps to complete. You will first need to install all the prerequisite software to ready your cloud server for installing Snort itself. Install the required libraries with the following command.<\/p>\n\n\n\n

sudo yum install -y gcc flex bison zlib libpcap pcre libdnet tcpdump<\/pre>\n\n\n\n
The latest Snort version at this time also requires libnghttp2<\/tt> which can be downloaded from the Extra Packages for Enterprise Linux (EPEL) and installed using the commands underneath.<\/p>\n\n\n\n
sudo yum install -y https:\/\/dl.fedoraproject.org\/pub\/epel\/epel-release-latest-7.noarch.rpm\nsudo yum install -y libnghttp2<\/pre>\n\n\n\n
With the prerequisites fulfilled, next up is how to install Snort on CentOS 7. Snort can be installed with ready-built packages, which simplifies the setup process considerably, and allows you to install Snort easily with yum<\/tt>. Alternatively, you can download and install the Snort on CentOS manually from the source. Below you will find instructions for both of these methods.<\/p>\n\n\n\n
Option 1. Installing with yum<\/h2>\n\n\n\n
Snort provides convenient rpm<\/tt> packets for CentOS 7, which can be installed simply with the commands below. Snort itself uses something called a Data Acquisition library (DAQ) to make abstract calls to packet capture libraries. Check the latest version number on the Snort front page<\/a>, if a newer version of DAQ or Snort is available simply replace the version number in the following commands with the latest option.<\/p>\n\n\n\n
sudo yum install https:\/\/www.snort.org\/downloads\/snort\/daq-2.0.6-1.centos7.x86_64.rpm<\/pre>\n\n\n\n
sudo yum install https:\/\/www.snort.org\/downloads\/snort\/snort-2.9.12-1.centos7.x86_64.rpm<\/pre>\n\n\n\n
Once you are done with the installation, jump forward to the configuration to continue.<\/p>\n\n\n\n
Option 2. Installing from the source<\/h2>\n\n\n\n
Setting up Snort on CentOS from the source code consists of a couple of steps: downloading the code, configuring it, compiling the code, installing it to an appropriate directory, and lastly configuring the detection rules.<\/p>\n\n\n\n
Before getting started, you will also need the following development packages in addition to the already install prerequisites.<\/p>\n\n\n\n
sudo yum install -y zlib-devel libpcap-devel pcre-devel libdnet-devel openssl-devel libnghttp2-devel luajit-devel\n<\/pre>\n\n\n\n
When ready, make a temporary download folder to your home directory and then change into it with the command below.<\/p>\n\n\n\n
mkdir ~\/snort_src && cd ~\/snort_src<\/pre>\n\n\n\n
Download the latest DAQ source package from the Snort website with the wget<\/tt> command underneath. Replace the version number in the command if a newer source is available.<\/p>\n\n\n\n
wget https:\/\/www.snort.org\/downloads\/snort\/daq-2.0.6.tar.gz<\/pre>\n\n\n\n
The download will only take a few seconds when complete extract the source code and jump into the new directory with the following commands.<\/p>\n\n\n\n
tar -xvzf daq-2.0.6.tar.gz\ncd daq-2.0.6<\/pre>\n\n\n\n
Run the configuration script using its default values, then compile the program with make and finally install DAQ.<\/p>\n\n\n\n
.\/configure && make && sudo make install<\/pre>\n\n\n\n
With the DAQ installed, you can get started with Snort, change back to the download folder.<\/p>\n\n\n\n
cd ~\/snort_src<\/pre>\n\n\n\n
Next, download the Snort source code with wget<\/tt>. Check the latest version number from the Snort website and replace it in the following command if necessary.<\/p>\n\n\n\n
wget https:\/\/www.snort.org\/downloads\/snort\/snort-2.9.12.tar.gz<\/pre>\n\n\n\n
Once the download is complete, extract the source and change into the new directory with these commands.<\/p>\n\n\n\n
tar -xvzf snort-2.9.12.tar.gz\ncd snort-2.9.12<\/pre>\n\n\n\n
Then configure the installation with sourcefire<\/tt> enabled, run make and make install.<\/p>\n\n\n\n
.\/configure --enable-sourcefire && make && sudo make install<\/pre>\n\n\n\n
With that done, continue below on how to set up the configuration files.<\/p>\n\n\n\n
Configuring Snort to run in NIDS mode<\/h2>\n\n\n\n
Next, you will need to set up Snort for your system. This includes editing some configuration files, downloading the rules that Snort will follow, and taking Snort for a test run.<\/p>\n\n\n\n
Start with updating the shared libraries using the command underneath.<\/p>\n\n\n\n
sudo ldconfig<\/pre>\n\n\n\n
Snort on CentOS gets installed to \/usr\/local\/bin\/snort<\/tt> directory, it is good practice to create a symbolic link to \/usr\/sbin\/snort<\/tt>.<\/p>\n\n\n\n
If you installed Snort with yum<\/tt> you can skip this command.<\/p>\n\n\n\n
sudo ln -s \/usr\/local\/bin\/snort \/usr\/sbin\/snort<\/pre>\n\n\n\n
Setting up username and folder structure<\/h2>\n\n\n\n
To run Snort on CentOS safely without root access, you should create a new unprivileged user and a new user group for the daemon to run under.<\/p>\n\n\n\n
sudo groupadd snort\nsudo useradd snort -r -s \/sbin\/nologin -c SNORT_IDS -g snort<\/pre>\n\n\n\n
Then create the folder structure to house the Snort configuration, just copy over the commands below. If you installed Snort using yum<\/tt> these directories should have already been added at installation, but check to make sure.<\/p>\n\n\n\n
sudo mkdir -p \/etc\/snort\/rules\nsudo mkdir \/var\/log\/snort\nsudo mkdir \/usr\/local\/lib\/snort_dynamicrules<\/pre>\n\n\n\n
Set the permissions for the new directories accordingly.<\/p>\n\n\n\n
sudo chmod -R 5775 \/etc\/snort\nsudo chmod -R 5775 \/var\/log\/snort\nsudo chmod -R 5775 \/usr\/local\/lib\/snort_dynamicrules\nsudo chown -R snort:snort \/etc\/snort\nsudo chown -R snort:snort \/var\/log\/snort\nsudo chown -R snort:snort \/usr\/local\/lib\/snort_dynamicrules<\/pre>\n\n\n\n
Create new files for the white and blacklists as well as the local rules.<\/p>\n\n\n\n
sudo touch \/etc\/snort\/rules\/white_list.rules\nsudo touch \/etc\/snort\/rules\/black_list.rules\nsudo touch \/etc\/snort\/rules\/local.rules<\/pre>\n\n\n\n
Then if you installed Snort from the source code, copy over the configuration files from the download folder. Skip this if you installed Snort with yum<\/tt>.<\/p>\n\n\n\n
sudo cp ~\/snort_src\/snort-2.9.12\/etc\/*.conf* \/etc\/snort\nsudo cp ~\/snort_src\/snort-2.9.12\/etc\/*.map \/etc\/snort<\/pre>\n\n\n\n
Next up, you will need to download the detection rules Snort will follow to identify potential threats. Snort provides three tiers of rule sets, community, registered and subscriber rules.<\/p>\n\n\n\n