|
|
|
# Installation
cd /usr/ports/net/snort
make install
mkdir -p /etc/snort/rules
cd /usr/local/share/examples/snort
cp *.rules /etc/snort/rules
cp *.conf* /etc/snort
useradd -c "Snort daemon" -s /sbin/nologin -d /nonexistent -g =uid _snort
# Add the log directory.
mkdir -p /var/log/snort
chown _snort._snort /var/log/snort
chmod 700 /var/log/snort
# Edit snort.conf.
# Configure the HOME_NET variable if you care that much.
# Change RULES_PATH to "/etc/snort/rules"
# Start the daemon.
/usr/local/bin/snort -D -d -c /etc/snort/snort.conf -u _snort -g _snort
# Add to /etc/rc.conf.local
echo "snort=YES" >> /etc/rc.conf.local
# add to /etc/rc.local
if [ X"${snort}" == X"YES" -a -x /usr/local/bin/snort ]; then
echo -n " snort"; /usr/local/bin/snort -D -d -c /etc/snort/snort.conf -u _snort -g _snort
fi
# Add to /etc/newsyslog.conf
echo "/var/log/snort/alert _snort:_snort 640 10 * * Z /var/run/snort_hme0.pid" >> /etc/newsyslog.conf
# Snort status reports
# Get snort-stat
# Is there a non-Debian-packaged version of this script?
wget http://mirrorshades.net/~bda/code/scripts/snort-stat
chmod 750 snort-stat
mv snort-stat /usr/local/sbin
# Patch snort-stat
wget http://mirrorshades.net/~bda/code/patches/snort-stat-2004.05.26.diff
patch /usr/local/sbin/snort-stat snort-stat-2004.05.26.diff
# If you care this much:
# rm /usr/local/sbin/snort-stat.orig
# Get snort_report.sh crontab.
wget http://mirrorshades.net/~bda/code/scripts/snort_report.sh
chmod 750 snort_report.sh
mv snort_report.sh /usr/local/sbin
# Add snort-stat cron to root's crontab:
00 6 * * * /bin/sh /usr/local/sbin/snort_report.sh
# If want to make sure the snort comes up on a reboot, reboot the machine now.
|
|
|
|
Note:
We use Hosting and VPS Hosting, from:
www.star-host.org
We like and trust them.
Good prices, high security.
|