ライブラリ
[root]# dnf config-manager --enable powertools <-- AL8
[root]# dnf config-manager --enable crb <-- AL9
[root]# dnf install epel-release
[root]# dnf upgrade
# AL 9.x
[root]# dnf install vim git flex flex-devel bison bison-devel \
gcc gcc-c++ make cmake automake autoconf libtool \
libpcap libpcap-devel libdnet libdnet-devel \
hwloc hwloc-devel openssl openssl-devel \
zlib zlib-devel luajit luajit-devel pkgconf \
libmnl libmnl-devel libunwind libunwind-devel \
libnfnetlink libnfnetlink-devel \
libnetfilter_queue libnetfilter_queue-devel \
xz xz-devel libuuid libuuid-devel \
hyperscan hyperscan-devel libsafec libsafec-devel \
gperftools gperftools-devel \
libcmocka libcmocka-devel
[root]# ln -s /usr/lib64/pkgconfig/safec-3.3.pc /usr/lib64/pkgconfig/libsafec.pc
# Ubuntu 24.04
[root]# apt install flex bison libtool libtool-bin libpcap-dev
hwloc libhwloc-dev luajit pkgconf libmnl0 libmnl-dev
libunwind-dev libnfnetlink0 libnfnetlink-dev
libnetfilter-queue1 libnetfilter-queue-dev xz-utils libuuid1
uuid-dev libhyperscan-dev libsafec3 libsafec-dev
libcmocka0 libcmocka-dev libdumbnet-dev libluajit-5.1-dev
libgoogle-perftools-dev
LibDAQ
[root]# tar xvfz snort3-libdaq-v3.0.19-0-g434f205.tar.gz
[root]# cd snort3-libdaq-434f205/
または、
[root]# git clone https://github.com/snort3/libdaq.git
[root]# cd libdaq
[root]# ./bootstrap
[root]# ./configure
[root]# make -j3
[root]# make -j3 check
[root]# make -j3 install
[root]# cd ..
[root]# rm -vrf libdaq または、 rm -vrf snort3-libdaq-434f205/
[root]# updatedb
[root]# locate libdaq
/usr/local/lib/libdaq.so
/usr/local/lib/libdaq.so.3
[root]# vim /etc/ld.so.conf.d/local.conf
/usr/local/lib
/usr/local/lib64
[root]# ldconfig -v <-- 共有ライブラリの更新
[root]# ldconfig -p | grep libdaq
libdaq.so.3 (libc6,x86-64) => /usr/local/lib/libdaq.so.3
libdaq.so (libc6,x86-64) => /usr/local/lib/libdaq.so
Flatbuffers
[root]# curl -Lo flatbuffers-24.3.25.tar.gz
https://github.com/google/flatbuffers/archive/v24.3.25.tar.gz
[root]# tar xvfz flatbuffers-24.3.25.tar.gz
[root]# cd flatbuffers-24.3.25
[root]# mkdir build
[root]# cd build
[root]# cmake ..
[root]# make -j3
[root]# make -j3 test
[root]# make -j3 install
[root]# cd ../..
[root]# rm -vrf flatbuffers-24.3.25
Snort3
[root]# tar xvfz snort3-snort3-3.7.3.0-0-g2187e24.tar.gz
[root]# cd snort3-snort3-xxxxxxx/
または、
[root]# git clone https://github.com/snort3/snort3.git
[root]# cd snort3
[root]# export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH
[root]# export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig:$PKG_CONFIG_PATH
[root]# export CFLAGS="-O3"
[root]# export CXXFLAGS="-O3 -fno-rtti"
[root]# ./configure_cmake.sh --prefix=/usr/local/snort
--enable-tcmalloc --enable-appid-third-party
--enable-tcmalloc : メモリ使用量を削減し、処理時間を短縮
--enable-appid-third-party : サードパーティの appid を有効
[root]# cd build
[root]# make -j3
[root]# make -j3 install
[root]# /usr/local/snort/bin/snort -V
[root]# cd ../..
[root]# rm -vrf snort3 または、 rm -vrf snort3-snort3-xxxxxxx/
・アップデート時
1. 設定ファイルが上書きされるため、設定ファイルの修正
[root]# vim /usr/local/snort/etc/snort/snort_defaults.lua
[root]# vim /usr/local/snort/etc/snort/snort.lua
2. pulledpork.conf 内のバージョン変更後、pulledpork.pl 実行
[root]# vim /usr/local/pulledpork/etc/pulledpork.conf
snort_version=3.7.0.0
[root]# /usr/local/pulledpork/pulledpork.pl -c /usr/local/pulledpork/etc/pulledpork.conf
3. Snort 再起動
[root]# systemctl restart snortd.service
Snort3 Extra
[root]# tar xvfz snort3-snort3_extra-3.7.1.0-0-g842adaf.tar.gz
[root]# cd snort3-snort3_extra-xxxxxxx/
または、
[root]# git clone https://github.com/snort3/snort3_extra.git
[root]# cd snort3_extra
# AL 9.x
[root]# export PKG_CONFIG_PATH=/usr/local/snort/lib64/pkgconfig:$PKG_CONFIG_PATH
# Ubuntu 24.04
[root]# export PKG_CONFIG_PATH=/usr/local/snort/lib/pkgconfig:$PKG_CONFIG_PATH
[root]# ./configure_cmake.sh --prefix=/usr/local/snort/extra
[root]# cd build
[root]# make -j3
[root]# make -j3 install
[root]# cd ../..
[root]# rm -vrf snort3_extra または、 rm -vrf snort3-snort3_extra-xxxxxxx/
ディレクトリ作成
[root]# mkdir -p /usr/local/snort/{builtin_rules,rules,appid,intel}
builtin_rules, rules にはルールファイル、appid には AppID 検出器、
intel にはブラックリストとホワイトリストを配置。
ルールファイル
・ルールセットの取得
Subscriber Release : 最新のルールセット(有償)
Registered User Release : Subscriber Release より30日遅れのルールセット
Community Rules : オープンソースコミュニティが作成したルールセット
[root]# mkdir rules
[root]# cd rules
Registered User Release を取得
[root]# curl -Lo snortrules-snapshot-3300.tar.gz
https://www.snort.org/rules/snortrules-snapshot-3300.tar.gz?
oinkcode=<OINKCODE>
・設定ファイル/ルールファイルをコピー
[root]# tar xvfz snortrules-snapshot-3300.tar.gz
[root]# ls
builtins etc rules snortrules-snapshot-3300.tar.gz so_rules
[root]# cp -v etc/*.lua /usr/local/snort/etc/snort/
[root]# cat rules/*.rules > /usr/local/snort/rules/snort.rules
[root]# cp -v builtins/builtins.rules /usr/local/snort/builtin_rules/
OpenAppID
[root]# cd /usr/local/snort/appid/
[root]# curl -Lo snort-openappid.tar.gz
https://snort.org/downloads/openappid/snort-openappid.tar.gz
[root]# tar xvfz snort-openappid.tar.gz
[root]# rm -v snort-openappid.tar.gz
[root]# ls
odp
IP Reputation
[root]# cd /usr/local/snort/intel/
[root]# curl -Lo ip-blocklist
https://www.talosintelligence.com/documents/ip-blacklist
[root]# ls
ip-blocklist
[root]# touch /usr/local/snort/intel/ip-allowlist