Single Sensor with Network Management System Integration Single Sensor with Database and Web Interface
Snort Installation Scenarios 27
As mentioned in Chapter 1, the ultimate objective of this book is to help you install Snort and to make all of these packages work with each other. When you go
through this book, you will see how these components act with each other to build a complete working intrusion detection system. The website for this book http:
authors.phptr.comrehman contains all of these packages in the source code form. You will also find scripts on the site that are very helpful in installing these packages on a
new system with no hassle. In fact, by using the scripts on the site as discussed in this book, you should be able to have a working IDS by just using a few commands as the
root user. If you use a version newer than that discussed in this book, the latest versions of the scripts that support new Snort versions can be downloaded from http:
www.argusnetsec.comdownloads.
This books details the installation of these components on a RedHat Linux version 7.3 machine. But the process is similar on other platforms and other versions of RedHat
Linux. All components are installed under opt directory for the purpose of this book. However, when a pre-compiled package is used, the location of files may be different.
When you use the scripts in the book or from the website, files will be installed under
Figure 2-1 Distributed Snort installation with the help of tools like SCP and Barnyard.
28 Chapter 2 • Installing Snort and Getting Started
this directory. In this chapter, you will learn how to install Snort as a standalone prod- uct. Later chapters will focus on other components.
Snort is available in both source code and binary forms. Pre-compiled binary packages are fine for most installations. As mentioned earlier, if you want to add or
remove certain features of Snort, you need to download the source code version and then compile it yourself. For example, someone may be interested in SMB alerts while
another may consider it unsecure. If you want to build Snort without support for SMB alerts, you may want to build it yourself. The same is true of other features like SNMP
traps, MySQL and so on. Another reason to compile the source code yourself may be when a new version is released but binaries are not yet available. You may also need to
compile the Snort package if you take a snapshot of the code under development. This chapter will provide a step-by-step guide to installing Snort.
The basic installation procedure is simple because you have plenty of predefined rules available with Snort that cover most of the known intrusion signatures. However,
customization of your installation may require a lot of work. Version 1.9.0 is used in this chapter, but the installation procedure is similar for
other versions of the software. After installation, basic information for getting started with Snort is also provided, including basic Snort concepts, logging and alerting and
some information about Snort modes of operation.