Knowledge Base

This has been tested on a Centos4.x server. But should work on most other Linux flavors.

Add a new repo /etc/yum.repos.d/RPMforge.repo

[RPMforge]
name=DAG-RHEL-4
baseurl=http://apt.sw.be/redhat/el4/en/i386/dag/
gpgcheck=1

# Add RPMforge GPG key
rpm --import http://dag.wieers.com/packages/RPM-GPG-KEY.dag.txt

# Add snort
yum -y install snort


*----------------
complete steps if you want to compile it
-------------------
wget http://www.tcpdump.org/release/libpcap-0.9.3.tar.gz
tar zxvf libpcap-0.9.3.tar.gz
rm -fr libpcap-0.9.3.tar.gz
cd libp*
./configure
make
make install



This will install the library in /usr/local/lib. To get everything right, you need to edit the file /etc/ld.so.conf and check if it contains a line with /usr/local/lib. When all's OK enter


pico /etc/ld.so.conf
ldconfig


wget http://surfnet.dl.sourceforge.net/so...cre-6.3.tar.gz
tar -xzf pcre-6.3.tar.gz
rm -fr pcre-6.3.tar.gz
cd pcre*
./configure
make
make install




wget http://www.snort.org/dl/current/snort-2.4.4.tar.gz
tar zxvf snort-2.4.4.tar.gz
rm -fr snort-2.4.4.tar.gz
cd snort*
./configure
make
make install



mkdir /var/log/snort
chown snort.snort /var/log/snort

Courtesy of Mora @ alkema4host.com