How to compile and install SNORT 2 on RHEL 8 - nomorespice/rhel8-howto GitHub Wiki

Snort is an open-source, free and lightweight network intrusion detection system (NIDS) software for Linux and Windows to detect emerging threats. This procedure will guide you through the installation process on a Red Hat Enterprise Linux 8 server.

This document assumes that:

you installed the RHEL 8 x64 Operating System according to How to install RHEL 8 via kickstart

you are performing these tasks as root

you are performing these tasks in order, as some tasks require others to be completed first

Add the CodeReady Red Hat repository and install required software

subscription-manager repos --enable=codeready-builder-for-rhel-8-x86_64-rpms
dnf -y install bison flex libpcap-devel pcre-devel openssl-devel libdnet-devel libtirpc-devel libtool nghttp2 libnghttp2-devel
mkdir /var/src

Download, compile and install the Snort Data Aquisition Library (DAQ)

cd /var/src
wget https://snort.org/downloads/snort/daq-2.0.7.tar.gz
tar zxvf daq-2.0.7.tar.gz
cd daq-2.0.7
autoreconf -f -i
./configure
make
make install

Download, compile and install the just-in-time compiler for Lua (Required for Snort OpenAppID)

cd /var/src
wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz
tar -zxvf LuaJIT-2.0.5.tar.gz 
cd LuaJIT-2.0.5
make
make install

Create a fake release file to compile snort using the correct RPC library

/bin/cat << EOT >/etc/fedora-release
Fedora release 28 (Rawhide)
EOT

Download, compile and install Snort

Be sure to verify the current version of Snort and modify this section accordingly.

cd /var/src
wget https://snort.org/downloads/snort/snort-2.9.18.tar.gz
tar -zxvf snort-2.9.18.tar.gz 
cd snort-2.9.18
./configure --enable-sourcefire
make
make install

Remove fake release file

/bin/rm /etc/fedora-release

Setup Snort username and group

groupadd snort
useradd -g snort -s /sbin/nologin snort
passwd -l snort

Setup the Snort file and directory structure

mkdir /etc/snort
mkdir /etc/snort/rules
mkdir /etc/snort/rules/iplists
mkdir /etc/snort/pulledpork
mkdir /var/log/snort
mkdir /var/log/snort/pcap
chown -R snort /var/log/snort
touch /etc/snort/rules/iplists/default.whitelist
touch /etc/snort/rules/iplists/default.blacklist
cp /var/src/snort*/etc/* /etc/snort
ln -s /usr/local/bin/snort /sbin/snort

Confine the Snort process using SELinux

semanage fcontext -a -t snort_exec_t "/usr/local/bin/snort"
semanage fcontext -a -t snort_var_run_t "/var/run/snort(/.*)?"
restorecon -R -v /usr/local/bin/
restorecon -R -v /var/run/snort/

/bin/cat << EOT >/var/src/my-snort.te
module my-snort 1.0;

require {
type snort_t;
class netlink_rdma_socket create;
class capability dac_override;
class packet_socket map;
        class capability sys_admin;
}

#============= snort_t ==============
allow snort_t self:netlink_rdma_socket create;
allow snort_t self:packet_socket map;
allow snort_t self:capability sys_admin;
allow snort_t self:capability dac_override;
EOT

checkmodule -M -m -o /var/src/my-snort.mod /var/src/my-snort.te
semodule_package -o /var/src/my-snort.pp -m /var/src/my-snort.mod
semodule -i /var/src/my-snort.pp
/bin/rm /var/src/my-snort.te
/bin/rm /var/src/my-snort.mod
/bin/rm /var/src/my-snort.pp

Download and install the PulledPork rule management script

yum -y install perl-libwww-perl.noarch perl-Sys-Syslog.x86_64 perl-Archive-Tar.noarch perl-LWP-Protocol-https.noarch
wget https://raw.githubusercontent.com/shirkdog/pulledpork/master/pulledpork.pl -O /usr/local/bin/pulledpork.pl
chmod 755 /usr/local/bin/pulledpork.pl

Build the PulledPork configuration file

Be sure to input your OINKCODE to download the registered version of the Snort rules

/bin/cat << EOT >/etc/snort/pulledpork/pulledpork.conf
rule_url=https://www.snort.org/rules/|snortrules-snapshot-29180.tar.gz|OINKCODE
rule_url=https://snort.org/downloads/community/|community-rules.tar.gz|Community
rule_url=https://talosintelligence.com/documents/ip-blacklist|IPBLOCKLIST|open
rule_url=https://rules.emergingthreats.net/|emerging.rules.tar.gz|open
#
ignore=deleted.rules,experimental.rules,local.rules
temp_path=/tmp
rule_path=/etc/snort/rules/snort.rules
local_rules=/etc/snort/rules/local.rules
sid_msg=/etc/snort/sid-msg.map
sid_msg_version=1
sid_changelog=/var/log/sid_changes.log
sorule_path=/etc/snort/snort_dynamicrules/
snort_path=/sbin/snort
config_path=/etc/snort/snort.conf
distro=RHEL-8-0
black_list=/etc/snort/rules/iplists/default.blacklist
IPRVersion=/etc/snort/rules/iplists
snort_control=/usr/bin/snort_control
snort_version=2.9.14.1
disablesid=/etc/snort/pulledpork/disablesid.conf
enablesid=/etc/snort/pulledpork/enablesid.conf
version=0.8.0
EOT

Build the PulledPork disabled rule file

Add any rules you would like to be disabled to this file

/bin/cat << EOT >/etc/snort/pulledpork/disablesid.conf
EOT

Add any rules you would like to be enabled to this file

/bin/cat << EOT >/etc/snort/pulledpork/enablesid.conf
EOT

Execute the PulledPork script to verify correct operation

/usr/local/bin/pulledpork.pl -W -P -c /etc/snort/pulledpork/pulledpork.conf

Build the Snort threshold file

Add any Snort rules you want suppressed to this file

/bin/cat << EOT >>/etc/snort/threshold.conf
#suppress gen_id 119, sig_id 14
EOT

Build the local rule file

Add any custom Snort rules to this file

/bin/cat << EOT >/etc/snort/rules/local.rules
# ------------
# LOCAL RULES
# ------------
#
EOT

Build the capture filter file.

Modify this file with the networks you wish to monitor

/bin/cat << EOT >/etc/snort/filter.bpf
( net 192.168.0.0/24 or net fdaa:0:0:0::/60 )
EOT

Build the ipvar include file