Re: [cobalt-security] snort

[Damian Gerow <dgerow@xxxxxxxxxxx>]

(I apologize for the bad quoting - our mail server's currently broken.)

Tried it - can't find kernel headers.  Should I just grab kernel source
for the kernel the Qube2's using, or is there specific packages for
this?


----  begin quote -----
> Is there a snort package available for the Qube2?

No.  It's very easy to compile, however.

Grab the latest source from www.snort.org, issue:

gzip -cd snort-version.tar.gz | tail -xvf -
cd snort-version
./configure
make
su
make install

Then grab a rules file from snort.org and start snort with the options
./snort -c rules.file -D

as root fairly obviously.