Softpanorama

May the source be with you, but remember the KISS principle ;-)
Home Switchboard Unix Administration Red Hat TCP/IP Networks Neoliberalism Toxic Managers
(slightly skeptical) Educational society promoting "Back to basics" movement against IT overcomplexity and  bastardization of classic Unix

Snort Installation on Solaris

News Recommended_Links Acid installation Snort-related Perl Scripts Humor Etc

Slightly modify the installation directions from the previous article on Snort:

../configure --with-mysql=/usr/local --with-openssl=/usr/local

Then follow the rest of the installation instructions provided there.

Now set up the Snort database in MySQL. First create the snort user and grant the appropriate permissions:

mysqladmin -u root -p create snort

Next, run the MySQL script included in the Snort source directory to create the appropriate tables:

mysql -u root -p < snort-2.3.3/schemas/create_mysql snort

Now add the snort user and set the permissions:

mysql -u root -p snort

mysql> set PASSWORD FOR snort@localhost=PASSWORD('snort_user_password');
mysql> grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort@localhost;
mysql> flush privileges;
mysql> exit

Finally, edit the snort.conf file and modify the output plug-in:

output database: log, mysql, dbname=snort user=snort password=snort host=localhost
output database: alert, mysql, dbname=snort user=snort password=snort host=localhost

This will cause both log and alert data to be written to the database.

To verify that Snort is able to write to MySQL, make sure MySQL is running, then start Snort with the following options:

snort -c /etc/snort.conf -g snort

Once Snort and MySQL are running, wait a few moments until it collects some alert data. Then run the following command:

echo "SELECT count(*) FROM event" | mysql -u root -p snort

Your output should look similar to the following, where the number is the number of alerts you've received:

count(*)
1

If the number is zero, then you haven't seen any traffic that will trigger an alert, or you need to revisit your Snort/MySQL configurations.

Top Visited
 Switchboard
Latest
Past week
Past month

NEWS CONTENTS

News

Chrooted Snort on Solaris

4.0 Getting the required software

The following dependencies are needed to build our Snort binary, and are assumed to be installed and functional: the gcc compiler 2.95+, flex 2.5.4+, and bison 1.75+). If these dependencies are not available, they can be downloaded in pkgadd format from sunfreeware.com. Then you will need to download, compile and install the following software:

Optional hardware info:

  • Building a passive tap
  • 100Mb tap diagram with 100Mb span port

5.0 Compiling the packages

The machine you compile packages on and the Snort IDS machine might be different machines. The following steps are done on the compiler machine. Download all packages to the /snort directory.

Building libpcap, libpcre and Snort is very straightforward.

    Step 1: Building and installing libpcap 
    	# cd /snort
	# gzip -dc libpcap-0.8.3.tar.gz | tar -xf -
	# cd libpcap-0.8.3
	# ./configure ; make
	# make install

    Step 2: Building libpcre 

    	# cd /snort
	# gzip -dc pcre-5.0.tar.gz | tar -xf - 
	# cd pcre-5.0
	# ./configure ; make
	# make install

    Step 3: Building Snort 

    	# cd /snort
	# gzip -dc snort-2.3.2.tar.gz | tar -xf -
	# cd snort-2.3.2
	# ./configure ; make

Now that the packages are built, let's create a snort.conf for testing inside the chroot. For simplicity, I've included a script that will make a generic snort.conf from the entire ruleset that came with Snort. While this is not optimal for a production environment, it works fine for testing purposes on a cable modem and an old Pentium II running Solaris on Intel. We just need a snort.conf to test Snort in the chroot. Save the script as /snort/fxsnort, chmod 755 fxsnort, and then run it as follows: 

	# ./fxsnort snort-2.3.2/rules out.conf

It should have created a generic /snort/snort.conf. Edit the generic snort.conf as follows:

Generic Edit
var INTERNAL any var INTERNAL $bge1_ADDRESS
var EXTERNAL any var EXTERNAL !$INTERNAL
var RULE_PATH ../rules var RULE_PATH /usr/local/etc
- preprocessor portscan: $INTERNAL 5 4 /tmp/portscan
# include $RULE_PATH/virus.rules

6.0 Building the chrooted environment

The next steps must be done on the Snort machine. Building a chrooted environment means re-creating a minimal system directory structure and copying every needed file and device inside the chrooted directory. For example, let's look at what's required to re-create /dev/tcp inside our chroot path /export/home/ids. This would involve: 

	# cd /export/home
	# mkdir ids
	# cd ids
	# mkdir dev
	# mkdir -p devices/psuedo
	# cd devices/psuedo
	sparc specific
	# mknod tcp@0:tcp c 11 42
	intel specific
	# mknod tcp@0:tcp c 42 0
	# cd ../../dev
	# ln -s ../devices/psuedo/tcp@0:tcp tcp

This would take up alot of time each time you had to build a chroot. Luckily, there are scripts to do this for us, downloadable here [ref 2]. I have made some modifications and added a perm_fix script that copies the current permissions of everything it re-creates. The modified package should be used and can be downloaded here at SecurityFocus: cell.tar.gz.

Adding your specific solaris interface to the /cell/snort/devlist file will be required unless you have a device matching bge, hme, qfe, eri, ce or elxl. To find your interface do the following: 

	# ifconfig -a
	lo0: flags=1000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4> mtu 8232 index 1
			inet 127.0.0.1 netmask ff000000 
	elxl0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
			inet 192.168.43.7 netmask ffffff00 broadcast 192.168.43.255
	elxl1: flags=1004843<UP,BROADCAST,RUNNING,MULTICAST,DHCP,IPv4> mtu 1500 index 3
			inet xx.xxx.xxx.x netmask fffff800 broadcast xx.xxx.xxx.255

Let's build the cell inside /export/home/ids. Download the cell.tar.gz package to root, then do the following: 

	# gzip -dc cell.tgz | tar -xf -
	# cd cell
	# ./make_cell snort /export/home/ids

7.0 Installing the Snort binaries into the chroot

We now have a minimal environment for Snort in /export/home/ids. All we need to do now is transfer the Snort binary to /export/home/ids/usr/local/bin. Let's give it a test run using: 

	# chroot /export/home/ids /usr/local/bin/snort -D -b -i bge1 \ 
	  -c /usr/local/etc/snort.conf -u nobody -g nobody -l /tmp

Note the Snort switches used:

	-D         Run Snort in background (daemon) mode
	-b         Log packets in tcpdump format (much faster!)
	-c <rules> Use Rules File <rules>
	-i <if>    Listen on interface <if>
	-t <dir>   Chroots process to <dir> after initialization
	-u <uname> Run Snort uid as <uname> user (or uid) after initialization
	-l <ld>    Log to directory <ld>
	-g <gname> Run Snort gid as <gname> group (or gid) after initialization

The prompt returned and thus no Snort process is running. What went wrong? Well, three files were purposely left out from /export/home/ids/usr/local/etc. I left out unicode.map, snort.conf and virus.rules. The file virus.rules can be left out by commenting it out in snort.conf. But let's see if we can use truss to see what really happened, because when dealing with chroots you will need a handy tool like truss to see what's really going on. Truss is a utility that executes a command and produces a trace of the system calls, signals and machine faults.

Note the truss switches used:

	-f    Follows all children created by fork() or vfork()
	-a    Shows the argument strings that are passed in each exec() system call
	-e    Shows the environment strings that are passed in each exec() system call
	-vall Verbose syscall. In this case all syscalls.

	# truss -fae -vall chroot /export/home/ids /usr/local/bin/snort -D -b -i bge1 \ 
	  -c /usr/local/etc/snort.conf -u nobody -g nobody -l /tmp
	12099:  execve("/usr/sbin/chroot", 0xFFBEFB74, 0xFFBEFBB4)  argc = 15
	12099:   argv: chroot /export/home/ids /usr/local/bin/snort -D -b -i
	12099:    bge1 -c /usr/local/etc/snort.conf -u nobody -g nobody -l
	12099:    /tmp
	12099:   envp: HOME=/ HZ=100 LC_COLLATE=en_US.ISO8859-15
	12099:    LC_CTYPE=en_US.ISO8859-15 LC_MESSAGES=C
	12099:    LC_MONETARY=en_US.ISO8859-15 LC_NUMERIC=en_US.ISO8859-15
	12099:    LC_TIME=en_US.ISO8859-15 LOGNAME=root MAIL=/var/mail/root
	12099:    PATH=/usr/sbin:/usr/bin SHELL=/sbin/sh TERM=xterm
	12099:    TZ=US/Eastern _INIT_NET_STRATEGY=none _INIT_PREV_LEVEL=S
	12099:    _INIT_RUN_LEVEL=3 _INIT_RUN_NPREV=0 _INIT_UTS_ISA=sparc
	12099:    _INIT_UTS_MACHINE=sun4u _INIT_UTS_NODENAME=webtkr5p
	12099:    _INIT_UTS_PLATFORM=SUNW,Sun-Fire-V210 _INIT_UTS_RELEASE=5.8
	12099:    _INIT_UTS_SYSNAME=SunOS _INIT_UTS_VERSION=Generic_108528-18
	12099:    HOSTTYPE=sun4 VENDOR=sun OSTYPE=solaris MACHTYPE=sparc
	12099:    SHLVL=1 PWD=/export/spare USER=root GROUP=other HOST=webtkr5p
	12099:    REMOTEHOST=172.27.100.74
12099:  mmap(0x00000000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, \ 
MAP_PRIVATE|MAP_ANON, -1, 0) = 0xFF3A0000
		12099:  resolvepath("/usr/lib/ld.so.1", "/usr/lib/ld.so.1", 1023) = 16
		12099:  open("/var/ld/ld.config", O_RDONLY)             Err#2 ENOENT
		12099:  open("/usr/lib/libc.so.1", O_RDONLY)            = 3
		12099:  fstat(3, 0xFFBEF29C)                            = 0
	12099:      d=0x00800005 i=484614 m=0100755 l=1  u=0     g=2     sz=1146168
	12099:          at = Apr 20 12:52:09 EDT 2005  [ 1114015929 ]
	12099:          mt = Aug  8 11:01:36 EDT 2002  [ 1028818896 ]
	12099:          ct = Dec 17 12:39:34 EST 2002  [ 1040146774 ]
	12099:      bsz=8192  blks=2256  fs=ufs
	12099:  mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) \ 
	= 0xFF390000
	12099:  mmap(0x00000000, 794624, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) \ 
	= 0xFF280000
	12099:  mmap(0xFF33A000, 24652, PROT_READ|PROT_WRITE|PROT_EXEC, \ 
	MAP_PRIVATE|MAP_FIXED, 3, 696320) = 0xFF33A000
	12099:  munmap(0xFF32A000, 65536)                       = 0
	12099:  memcntl(0xFF280000, 113332, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0
	12099:  close(3)                                        = 0
	12099:  open("/usr/lib/libdl.so.1", O_RDONLY)           = 3
	12099:  fstat(3, 0xFFBEF29C)                            = 0
	12099:      d=0x00800005 i=484626 m=0100755 l=1  u=0     g=2     sz=5296
	12099:          at = Apr 20 12:52:09 EDT 2005  [ 1114015929 ]
	12099:          mt = Sep  6 17:41:11 EDT 2002  [ 1031348471 ]
	12099:          ct = Dec 17 12:39:34 EST 2002  [ 1040146774 ]
	12099:      bsz=8192  blks=12    fs=ufs
	12099:  mmap(0xFF390000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, \ 
	0) = 0xFF390000
	12099:  close(3)                                        = 0
	12099:  open("/usr/platform/SUNW,Sun-Fire-V210/lib/libc_psr.so.1", O_RDONLY) = 3
	12099:  fstat(3, 0xFFBEF12C)                            = 0
	12099:      d=0x00800005 i=377643 m=0100755 l=1  u=0     g=2     sz=4852
	12099:          at = Apr 20 12:52:09 EDT 2005  [ 1114015929 ]
	12099:          mt = Nov 12 18:51:58 EST 2002  [ 1037145118 ]
	12099:          ct = Dec 17 12:36:16 EST 2002  [ 1040146576 ]
	12099:      bsz=8192  blks=10    fs=ufs
	12099:  mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, \ 
	MAP_PRIVATE, 3, 0) = 0xFF380000
	12099:  close(3)                                        = 0
	12099:  getuid()                                        = 0 [0]
	12099:  chroot("/export/home/ids")                      = 0
	12099:  chdir("/")                                      = 0
	12099:  execve("/usr/local/bin/snort", 0xFFBEFB7C, 0xFFBEFBB4)  argc = 13
	12099:   argv: /usr/local/bin/snort -D -b -i bge1 -c
	12099:    /usr/local/etc/snort.conf -u nobody -g nobody -l /tmp
	12099:   envp: HOME=/ HZ=100 LC_COLLATE=en_US.ISO8859-15
	12099:    LC_CTYPE=en_US.ISO8859-15 LC_MESSAGES=C
	12099:    LC_MONETARY=en_US.ISO8859-15 LC_NUMERIC=en_US.ISO8859-15
	12099:    LC_TIME=en_US.ISO8859-15 LOGNAME=root MAIL=/var/mail/root
	12099:    PATH=/usr/sbin:/usr/bin SHELL=/sbin/sh TERM=xterm
	12099:    TZ=US/Eastern _INIT_NET_STRATEGY=none _INIT_PREV_LEVEL=S
	12099:    _INIT_RUN_LEVEL=3 _INIT_RUN_NPREV=0 _INIT_UTS_ISA=sparc
	12099:    _INIT_UTS_MACHINE=sun4u _INIT_UTS_NODENAME=webtkr5p
	12099:    _INIT_UTS_PLATFORM=SUNW,Sun-Fire-V210 _INIT_UTS_RELEASE=5.8
	12099:    _INIT_UTS_SYSNAME=SunOS _INIT_UTS_VERSION=Generic_108528-18
	12099:    HOSTTYPE=sun4 VENDOR=sun OSTYPE=solaris MACHTYPE=sparc
	12099:    SHLVL=1 PWD=/export/spare USER=root GROUP=other HOST=webtkr5p
	12099:    REMOTEHOST=172.27.100.74
	12099:  mmap(0x00000000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, \ 
	MAP_PRIVATE|MAP_ANON, -1, 0) = 0xFF3A0000
	12099:  resolvepath("/usr/lib/ld.so.1", "/usr/lib/ld.so.1", 1023) = 16
	12099:  open("/var/ld/ld.config", O_RDONLY)             Err#2 ENOENT
	12099:  open("/usr/local/lib/libpcre.so.0", O_RDONLY)   Err#2 ENOENT
	12099:  open("/usr/lib/libpcre.so.0", O_RDONLY)         Err#2 ENOENT
	ld.so.1: /usr/local/bin/snort: fatal: libpcre.so.0: open failed: No such \ 
	file or directory
	12099:  write(2, " l d . s o . 1 :   / u s".., 91)      = 91
	12099:  getpid()                                        = 12099 [12098]
	12099:          *** process killed ***

Above in red, it looks like the attempt to open libpcre.so.0 ending in a Err#2 ENOENT, was critical. Note that not all Err# after a system call are critical, however. If you notice right above it an open of /var/ld/ld.config also failed with Err#2 ENOENT, but was not critical. Learning which is critical and which isn't, comes with using truss more. As a guideline, just check the error with grep, as below, and assess whether that sounds like the problem or not. It seems I also forgot a file other than the 3 mentioned above. We will copy libpcre.so.0 from our compiler system to /export/home/ids/usr/lib. Notice it checks for /usr/local/lib/libpcre.so.0 and /usr/lib/libpcre.so.0, so placing it in either would be ok. Let's give it another try: 

	# grep ENOENT /usr/include/sys/errno.h
	#define ENOENT  2       /* No such file or directory            */

	# truss -fae -vall chroot /export/home/ids /usr/local/bin/snort -D -b -i bge1 \ 
	  -c /usr/local/etc/snort.conf -u nobody -g nobody -l /tmp
	begin snipped ... 
	12330:          dat:  maxlen=1280 len=108  buf=0xFFBEC728: " A p r   2 0   1"..
	12330:  open("/var/run/syslog_door", O_RDONLY)          Err#2 ENOENT
	12330:  brk(0x001ED350)                                 = 0
	12330:  brk(0x001EF350)                                 = 0
	12330:  brk(0x001EF350)                                 = 0
	12330:  brk(0x001FF350)                                 = 0
	12330:  brk(0x001FF350)                                 = 0
	12330:  brk(0x0020F350)                                 = 0
	12330:  open("/usr/local/etc/unicode.map", O_RDONLY)    Err#2 ENOENT
	12330:  fstat(4, 0xFFBEC8D0)                            = 0
	12330:      d=0x00800000 i=21702 m=0020666 l=1  u=0     g=3     rdev=0x00540000
	12330:          at = Apr 20 12:50:38 EDT 2005  [ 1114015838 ]
	12330:          mt = Apr 20 12:50:38 EDT 2005  [ 1114015838 ]
	12330:          ct = Apr 20 12:50:38 EDT 2005  [ 1114015838 ]
	12330:      bsz=8192  blks=0     fs=ufs
	12330:  time()                                          = 1114032987
	12330:  putmsg(4, 0xFFBEBF88, 0xFFBEBF7C, 0)            = 0
	12330:          ctl:  maxlen=24   len=24   buf=0xFFBEC8B8: "\0\0\0\0\0\0\010"..
	12330:          dat:  maxlen=1280 len=176  buf=0xFFBEC3B8: " A p r   2 0   1"..
	12330:  open("/var/run/syslog_door", O_RDONLY)          Err#2 ENOENT
	12330:  llseek(0, 0, SEEK_CUR)                          = 0
	12330:  llseek(5, 0xFFFFFFFFFFFFE267, SEEK_CUR)         = 615
	12330:  _exit(1)

Above in red, we copied libpcre.so.0 but we still don't have unicode.map. Let's do that and try again. 

	# truss -fae -vall chroot /export/home/ids /usr/local/bin/snort -D -b \ 
	  -i bge1 -c /usr/local/etc/snort.conf -u nobody -g nobody -l /tmp
	begin snipped ...
	12236:  sysinfo(SI_SRPC_DOMAIN, "", 256)                = 1
	12236:  setgroups(1, 0x001E6A60)                        = 0
	12236:           60001
	12236:  setuid(60001)                                   = 0
	12236:  open("/tmp/alert", O_WRONLY|O_APPEND|O_CREAT, 0666) Err#13 EACCES
	12236:  fstat(4, 0xFFBEED18)                            = 0
	12236:      d=0x00800000 i=21702 m=0020666 l=1  u=0     g=3     rdev=0x00540000
	12236:          at = Apr 20 12:50:38 EDT 2005  [ 1114015838 ]
	12236:          mt = Apr 20 12:50:38 EDT 2005  [ 1114015838 ]
	12236:          ct = Apr 20 12:50:38 EDT 2005  [ 1114015838 ]
	12236:      bsz=8192  blks=0     fs=ufs
	12236:  time()                                          = 1114030575
	12236:  putmsg(4, 0xFFBEE3D0, 0xFFBEE3C4, 0)            = 0
	12236:          ctl:  maxlen=24   len=24   buf=0xFFBEED00: "\0\0\0\0\0\0\010"..
	12236:          dat:  maxlen=1280 len=141  buf=0xFFBEE800: " A p r   2 0   1"..
	12236:  open("/var/run/syslog_door", O_RDONLY)          Err#2 ENOENT
	12236:  llseek(0, 0, SEEK_CUR)                          = 0
	12236:  llseek(6, 0xFFFFFFFFFFFFE3C7, SEEK_CUR)         = 9159
	12236:  _exit(1)

We have all the files now, so now what's wrong? Using truss and a little patience it is clear we can see what is missing from our chrooted environment. Without truss or strace [ref 3] this would be a difficult task. The line in red above looks like our problem, but once again, what does it mean? It tries to open /tmp/alert and receives an Err #13 EACCES response. Let's see what that means, using grep below. You will quickly discover that it means permission denied. A listing on the directory shows that only root can write in /export/home/ids/tmp (permission: drwxr-xr-x = 755 for user root and group other), but our Snort process is running as the user, nobody and the (-l /tmp) on our command line tries to create log files in /tmp of the chroot. To fix this, let's set the chrooted /tmp directory to the same permission as the system directory /tmp using chmod. That should take care of this error and our Snort process should finally be running in the chroot (full listing). 

	# grep EACCES /usr/include/sys/errno.h
	#define EACCES  13      /* Permission denied                    */
	
	ls -ld /export/home/ids/tmp
	drwxr-xr-x   2 root     other        512 Apr 21 17:26 /export/home/ids/tmp
	# chmod 1777 tmp

The following scripts automate the startup of Snort and the plumbing of the non-IP'ed interfaces. The /etc/rc3.d/S99sniff script is needed if using and interface without an IP address. Only /etc/rc3.d/S99snort is needed if automating Snort for an interface with an IP address.

7.1 A look at utilizing the chroot method integrated into snort

Snort also comes with its own chrooting method after intialization. Using this technique does not require a chrooted environment, it only requires a chroot path. I'm sure you are then asking why one would go through all the work needed to build a chrooted environment? Well, let's take a look at Snort's chrooting method. This is the command line we'll use to start it: 

	# /export/home/ids/usr/local/bin/snort -D -b -i bge1 \ 
	  -c /export/home/ids/usr/local/etc/snort.conf -u nobody -g nobody \ 
	  -l /export/home/ids/tmp -t /export/home/ids

This will fail to start Snort because the Snort process now needs to initialize before it can chroot. In other words, it needs the libraries outside the chroot. Therefore this works after copying the library libpcre.so.0 to the system's /usr/lib or /usr/local/lib directory.

After fixing this, Snort starts. However, the portscan file is being written to /tmp/portscan instead of /export/home/ids/tmp/portscan, the chroot. This can be fixed by changing the snort.conf entry (preprocessor portscan: $INTERNAL 5 4 /tmp/portscan) to /export/home/ids/tmp/portscan. Please note that all these inconsistencies with reading some things inside the chroot and some outside the chroot lead this author to believe that the chroot method built into Snort has allowed the running daemon to see both inside and outside the chroot environment. So the question is, can an attack on the process do the same? This method still seems vulnerable to buffer overflows because Snort is still really running in the real file system. This means a hacker could still possibly work their way back to executing a shell or other malicious code. The chrooted environment as presented in this article requires more work to setup, but pays off by being more secure because Snort does not know its running inside a bubble. This way, one can be sure that Snort is definitely limited to the contents of the chroot which does not contain a shell and thus results in the daemon being more trustworthy.

8.0 Conclusion

The concept of chrooting is not new and everything done in this article using Solaris works very similarly on other flavors of Unix (Linux, BSD, AIX, and so on). The library and device requirements will be different but everything else is pretty much the same. Let's briefly look at the steps we've taken to secure our Snort IDS. We created a minimal clone of the file system and the devices that would sustain the Snort daemon. Next, we ran the Snort daemon as "nobody," a minimal privilege user. Finally, when possible we ran it on an interface without an IP address. What we built, in the end, is a secure IDS that adds minimal risk to the network perimeter. It also serves as a stealth syslog server for our Cisco border devices. The Cisco units require a syslog server entry pointing to a fake IP on the network and a static ARP entry binding the fake IP with the MAC address of the Snort interface. On the Snort machine, you add a simple Snort config, logging for traffic destined for the fake IP to a specified file. This file will contain your Cisco syslog messages. This IDS is also used as a sniffer if needed for troubleshooting on any of the connected networks.

Sun Tools & Products Forums - Anyone installed SNORT on Solaris 10

moosie_au
Posts:74
Registered: 2/25/04 		Anyone installed SNORT on Solaris 10??
Aug 23, 2005 7:31 PM
Click to email this message

Hi Im installing SNORT 2.4.0 on Solaris 10, ive been following the SNORT-ACID install on Solaris 9 walkthru and have come up against a few problems,
Ive been able to install the Mysql side of things but now when i try to install SNORT , i issue the ./configure --with-mysql=/usr/local/mysql --host=sparc-sun-solaris2.10 all seems to go well until i issue the make command...then i receive the error:

ar cru libsfutil.a sfghash.o sfhashfcn.o sflsq.o sfmemcap.o sfthd.o sfxhash.o ipobj.o mwm.o sfksearch.o acsmx.o acsmx2.o mpse.o util_math.o util_net.o util_str.o asn1.o sfeventq.o sfsnprintfappend.o
make[3]: ar: Command not found
make[3]: *** [libsfutil.a] Error 127
make[3]: Leaving directory `/usr/local/snort-2.4.0/src/sfutil'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/usr/local/snort-2.4.0/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/usr/local/snort-2.4.0'
make: *** [all] Error 2

has anyone successfully installed SNORT on Solaris 10 ?? if so how do you get around this error??

Any any help would be appreciated. Thanks in advance.

mAbrante
Posts:734
Registered: 03/03/05 		Re: Anyone installed SNORT on Solaris 10??
Aug 23, 2005 11:41 PM (reply 1 of 7)
Click to email this message

I think you need to add /usr/ccs/bin to your PATH, thats where the "ar" command lives.

//Magnus

moosie_au
Posts:74
Registered: 2/25/04 		Re: Anyone installed SNORT on Solaris 10??
Aug 25, 2005 5:28 PM (reply 2 of 7)
Click to email this message

I have /usr/ccs/bin in my path, my path is:
PATH=$HOME:/usr/local/bin/:/usr/ccs/bin/:/bin/:/sbin/:/usr/acb/:/usr/ucb/bin/:/ u
sr/bin/:/usr/sbin/:/opt/sfw/bin/:/opt/bin/:/opt/sbin/:/opt/rsc/bin/:/usr/openwi n
/bin/:/usr/local/sbin/:/usr/local/mysql/bin/:$PATH
export PATH
moosie_au
Posts:74
Registered: 2/25/04 		Re: Anyone installed SNORT on Solaris 10??
Aug 25, 2005 5:32 PM (reply 3 of 7)
Click to email this message

I checked the install directories where i had installed my other packages....i.e. /usr/local/
I found that snort was looking at /usr/local/bin instead of /usr/ccs/bin for ar
so i just made a symbolic link in /usr/local/bin for ar and then it seemed to work fine

Solaris 10 Sparc Success - Snort Forums Archive

Posted by jritorto on March 16, 2006 17:48:31

Hi,
I deployed 2.4.3 on Solaris 10 1/06 x86 with BASE a couple of weeks ago to try for better reliability / performance than we were getting with former Linux installation. Pretty straightforward. Imagine its same on SPARC.. I'll cut/paste my installation notes for you below. Note that they're a bit stale because i've tweaked for multiple interfaces since writing them. Note links at bottom for references I used to prepare these instructions..

If you don't feel like building source, install the blastwave.org package via pkg-get. That''s really easy and all you have to do afterwards is dl the rules and adjust snort.conf.

Jacob Ritorto

*******************************
Solaris 10 (x86) 1/06 Snort/BASE build and install notes


This procedure leverages mysql, libtool and openssl shipped with Solaris 10. Naturally, you should adjust pathnames to reflect optional software versions you use.


1. Download sources for adodb, base, snort, pcre, libpcap, libxml2, php.
2. Set your PATH environment variable to something that works for you.
1.

For example,

/usr/sbin:/usr/bin:/opt/csw/bin:/usr/sfw/bin:/usr/ccs/bin
3.

Build and install libpcap:
1.

./configure –prefix=/opt/libpcap-0.9.4 && gmake && gmake install
4.

Build and install pcre:
1.

http://forum.sun.com/thread.jspa?messageID=104833
2.

./configure –prefix=/opt/pcre-6.3 && gmake && gmake install

5.

Build and install snort:
1.

Set your LDFLAGS environment variable to -R/opt/pcre-6.3/lib
2.

./configure --prefix=/opt/snort-2.4.3 --with-openssl --with-libpcap-includes=/opt/libpcap-0.9.4/include --with-libpcap-libraries=/opt/libpcap-0.9.4/lib --with-libpcre-includes=/opt/pcre-6.3/include --with-libpcre-libraries=/opt/pcre-6.3/lib –with-mysql=/usr/sfw && gmake && gmake install
3.

Unset your LDFLAGS environment variable.
4.

Go to snort.com to download rules. Untar them into /opt/snort-2.4.3/rules

6.

Fire up & tweak mysql:
1.

/usr/sfw/bin/mysql_install_db
2.

groupadd mysql
3.

useradd -g mysql mysql
4.

chgrp -R mysql /var/mysql
5.

chmod -R 770 /var/mysql
6.

installf SUNWmysqlr /var/mysql d 770 root mysql
7.

cp /usr/sfw/share/mysql/my-medium.cnf /var/mysql/my.cnf
8.

/usr/sfw/sbin/mysqld_safe --user=mysql &
9.

mysqladmin -u root password 'password'
10.

mysqladmin -u root -h `hostname` password 'password'
11.

set mysql to stop/start at boot, etc: (not the proper smf(5) way; sorry; please fix*.):
1.

ln /etc/sfw/mysql/mysql.server /etc/rc3.d/S99mysql
2.

ln /etc/sfw/mysql/mysql.server /etc/rc0.d/K00mysql
3.

ln /etc/sfw/mysql/mysql.server /etc/rc1.d/K00mysql
4.

ln /etc/sfw/mysql/mysql.server /etc/rc2.d/K00mysql
5.

ln /etc/sfw/mysql/mysql.server /etc/rcS.d/K00mysql
12.

Cd to snort source directory. mysql -u root -p < schemas/create_mysql snort
13.

mysql -u root -p snort

14.

mysql> grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort@localhost;
15.

mysql> set PASSWORD FOR snort@localhost=PASSWORD('password');
16.

mysql> flush privileges;
17.

mysql> exit

7.

Edit the /opt/snort-2.4.3/rules/snort.conf file.
1.

output database: log, mysql, dbname=snort user=snort password=password host=localhost
2.

output database: alert, mysql, dbname=snort user=snort password=password host=localhost
3.

comment out ftp_telnet preprocessor section
4.

comment out smtp preprocessor section

8.

Test snort & see if it's making database entries:
1.

snort -c /opt/snort-2.4.3/rules/snort.conf
2.

echo "SELECT count(*) FROM event" | mysql -u root -p snort

9.

Build a newer libxml2
1.

./configure –prefix=/opt/libxml2-2.6.23 && gmake && gmake install
10.

Build, install and configure php and pear:

1.

./configure --prefix=/opt/php-5.1.2 --enable-memory-limit=yes --with-apxs2=/usr/apache2/bin/apxs --with-gettext=/usr/bin/gettext --with-exif --without-mm --with-mysql=/usr/sfw --with-openssl=/usr/sfw --with-zlib --with-jpeg-dir=/usr/sfw --with-png-dir=/usr/sfw --with-exec-dir=/opt/php-5.1.2/libexec --enable-cli --enable-sockets --with-libxml-dir=/opt/libxml2-2.6.23 –with-gd && gmake && gmake install
2.

/opt/php-5.1.2/bin/pear install Image_Color
3.

/usr/local/php/bin/pear install Log
4.

/usr/local/php/bin/pear install Numbers_Roman
5.

/usr/local/php/bin/pear install http://pear.php.net/get/Numbers_Words-0.13.1.tgz
6.

/usr/local/php/bin/pear install http://pear.php.net/get/Image_Graph-0.3.0dev4.tgz

11.

Install BASE by untarring it into /var/apache2/htdocs
12.

Install adodb by untarring it into /var/apache2/htdocs
13.

copy /var/apache2/htdocs/base/base_conf.php.dist to base_conf.php and edit:
1.

$Dblib_path Full path to the ADOdb installation "/var/apache2/htdocs/adodb"
2.

$Dbtype Type of database used "mysql"
3.

$Use_Auth_System Set to 1 to force users to authenticate to use BASE 1
4.

$BASE_urlpath The root URI of your site "/base"
5.

$alert_dbname The alert database name "snort"
6.

$alert_host The alert database server "localhost"
7.

$alert_port The port where the database is stored (Leave blank if you're not running MySQL on a network socket.) ""
8.

$alert_user The username for the alert database "snort"
9.

$alert_password The password for the username "snort_user_password"


References:

http://meljr.com/~meljr/AMPSolaris10.html

http://www.sun.com/bigadmin/features/articles/intrusion_detection.html

http://www.sun.com/bigadmin/features/articles/snort_base.html

http://forum.sun.com/thread.jspa?messageID=104833

* http://www.sun.com/bigadmin/content/submitted/mysql_smf_tip.html

Sparc Solaris 9 snort compilation problems. - Snort Forums Archive

Posted by gkout on April 03, 2005 11:21:21

I m compiling snort on a solaris 9 box (patched with latest patches) and I have configured snort with configure --with-mysql=/usr/local/mysql cause I want to implement it along with acid. Though the configure runs smooth with no probs I get the following error when I run make:
... (truncated)
"make[3]: Entering directory `/downloads/snort-2.3.2/src'
gcc -g -O2 -Wall -L/usr/local/lib -R/usr/local/lib -lpcre -L/usr/local/mysql/lib/mysql -o snort codes.o debug.o decode.o log.o mstring.o parser.o plugbase.o snort.o snprintf.o strlcatu.o strlcpyu.o tag.o ubi_BinTree.o ubi_SplayTree.o util.o detect.o signature.o mempool.o sf_sdlist.o fpcreate.o fpdetect.o pcrm.o byte_extract.o sfthreshold.o packet_time.o event_wrapper.o event_queue.o inline.o output-plugins/libspo.a detection-plugins/libspd.a preprocessors/libspp.a preprocessors/flow/portscan/libportscan.a preprocessors/flow/libflow.a parser/libparser.a preprocessors/HttpInspect/libhttp_inspect.a sfutil/libsfutil.a -lmysqlclient -lz -lpcre -lpcap -lm -lsocket -lnsl -lresolv
Undefined first referenced
symbol in file
SSL_load_error_strings /usr/local/mysql/lib/mysql/libmysqlclient.a(viosslfactories.o)"

I found a post that says to add the following line after the INCLUDES in the preprocessor section in configure file.
LIBS="$LIBS -lresolve"
but no good. I still get the same error.
I have installed all the libs for gcc (libtools, glib) and gmake autoconf etc.
Tried both gcc 2.95.3. and gcc 3.2.3 but didn't work out.
Any suggestions would be appreciated.
Thank you all.
G.K.

Posted by SenthilPrabuS on April 04, 2005 00:21:24

Hi,
The error occurs because, MySQL was build with SSL support on your machine. Also, compiler looks for /usr/local/mysql/lib/mysql/libmysqlclient.a. So if You dont have libmysqlclient.sl library, then you fill face such problems. So place a copy of libmysqlclient.sl there to solve it or.

Another solution is to edit the configure file as below. Rerun the configure script again and try gmake.

Before: LIBS="${LIBS} -lmysqlclient"
After: LIBS="${LIBS} -lmysqlclient -lssl -lcrypto"

Hope, this helps......

--
Senthil Prabu.S

Posted by gkout on April 05, 2005 03:32:12

Thanks Senthil. This worked just fine and the snort is up and running with acid.
Do you know of any documentation about configuring/compiling ( e.g. the -lsssl and -lcrypto ) and gcc? Thanxs for your help, really appreciate it.

Snort Installation and Basic Usage Part One by Hal Flynn 2000-07-31

Gathering the Required Software
Snort www.snort.org
This paper is based on the most recent version of Snort, v1.6.6.2

libpcap ftp://ftp.ee.lbl.gov/libpcap.tar.Z
Snort requires lipbcap for packet capture. BSD derivatives typically include libpcap; Linux typically does not
After downloading the required software packages store them in /usr/local 

Installation
Step 1 - Install libpcap (skip to Step 2 if you already have libpcap installed)
# gzip -d -c libpcap.tar.Z | tar xvf -
# cd libpcap-0.4/
# ./configure
# make
# make install
# make install-incl
# make install-man

Step 2 - install Snort
# gzip -d -c snort-1.6.2.2.tar.gz | tar xvf -
# cd snort-1.6.2.2/
# ./configure
# make
# make install

Recommended Links

Google matched content

Softpanorama Recommended

Top articles

Sites

Solaris 10 Sparc Success - Snort Forums Archive

[PDF] SNORT-ACID install on Solaris9

Snort

Author
Debian, Snort, Barnyard, BASE, & Oinkmaster Setup Guide Andy Firman
Snort Install on FreeBSD Joshua Abraham
Snort 2.3.2/2.4.3 Install on FreeBSD 5.4 and 6.0 Henry Orlando Acevedo Lopez
Oinkmaster Installation and Configuration Guide Patrick S. Harper
Snort, Apache, SSL, PHP, MySQL, and BASE Install on CentOS 4, RHEL 4 or Fedora Core Patrick S. Harper
Snort, Apache, PHP, MySQL, ACID on Solaris 9 Installation Guide Guillaume Rix
Installing Freebsd, Mysql, and Snort Tutorial Keith Tokash
Snort Installation Manual - Snort, MySQL, Redhat 7.3 Steven J. Scott
Snort's Place in a Windows 2000 Environment Jon Bull
ACID: Installation and Configuration Roman Danyliw
Snort, MySQL 5, Apache, and BASE for Gentoo Linux Chris Vespermann

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

Copyright © 1996-2021 by Softpanorama Society. www.softpanorama.org was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

 You can use PayPal to to buy a cup of coffee for authors of this site

Disclaimer:

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last updated: March 12, 2019