Intrusion Detection

[MaindotC]

hello could you supply me with the all the terminal commands you use to install base and apache and also the pear modules

This guide is the one I used to install snort - it's not much different than the OP. The comment on the bottom by Angry shows which perl commands to execute in order for BASE to work properly.

[newbux]

thanks for the link i tried but i guess it didnt work because i have intrepid or something. so i went and tried to do the OP again but got an error when i tried to compile snort i think i did everything as described in the post i don't know why i received the error message can you help me out.

terminal code in OP:

cd /usr/src/snort-2.8.3
./configure -enable-dynamicplugin --with-mysql
make
make install

error:

In function ‘open’,
inlined from ‘server_stats_save’ at server_stats.c:349:
/usr/include/bits/fcntl2.h:51: error: call to ‘__open_missing_mode’ declared with attribute error: open with O_CREAT in second argument needs 3 arguments
make[4]: *** [server_stats.o] Error 1
make[4]: Leaving directory `/usr/src/snort-2.8.3.1/src/preprocessors/flow/portscan'
make[3]: *** [install-recursive] Error 1
make[3]: Leaving directory `/usr/src/snort-2.8.3.1/src/preprocessors/flow'
make[2]: *** [install-recursive] Error 1
make[2]: Leaving directory `/usr/src/snort-2.8.3.1/src/preprocessors'
make[1]: *** [install-recursive] Error 1
make[1]: Leaving directory `/usr/src/snort-2.8.3.1/src'
make: *** [install-recursive] Error 1

[MaindotC]

Anything dealing with libraries or source code is a little over my head. I know how to use Ubuntu, but I don't know anything about development. Try dev section or devs on irc?

[topimiring]

is it possible to deploy snort as distributed IDS ?

[bodhi.zazen]

is it possible to deploy snort as distributed IDS ?

Yes.

http://www.securityfocus.com/infocus/1640

http://www.securityfocus.com/infocus/1643

[topimiring]

@bodhi.zazen : THANKS bro ..

[bodhi.zazen]

@bodhi.zazen : THANKS bro ..

You are most welcome.

[newbux]

i decided to try and finish the tutorial even though i received a error when compiling snort and when i was editing /etc/snort/snort.conf i couldnt save the changes because i didnt have the permissions. im logged in as administrator do you know why maybe thats why the errors are thier when i try to compile it thanks

[bodhi.zazen]

i decided to try and finish the tutorial even though i received a error when compiling snort and when i was editing /etc/snort/snort.conf i couldnt save the changes because i didnt have the permissions. im logged in as administrator do you know why maybe thats why the errors are thier when i try to compile it thanks

You have to run the commands in this tutorial as root.

Either prefix every command with sudo

sudo command

or obtain a root shell with

sudo -i

[newbux]

the directions in the tutorial i was working on were

Open /etc/snort/snort.conf with your favorite text editor (nano, vi, vim, etc.).

when i made the changes i tried to save them and close the document but a pop box said that i did not have the correct permissions.

so i did not use the terminal to edit it how come i dont have permissions even if im logged in as administrator.thanks