| Git Clone URL: | https://aur.archlinux.org/snort.git (read-only, click to copy) |
|---|---|
| Package Base: | snort |
| Description: | A lightweight network intrusion detection system. |
| Upstream URL: | https://www.snort.org/snort3 |
| Licenses: | GPL |
| Submitter: | Snowman |
| Maintainer: | robertfoster |
| Last Packager: | robertfoster |
| Votes: | 64 |
| Popularity: | 0.143170 |
| First Submitted: | 2012-11-16 17:33 (UTC) |
| Last Updated: | 2022-04-17 08:08 (UTC) |
It does not compile:
make[1]: Leaving directory '/var/cache/private/pamac/snort/src/snort3-3.1.22.0/build'
make: *** [Makefile:156: all] Error 2
make: Leaving directory '/var/cache/private/pamac/snort/src/snort3-3.1.22.0/build'
==> ERROR: A failure occurred in build().
Aborting...
Oooh, man, this sucks... Is this package both out-of-date and abandonded? I appreciate the effort people put into maintaining stuff, but this is not right and not typical. Please fix!
==> Retrieving sources...
-> Found snort3-3.1.19.0.tar.gz
-> Downloading snort-openappid-21442.tar.gz...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (22) The requested URL returned error: 404
==> ERROR: Failure while downloading https://snort.org/downloads/openappid/21442
Aborting...
-> error making: snort
yay -S snort 61,85s user 12,81s system 119% cpu 1:02,31 total
3.1.21.0 released
Latest announced version of snort is 3.1.18.0. But this package was just updated to 3.1.19.0.. why so?
Was able to get snort to install after messing with PKGBUILD.
Accidentally deleted my comment too :(
Hi,
I have installed snort3 as provided by the AUR package:
""" :~$ snort -V
,,_ -> Snort++ <- o" )~ Version 3.1.6.0 '''' By Martin Roesch & The Snort Team http://snort.org/contact#team Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using DAQ version 3.0.4 Using LuaJIT version 2.1.5 Using OpenSSL 1.1.1f 25 Mar 2021 Using libpcap version 1.9.1 (with TPACKET_V3) Using PCRE version 8.45 2021-06-15 Using ZLIB version 1.2.11 Using FlatBuffers 2.0.0 Using Hyperscan version 5.4.0 2021-01-13 Using LZMA version 5.2.5 """ So far so good but when I test the defaul configuration file: """ $ snort -c /etc/snort/snort.lua
The long output ends up with:
ERROR: Could not find requested DAQ module: pcap
FATAL: see prior 1 erros (0 warnings) Fatal Erro, Quitting.. """ instead of: """ Snort successfully validated the configuration (with 0 warnings). o")~ Snort exiting """
The same issue has been reported on Ubuntu 20.04 as well
Please advise,
@akeller - actually message is wrong. You have to edit this file. /etc/snort/homenet.conf and NOT snort.lua
In most cases you do not need to edit homenet.conf if using private addresses.
pulledpork also probably shouldn't be a requirement since the rules are incompatible with snort3. The requirement should be removed or replaced with pulledpork3
edit: I'm completely new to snort and could be wrong about the compatibility. But that seems to be the case.
The install gives this message:
You have to edit the HOME_NET variable in the /etc/snort/snort.conf file to reflect your local network.
but it seems that the conf file is now /etc/snort/snort.lua
@amish you're totally right, apologies. I added your username as contributor
Is there a reason for !makeflags to be in the options of the PKGBUILD ?
I built without it (meaning I built with my MAKEFLAGS, set to -j8) and it worked fine.
Hi robertfoster. You copied everything from my AUR package. Snort-nfqueue.
That is fine. But you didn't mention my name anywhere. i.e. you gave me no credits for studying snort 3 and putting lots of hardwork in configuring it etc.
Thats very bad.
For a 3.x package, see snort-nfqueue package.
systemd fails to start service as inline using /usr/lib/systemd/system/snort@.service as described in wiki. If I delete "ExecStartPre=/usr/sbin/ip link set up dev %I" the service will start.
[Unit]
Description=Snort IDS system listening on '%I'
[Service]
Type=simple
ExecStartPre=/usr/sbin/ip link set up dev %I
ExecStartPre=/usr/bin/ethtool -K %I gro off
ExecStart=/usr/bin/snort --daq-dir /usr/lib/daq/ -A fast -b -p -u snort -g snort -c /etc/snort/snort.conf -i %I -Q
[Install]
Alias=multi-user.target.wants/snort@%i.service
This works for me:
# Maintainer: robertfoster
# Contributor: Lukas Fleischer <archlinux at cryptocrack dot de>
# Contributor: Hugo Doria <hugo@archlinux.org>
# Contributor: Kessia 'even' Pinheiro <kessiapinheiro at gmail.com>
# Contributor: dorphell <dorphell@archlinux.org>
# Contributor: Gregor Ibic <gregor.ibic@intelicom.si>
# Contributor: Netboy3
# Contributor: Jaap Crezee <jaap@jcz.nl>
pkgname=snort
pkgver=2.9.16.1
pkgrel=1
pkgdesc='A lightweight network intrusion detection system.'
arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64' 'arm')
url='http://www.snort.org'
license=('GPL')
depends=('dbus' 'libdaq' 'libdnet' 'libgcrypt' 'libgpg-error' 'libnghttp2' 'libnl' 'libpcap' 'luajit' 'lz4' 'openssl' 'pcre' 'xz' 'zlib')
makedepends=('libtirpc')
backup=('etc/snort/snort.conf'
'etc/snort/threshold.conf'
'etc/snort/reference.config'
'etc/snort/classification.config'
'etc/snort/rules/emerging.conf')
options=('!makeflags' '!libtool')
install='snort.install'
source=("https://www.snort.org/downloads/snort/${pkgname}-${pkgver}.tar.gz"
"http://rules.emergingthreats.net/open/${pkgname}-2.9.0/emerging.rules.tar.gz"
'snort@.service'
)
build() {
cd "${srcdir}/${pkgname}-${pkgver}"
./configure --prefix=/usr \
--sysconfdir=/etc/snort \
--with-libpcap-includes=/usr/include/pcap \
--with-daq-includes=/usr/include \
--with-daq-libraries=/usr/lib/daq/ \
--disable-static-daq \
CPPFLAGS="$CPPFLAGS -I/usr/include/tirpc/"
make
}
package() {
cd "${srcdir}/${pkgname}-${pkgver}"
make DESTDIR="${pkgdir}" install
mkdir -p "${pkgdir}/"{etc/rc.d,etc/snort/rules}
install -d -m755 "${pkgdir}/var/log/snort"
install -D -m644 etc/{*.conf*,*.map} "${pkgdir}/etc/snort/"
cd "${srcdir}/${pkgname}-${pkgver}"
# init service file
install -D -m644 ../snort@.service $pkgdir/usr/lib/systemd/system/snort@.service
sed -i 's#/usr/local/lib/#/usr/lib/#' "${pkgdir}/etc/snort/snort.conf"
# emerginthreats rules
echo 'include $RULE_PATH/emerging.conf' >> "${pkgdir}/etc/snort/snort.conf"
cp ${srcdir}/rules/* "${pkgdir}/etc/snort/rules"
}
md5sums=('ec148a494cde9095fb590a51efa306de'
'SKIP'
'a847030a34396e6b2d1cacd272ad42da'
)
==> Making package: snort 2.9.16-2 (Sat Aug 8 09:52:46 2020)
==> Retrieving sources...
-> Downloading snort-2.9.16.tar.gz...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (22) The requested URL returned error: 404
==> ERROR: Failure while downloading https://www.snort.org/downloads/snort/snort-2.9.16.tar.gz
Aborting...
Error downloading sources: snort
@Strykar, download links for this package are just fine. You can try them out in the "Sources" section above and see that they work. If you have a problem with a dependent AUR package (like libdaq), then post it in the proper AUR package page, not here (it's not even the same maintainer).
Download links are outdated, for ex. daq is now at https://www.snort.org/downloads/snort/daq-2.0.7.tar.gz
Build of 2.9.16 now fails with GCC10. See https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=956d614c759705691a0c336c71bc2a176e71a56f for patching 2.9.16 so it can build under GCC10.
curl: (22) The requested URL returned error: 404 ==> ERROR: Failure while downloading https://www.snort.org/downloads/snort/snort-2.9.13.tar.gz
any plan to snort3?
==> ERROR: Failure while downloading https://www.snort.org/downloads/snort/snort-2.9.12.tar.gz
Aborting...
Error downloading sources: snort
I think there is a missing dependency:
ERROR! LuaJIT library not found. Go get it from http://www.luajit.org/ (or) Try compiling without openAppId using '--disable-open-appid' configure: error: "Fatal!"
I have installed luajit (https://www.archlinux.org/packages/community/x86_64/luajit/) manualy and it works.
Snort fail to install due to a 404 error from curl:
curl: (22) The requested URL returned error: 404
==> ERROR: Failure while downloading https://www.snort.org/downloads/snort/snort-2.9.11.1.tar.gz
Aborting...
Same here, unable to upgrade snort for the past few weeks...
I get an error during compilation. Is there a missing dependency?
sp_rpc_check.c:32:10: fatal error: rpc/rpc.h: No such file or directory
make[4]: *** [Makefile:487: sp_rpc_check.o] Error 1
:: failed to build snort package(s)
Pinned Comments