Re: snortsam and debian

[Erek Adams <erek () snort org>]

On Thu, 19 Jun 2003, Hans Steinraht wrote:

> hi,
> I have succesfully installed snort on a linux debian box and all is
> running well
>
> Next I like to install SnortSam to have the possibility to block ip's.
>
> My problem is: there is no deb-package for it.
> I could download the Snort sources and complile them by myself but then I
> miss the automatic updates for my rulesets from debian (apt)
>
> Does anyone has some ideas how to get SnortSam installed on a Debian
> machine, or are there maybe alternatives that can block ip addresses after
> Snort has detect something.

To be honest, roll you own.  Don't worry about a premade binary, as they
tend to give you more problems down the road and you end up building your
own eventually.

And a bit of serious advice--NEVER, EVER auto-update rules.  All it takes
is one bad rule and your entire IDS is down.  And how hard is:

        cd /tmp/rulestuff
        wget http://www.snort.org/dl/rules/snortrules-current.tar.gz
        tar -zxvf snortrules-current.tar.gz
        <examine the rules>
        <if Ok, then>
        mv * /etc/snort/rules/

If you just can't live without the auto-update, then consider the program
oinkmaster [0].  It does do rule updates, but it does it in a smart
manner....

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


[0]     http://www.algonet.se/~nitzer/oinkmaster/


-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users