How To Install Snort on Fedora 39

In this tutorial, we will show you how to install Snort on Fedora 39. Snort is a powerful open-source tool that serves as a network intrusion detection and prevention system. It analyzes network traffic in real-time, identifying a wide range of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, and OS fingerprinting attempts. The flexibility and robustness of Snort make it a valuable security tool for network administrators.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Snort on a Fedora 39.

Prerequisites

Before diving into the installation process, let’s ensure that you have everything you need:

• A server running one of the following operating systems: Fedora 39.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• You will need access to the terminal to execute commands. Fedora 39 provides the Terminal application for this purpose. It can be found in your Applications menu.
• A network connection or internet access to download the Snort repository.
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Snort on Fedora 39

Step 1. Before diving into the installation process, it’s crucial to ensure your Fedora 39 system is up-to-date. Regular system updates provide the latest features, improve system stability and patch security vulnerabilities. To update your Fedora system, open the terminal and execute the following command:

sudo dnf clean all
sudo dnf update

Step 2. Install Necessary Dependencies.

 Make sure all necessary dependencies are installed on your Fedora system:

sudo dnf groupinstall "Development Tools
sudo dnf install git libpcap-devel libdnet-devel

Step 3. Installing Snort on Fedora 39

With the prerequisites installed, clone the latest Snort 3 source code from GitHub using git:

git clone https://github.com/snort3/snort3.git

This command creates a directory named snort3 and downloads the latest Snort source code into it.

Change into the Snort source directory:

cd snort3

Before compiling, it’s a good practice to review the README.md file and other documentation for any specific compilation steps or requirements. Next, use the ./configure script to configure the software and create makefiles:

./configure

This script checks your system to ensure all the necessary prerequisites are met and prepares it for the installation. If the script runs successfully, compile the source code using the make command:

make

Finally, install Snort on your system using the make install command:

sudo make install

Step 4. Configuring Snort.

After installing Snort, the next step is to configure it. Start by creating the Snort configuration file at /etc/snort/snort.conf. This file contains various configuration directives that control how Snort behaves. You can use a text editor like nano or vi to create and edit this file.

Next, configure Snort rules and preprocessing directives. Snort rules define the patterns of network traffic that Snort should flag as suspicious, while preprocessing directives control how Snort processes network packets before applying the rules.

Finally, specify the network interfaces that Snort should monitor. This is typically done using the HOME_NET variable in the snort.conf file.

Step 5. Running Snort.

With Snort installed and configured, you can now run it. To test your installation, launch Snort in sniffer mode using the snort -v command. This command tells Snort to capture and display network packets without analyzing them.

To run Snort in intrusion detection mode, use the snort -c /etc/snort/snort.conf command. This command tells Snort to analyze network traffic according to the rules and configurations specified in the snort.conf file.

Snort also supports a variety of command-line options that allow you to customize its runtime behavior. For example, the -k option controls how Snort handles checksums, while the -l option specifies the directory where Snort should save its log files.

Congratulations! You have successfully installed Snort. Thanks for using this tutorial for installing Snort on your Fedora 39 system. For additional or useful information, we recommend you check the official Snort website.