Re: Building Snort3 on Raspbian Bullseye

I didn’t use the make command

Installation of OPENWRT

Download the OS

https://openwrt.org/

Utiliser rpi imager to install it on Raspberry Pi :

format the Sdcard

Boot on the pi with the boot image (to reset the ‘bios’)

Burn the Openwrt image (target 2711x stable)

boot again on the installed OS

Change the password with the command passwd

Configuration of OPENWRT

(without Wifi and only between eth0 and eth1 (serial packets filtration))

Go to etc/config

(Copy config files with the cp command, before making modifications)

In the file ’network’, replace the ip address with 192.168.1.10 for ex (static)

Delete ssh command to secure any unwanted access :

opkg remove dropbear

/etc/init.d/uhttpd stop (this command can be added in the boot file)

See openwrt documentation for precise firewall configuration

(pay attention to separate physically network cables during manipulations)

Add the command arptables-legacy -P FORWARD DROP in the etc/init.d/boot file

Reboot

Connect on theLuciadministration website on http://192.168.1.10

(put the network file in static mode, and deactivate the vpn to grant the access)

add dns servers configuration (for ex 9.9.9.11 (quad9))

(if necessary, add NAT 100.64.0.0/10 for ex, on eth1 (if necessary with the masquerade option))

Connect the eth0 cable again (without vpn, with a fix address on the Pi, on the same gateway)

eth1 should be up (verification with ifconfig)

Installing packages :

ping 1.1.1.1 => connection OK!

Opkg update

Opkg list

Opkg install htop iftop nano ipsec adguardathome kmod_usb_net_rtl8152 block-mount kmod-fs-ext4 kmod-fs-f2fs parted nano ss squid snort adguardhome htop iftop

(choose between those packages the one you need)

If you need to extend the system partition with an external usb key :

parted -s /dev/sda -- mklabel gpt mkpart extroot 32768 -32768s

mkfs.f2fs -l extroot/dev/sda

Go in the disk parameters in Luci (system menu, mount options, and add the usb key as /overlay)

(Mount points edit save)

Firewall configuration :

Add the IP addresses and ports to block in the Luci firewall menu

(with virtual wan and no source address (not to block the destination IP address))

Notice : If you install adguardhome, delete the ‘dns et dhcp’ package before (adguardhome is self managing them)

SNORT3 IPS configuration :

Download the community filter file :

wgethttps://www.snort.org/downloads/community/snort3-community-rules.tar.gz

Replace ‘alert’ by ‘drop’ and ‘nodrop’ by ‘noalert’

sed -i 's/[THE_OLD_TERM]/[THE_NEW_TERM]/g' [TARGETED_FILE]

In the file snort.lua, add the community rule :

in the IPS section :

include = ‘/etc… snort3-community.rules’

Verify the right Snort configuration with :

snort -c /etc/snort/snort.lua —daq-dir /usr/lib/daq -T

there should be zero errors.

Final connection & tests

Documentation for more infos

https://openwrt.org/docs/guide-user/additional-software/extroot_configuration

https://openwrt.org/docs/guide-user/services/proxy/proxy.squid

https://openwrt.org/docs/guide-user/services/snort

[https://openwrt.org/docs/guide-user/services/dns/adguard-home?s[]=adguardhome](https://openwrt.org/docs/guide-user/services/dns/adguard-home?s%5B%5D=adguardhome)

You are welcome
To promote also Green libertarianism (turquoise ecology)

Le dim. 13 août 2023 à 18:16, Karl Baker <[[email protected]](mailto:Le dim. 13 août 2023 à 18:16, Karl Baker <<a href=)> a écrit :

> Hello,
>
> After becoming interested in setting up one of my Raspberry Pi devices
> to run Snort, I first installed version 2.9.20 which was available in
> the apt repository, and after removing that version am now in the
> process of setting up 3.1.67.
>
> During the make execution I am receiving the following error messages:
>
> Scanning dependencies of target snort
> [ 98%] Building CXX object src/CMakeFiles/snort.dir/main.cc.o
> [100%] Linking CXX executable snort
> /usr/bin/ld: memory/CMakeFiles/memory.dir/memory_cap.cc.o: in function
> `std::__atomic_base<unsigned long long>::store(unsigned long long,
> std::memory_order)':
> /usr/include/c++/10/bits/atomic_base.h:404: undefined reference to
> `__atomic_store_8'
> /usr/bin/ld: /usr/include/c++/10/bits/atomic_base.h:404: undefined
> reference to `__atomic_store_8'
> /usr/bin/ld: /usr/include/c++/10/bits/atomic_base.h:404: undefined
> reference to `__atomic_store_8'
> /usr/bin/ld: memory/CMakeFiles/memory.dir/memory_cap.cc.o: in function
> `std::__atomic_base<unsigned long long>::load(std::memory_order) const':
> /usr/include/c++/10/bits/atomic_base.h:426: undefined reference to
> `__atomic_load_8'
> /usr/bin/ld: /usr/include/c++/10/bits/atomic_base.h:426: undefined
> reference to `__atomic_load_8'
> /usr/bin/ld: /usr/include/c++/10/bits/atomic_base.h:426: undefined
> reference to `__atomic_load_8'
> /usr/bin/ld: /usr/include/c++/10/bits/atomic_base.h:426: undefined
> reference to `__atomic_load_8'
> /usr/bin/ld:
> service_inspectors/dce_rpc/CMakeFiles/dce_rpc.dir/dce_smb2_file.cc.o: in
> function `std::__atomic_base<unsigned long long>::store(unsigned long
> long, std::memory_order)':
> /usr/include/c++/10/bits/atomic_base.h:404: undefined reference to
> `__atomic_store_8'
> /usr/bin/ld:
> service_inspectors/dce_rpc/CMakeFiles/dce_rpc.dir/dce_smb2_file.cc.o: in
> function `std::__atomic_base<unsigned long
> long>::load(std::memory_order) const':
> /usr/include/c++/10/bits/atomic_base.h:426: undefined reference to
> `__atomic_load_8'
> /usr/bin/ld: /usr/include/c++/10/bits/atomic_base.h:426: undefined
> reference to `__atomic_load_8'
> /usr/bin/ld: /usr/include/c++/10/bits/atomic_base.h:426: undefined
> reference to `__atomic_load_8'
> /usr/bin/ld: /usr/include/c++/10/bits/atomic_base.h:426: undefined
> reference to `__atomic_load_8'
> /usr/bin/ld: /usr/include/c++/10/bits/atomic_base.h:426: undefined
> reference to `__atomic_load_8'
> /usr/bin/ld:
> service_inspectors/dce_rpc/CMakeFiles/dce_rpc.dir/dce_smb2_file.cc.o: in
> function `std::__atomic_base<unsigned long long>::store(unsigned long
> long, std::memory_order)':
> /usr/include/c++/10/bits/atomic_base.h:404: undefined reference to
> `__atomic_store_8'
> /usr/bin/ld:
> service_inspectors/dce_rpc/CMakeFiles/dce_rpc.dir/dce_smb2_file.cc.o: in
> function `std::__atomic_base<unsigned long
> long>::load(std::memory_order) const':
> /usr/include/c++/10/bits/atomic_base.h:426: undefined reference to
> `__atomic_load_8'
> collect2: error: ld returned 1 exit status
> make[2]: *** [src/CMakeFiles/snort.dir/build.make:1779: src/snort] Error 1
> make[1]: *** [CMakeFiles/Makefile2:3256: src/CMakeFiles/snort.dir/all]
> Error 2
> make: *** [Makefile:171: all] Error 2
>
> Can anyone point me in the right direction so that it will correctly
> make and I can install Snort3 please?
>
> Thanks,
>
> Karl Baker
> _______________________________________________
> Snort-users mailing list
> [email protected]
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> To unsubscribe, send an email to:
> [email protected]
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette