Barnyard2 Installation Linux

Vorbereitung

• apt-get install -y mysql-server libmysqlclient-dev mysql-client autoconf libtool
• apt-get install libpcap-dev libprelude-dev

Edit /etc/snort/snort.conf

###################################################
# Step #6: Configure output plugins
# For more information, see Snort Manual, Configuring Snort - Output Modules
###################################################

# unified2 
# Recommended for most installs
# output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types
# output unified2: filename snort.log, limit 128, nostamp, mpls_event_types, vlan_event_types
output database log,mysql, user=snort password=snort dbname=snort host=localhost

Compile and Install Barnyard2

• git clone git://github.com/firnsy/barnyard2.git
• cd barnyard2
• ./autogen.sh
• CFLAGS='-lpthread'
• ./configure --with-mysql-libraries=/usr/lib/x86_64-linux-gnu
• apt-get install libdumbnet-dev
• ln -s /usr/include/dumbnet.h /usr/include/dnet.h
• ldconfig
• make
• make install
• cp etc/barnyard2.conf /etc/snort/
• touch /var/log/snort/barnyard2.waldo

Database Settings

• sudo mysql -u root -p
• mysql > create database snort;
• mysql > use snort;
• mysql > source /root/barnyard2/schemas/create_mysql
• mysql > CREATE USER 'snort'@'localhost' IDENTIFIED BY 'snort'*
• mysql > grant create, insert, select, delete, update on snort.* to 'snort'@'localhost';