sudo apt install -y gcc libpcre3-dev zlib1g-dev libpcap-dev openssl libssl-dev libnghttp2-dev libdumbnet-dev bison flex libdnet

mkdir ~/snort && cd ~/snort

# 下载 daq-2.0.6.tar.gz 到当前目录
tar -xvzf daq-2.0.6.tar.gz
cd daq-2.0.6
./configure && make && sudo make install

cd ~/snort

# 下载 snort-2.9.11.1.tar.gz
tar -xvzf snort-2.9.11.1.tar.gz
cd snort-2.9.11.1
./configure --enable-sourcefire && make && sudo make install

sudo ldconfig
sudo ln -s /usr/local/bin/snort /usr/sbin/snort
sudo mkdir /usr/local/lib/snort_dynamicrules

sudo chmod -R 5775 /etc/snort/
sudo chmod -R 5775 /var/log/snort/
sudo chmod -R 5775 /usr/local/lib/snort_dynamicrules/
sudo chown -R pinvon:pinvon /etc/snort/
sudo chown -R pinvon:pinvon /var/log/snort/
sudo chown -R pinvon:pinvon /usr/local/lib/snort_dynamicrules/

touch /etc/snort/rules/white_list.rules
touch /etc/snort/rules/black_list.rules
touch /etc/snort/rules/local.rules

cp ~/snort/snort-2.9.11.1/etc/*.conf* /etc/snort
cp ~/snort/snort-2.9.11.1/etc/*.map /etc/snort

sudo tar -xvf community-rules.tar -C ~/snort
cd snort/community-rules
sudo cp * /etc/snort/rules

sudo sed -i 's/include \$RULE\_PATH/#include \$RULE\_PATH/' /etc/snort/snort.conf

# 如果想要保护某个主机
ipvar HOME_NET 想要保护的主机IP
ipvar EXTERNAL_NET !$HOME_NET

# 规则的路径
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules

var WHITE_LIST_PATH /etc/snort/rules
var BLACK_LIST_PATH /etc/snort/rules

# 末尾
include $RULE_PATH/community.rules