* Part 1: Introduction to Snort intrusion detection and prevention
* Part 2: Hardware and network setup requirements
* Part 3: Installation prerequisites
* Part 4: Compiling and configuration with MySQL
* Part 5: Configuring Snort and setting up rules
* Part 6: Editing the snort.conf file

This tutorial describes how to install and configure Snort intrusion detection system (IDS), ACIDBASE (Basic Analysis and Security Engine), MySQL, and Apache2 on Ubuntu 9.04 using packages from Ubuntu’s Synaptic Package Manager. Snort will assist you in monitoring your network and alert you about possible threats.

In this tutorial I will describe how to install and configure Snort (an intrusion detection system (IDS)) from source, BASE (Basic Analysis and Security Engine), MySQL, and Apache2 on Ubuntu 7.10 (Gutsy Gibbon). Snort will assist you in monitoring your network and alert you about possible threats.

There's a good chance that as a value-added reseller (VAR) or security service provider, you believe Snort and similar tools are valuable. However, there are plenty of technical folks that believe Snort is a waste of time. The goal of this Snort Report is to help you communicate the value of Snort to those customers whose IT departments are resistant to the open source tool.

An intrusion detection system – or IDS – is a high-tech burglar alarm, keeping a watchful eye on your computer and alerting when computer or network activity indicates unauthorised or malicious activity. An IDS is a must-have app, and Snort is rapidly becoming the tool of choice.

When it comes to open source Intrusion Detection/Prevention Systems (IDS/IPS) one name stands alone -- Snort. Yup the hog is still protecting lots of networks and today Sourcefire (Nasdaq:FIRE) --the lead commercial vendor behind Snort) issued a release celebrating Snorts 10th anniversary (technically the anniversary was December but hey...).

In our first two installments on intrusion detection (see Resources), we got as far as setting up a Snort sensor on our network. Now it's time to set it up to automatically collect new rulesets, and set up BASE (Basic Analysis and Security Engine) to present all that data in a nice digestible way with graphs and sorting tools.

We're going to demonstrate how to quickly install and run the open source IDS sensor Snort on Red Hat Enterprise Linux 5 (RHEL 5). The instructions below will also generally work for RHEL 4, CentOS 4 and 5, as well as Fedora Core 5 and 6.

There are already tons of written Snort rules, but there just might be a time where you need to write one yourself. You can think of writing Snort rules as writing a program. They can include variables, keywords and functions.