Closed dougburks closed 4 years ago
I've packaged Snort 2.9.16.0 and DAQ 2.0.7 and the following packages are now available at ppa:securityonion/test
:
securityonion-daq - 2.0.7-1ubuntu1securityonion2
securityonion-snort - 2.9.16.0-1ubuntu1securityonion1
Please test as follows:
install the latest ISO image in a VM, but do not run Setup yet
if possible, create a snapshot of the VM
run Setup in Evaluation mode (Snort with Emerging Threats ruleset)
add the test PPA:
sudo add-apt-repository -y ppa:securityonion/test
install updates:
sudo soup
the Snort package should back up your existing snort.conf,
migrate your HOME_NET
and EXTERNAL_NET
variables, and tell you that
you need to run sudo rule-update
verify that your snort.conf
has been updated and shows:
VERSIONS : 2.9.16
verify the new Snort version number:
snort -V
Update your rules using PulledPork:
sudo rule-update
Verify that PulledPork downloaded rules properly
Create some traffic:
sudo so-test
Verify that Snort is generating alerts properly in Sguil, Squert, and Kibana
Increase Snort instances:
sudo so-sensor-stop
#increase IDS_LB_PROCS in /etc/nsm/HOSTNAME-INTERFACE/sensor.conf
sudo so-sensor-start
sudo so-test
Verify that Snort is generating alerts and load-balancing traffic via PF_RING
check sostat
output for anything out of the ordinary (specifically, check the pf_ring and Snort sections for packet loss)
reboot and make sure everything still works properly
Re-run Setup and verify that Snort and PulledPork work properly on new installations
check log files for errors or anything else out of the ordinary
verify no regressions
anything else we missed?
Thanks in advance for your time and effort!
No issues found during my testing. 👍
Thanks @weslambert !
https://blog.snort.org/2020/04/snort-29160-has-been-released.html
https://www.snort.org/downloads/snort/daq-2.0.7.tar.gz
https://www.snort.org/downloads/snort/snort-2.9.16.tar.gz