Snort 2.9.16.0 - Githubissues

dougburks commented 4 years ago

dougburks commented 4 years ago

I've packaged Snort 2.9.16.0 and DAQ 2.0.7 and the following packages are now available at ppa:securityonion/test:

securityonion-daq - 2.0.7-1ubuntu1securityonion2
securityonion-snort - 2.9.16.0-1ubuntu1securityonion1

Please test as follows:

add the test PPA:

sudo add-apt-repository -y ppa:securityonion/test

install updates:
```
sudo soup
```
the Snort package should back up your existing snort.conf, migrate your HOME_NET and EXTERNAL_NET variables, and tell you that you need to run sudo rule-update
verify that your snort.conf has been updated and shows:
```
VERSIONS : 2.9.16
```
verify the new Snort version number:
```
snort -V
```
Update your rules using PulledPork:
```
sudo rule-update
```
Verify that PulledPork downloaded rules properly
Create some traffic:
```
sudo so-test
```
Verify that Snort is generating alerts properly in Sguil, Squert, and Kibana

Increase Snort instances:

sudo so-sensor-stop
#increase IDS_LB_PROCS in /etc/nsm/HOSTNAME-INTERFACE/sensor.conf
sudo so-sensor-start
sudo so-test

Verify that Snort is generating alerts and load-balancing traffic via PF_RING
check sostat output for anything out of the ordinary (specifically, check the pf_ring and Snort sections for packet loss)
reboot and make sure everything still works properly
Re-run Setup and verify that Snort and PulledPork work properly on new installations
check log files for errors or anything else out of the ordinary
verify no regressions
anything else we missed?

Thanks in advance for your time and effort!

weslambert commented 4 years ago

No issues found during my testing. 👍

dougburks commented 4 years ago

Thanks @weslambert !

dougburks commented 4 years ago

Security-Onion-Solutions / security-onion