robertdebock.snort

Snort

This role is no longer active and is not maintained.

To install and set up Snort on your computer, follow the instructions below.

GitHub	GitLab	Quality	Downloads	Version

Example Playbook

Here is an example playbook that is tested with every update:

---
- name: Converge
  hosts: all
  become: yes
  gather_facts: yes

  roles:
    - role: robertdebock.snort

Before using the machine, prepare it using a separate playbook:

---
- name: Prepare
  hosts: all
  gather_facts: no
  become: yes

  roles:
    - role: robertdebock.bootstrap
    - role: robertdebock.epel

For a complete guide on how to use these roles, check out this explanation.

Role Variables

You can find variables in defaults/main.yml:

---
# Default settings for Snort

snort_version: 2.9.17

Requirements

You need to install the pip packages listed in requirements.txt.

Status of Requirements

To prepare your system, you can use the following roles (these are verified to work):

Requirement	GitHub	GitLab
robertdebock.bootstrap
robertdebock.epel

Context

This role works alongside many others. For more information, check out the documentation.

Here’s a chart showing related roles: dependencies

Compatibility

This role has been tested on these container images:

Container	Tags
el	8
fedora	32

You need at least Ansible version 2.10. Tests have been conducted with:

The previous version.
The current version.
The development version.

Exceptions

Some variations may not work. Here are the ones that fail and why:

Variation	Reason
Alpine	Not enough space to store data.
Archlinux	Missing file: rpc/rpc.h.
CentOS latest	Required Libpcap library version not found.
fedora:rawhide	Warning about unaligned pointer value.

Included Version(s)

This role refers to a specific version released by Snort. You can check the releases here:

Snort Releases.

The version reference indicates that the role may get outdated. Tests are performed monthly to identify any issues. If you discover a problem, please report it on GitHub.