snort3 service file

snort3.service

[Unit]
Description=Snort Daemon
After=syslog.target network.target

[Service]
Type=simple
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
ExecStartPre=/usr/sbin/ip link set up promisc on arp off multicast off dev snort_iface1
ExecStartPre=/usr/sbin/ethtool -K snort_iface1 rx off tx off gro off lro off
ExecStart=/usr/local/bin/snort --plugin-path=/usr/local/lib/snort --plugin-path /usr/local/etc/so_rules/ -c /usr/local/etc/snort/snort.lua -D -u snort -g snort -l /var/log/snort -m 0x1b --create-pidfile -s 65535 -k none -i snort_iface1
Restart=on-failure
RestartSec=120s

[Install]
WantedBy=multi-user.target

Hey folks, this is a basic systemd service file for Snort3.

Some important things to note:

• Lines 11,12, and 13 have a string snort_iface1. This string MUST be replaced with the name of the network interface you will be using for IDS mode operations.

  • For example, if your sniffing interface is ens192, either manually replace snort_iface1 with ens192 on those three lines, or run sed -i.bak 's/snort_iface1/ens192/g' snort3.service

• This service file implies you are going to be running snort3 in IDS mode. This configuration file will not support IPS mode operation. Unless...

• If you want this snort3.service file to support IPS mode operation, or IDS mode for multiple network interfaces, you will need to duplicate lines 11 and 12 for every single network interface you want to sniff from. Additionally line 13 will need to be modified to define the multiple interfaces you wish to sniff from with the -i argument.

This configuration file is released under MIT licensing. Have fun.

Note: For users having problems with shared object rules not loading and want to just forego them entirely, remove the line --plugin-path /usr/local/etc/so_rules/.

You'll also need to re-run pulledpork, commenting out or removing the distro and sorule_path directives to avoid downloading shared-object rules. Alternatively, use snort2lua and convert the Emerging Threats ruleset from snort 2.9.x to 3.x