0

Configuration

1-Copy the default configuration file from the package into the /etc/snort directory:

cp ./etc/* /etc/snort/

2-Edit /etc/snort/snort.conf and make the following changes:

var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
var WHITE_LIST_PATH /etc/snort/rules
var BLACK_LIST_PATH /etc/snort/rules

3-Uncomment the Unified2 output line and remove nostamp from the comma-delimited options list:

output unified2: filename merged.log, limit 128, mpls_event_types, vlan_event_types

How can I type "Edit /etc/snort/snort.conf " on Mac terminal and type inside
var RULE_PATH /etc/snort/rules, var SO_RULE_PATH /etc/snort/so_rules, var PREPROC_RULE_PATH /etc/snort/preproc_rules, var WHITE_LIST_PATH /etc/snort/rules, var BLACK_LIST_PATH /etc/snort/rules, although I tried many times but invain ?Screenshot attached file

1 Answer 1

0

There are many methods. One is to use a shell editor like nano. Assuming the file is owned by root, you can type the following:

sudo nano /etc/snort/snort.conf

As long as your user account is an Administrator, you should be able to edit that file with sudo. In nano, you should be able to edit your file with the modifications you require. Ctrl-O to save, and Ctrl-X to exit.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .