Can not install snort on ubuntu 64bit

All about Snort integration in Artica

Can not install snort on ubuntu 64bit

New postby abolinhas » Wed Jun 08, 2011 4:13 pm

Hi David,

I can not install snort on ubuntu10 64bit

Image
Cumprimentos / Best Regards

André Bolinhas
Twitter: @abolinhas
User avatar
abolinhas
 
Posts: 1015
Joined: Fri Jun 19, 2009 8:50 am
Location: Portugal
Artica servers number: 4
Linux System: Ubuntu
Technical skills: A Linux System Administrator

Re: Can not install snort on ubuntu 64bit

New postby admin » Wed Jun 08, 2011 5:46 pm

Waht is the output of

Code: Select all
/usr/share/artica-postfix/bin/artica-make APP_SNORT_DAQ
User avatar
admin
Site Admin
 
Posts: 11946
Joined: Wed Oct 17, 2007 7:59 am
Location: France

Re: Can not install snort on ubuntu 64bit

New postby abolinhas » Wed Jun 08, 2011 6:01 pm

Code: Select all
libtool: link: gcc -shared  .libs/daq_ipq_la-daq_ipq.o   -Wl,-rpath -Wl,/root/APP_DAQ-sources-2011-06-08-18/sfbpf/.libs -lipq /usr/lib/libdnet ../sfbpf/.libs/libsfbpf.so -lpcap    -Wl,-soname -Wl,daq_ipq.so -o .libs/daq_ipq.so
/usr/bin/ld: /usr/lib/gcc/x86_64-linux-gnu/4.4.3/../../../../lib/libipq.a(libipq.o): relocation R_X86_64_32S against `ipq_errmap' can not be used when making a shared object; recompile with -fPIC
/usr/lib/gcc/x86_64-linux-gnu/4.4.3/../../../../lib/libipq.a: could not read symbols: Bad value
collect2: ld returned 1 exit status
make[2]: *** [daq_ipq.la] Error 1
make[2]: Leaving directory `/root/APP_DAQ-sources-2011-06-08-18/os-daq-modules'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/root/APP_DAQ-sources-2011-06-08-18'
make: *** [all] Error 2
Cumprimentos / Best Regards

André Bolinhas
Twitter: @abolinhas
User avatar
abolinhas
 
Posts: 1015
Joined: Fri Jun 19, 2009 8:50 am
Location: Portugal
Artica servers number: 4
Linux System: Ubuntu
Technical skills: A Linux System Administrator

Re: Can not install snort on ubuntu 64bit

New postby admin » Wed Jun 08, 2011 6:06 pm

Could use this fix and do

Code: Select all
/usr/share/artica-postfix/bin/artica-make APP_SNORT_CAP

after
Code: Select all
/usr/share/artica-postfix/bin/artica-make APP_SNORT_DAQ
Attachments
artica-make.tar.gz
(876.09 KiB) Downloaded 366 times
User avatar
admin
Site Admin
 
Posts: 11946
Joined: Wed Oct 17, 2007 7:59 am
Location: France

Re: Can not install snort on ubuntu 64bit

New postby abolinhas » Wed Jun 08, 2011 6:18 pm

Code: Select all
libtool: link: gcc -shared  .libs/daq_ipq_la-daq_ipq.o   -Wl,-rpath -Wl,/root/APP_DAQ-sources-2011-06-08-19/sfbpf/.libs -lipq /usr/lib/libdnet ../sfbpf/.libs/libsfbpf.so -lpcap    -Wl,-soname -Wl,daq_ipq.so -o .libs/daq_ipq.so
/usr/bin/ld: /usr/lib/gcc/x86_64-linux-gnu/4.4.3/../../../../lib/libipq.a(libipq.o): relocation R_X86_64_32S against `ipq_errmap' can not be used when making a shared object; recompile with -fPIC
/usr/lib/gcc/x86_64-linux-gnu/4.4.3/../../../../lib/libipq.a: could not read symbols: Bad value
collect2: ld returned 1 exit status
make[2]: *** [daq_ipq.la] Error 1
make[2]: Leaving directory `/root/APP_DAQ-sources-2011-06-08-19/os-daq-modules'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/root/APP_DAQ-sources-2011-06-08-19'
make: *** [all] Error 2


No errors on SNORT_CAP
Cumprimentos / Best Regards

André Bolinhas
Twitter: @abolinhas
User avatar
abolinhas
 
Posts: 1015
Joined: Fri Jun 19, 2009 8:50 am
Location: Portugal
Artica servers number: 4
Linux System: Ubuntu
Technical skills: A Linux System Administrator

Re: Can not install snort on ubuntu 64bit

New postby admin » Wed Jun 08, 2011 6:51 pm

I can reproduce the issue on my server byt have no time to investigate it seems there DAQ error on 64 bits

Code: Select all
libipq.a: could not read symbols: Bad value


it seems a common problem
http://www.google.com/search?client=ubu ... 8&oe=utf-8

Could you try to investigate with snort forum ? to help me.
Attached here the last artica-make that pay attention of /lib64 directory.
Attachments
artica-make.tar.gz
(876.41 KiB) Downloaded 363 times
User avatar
admin
Site Admin
 
Posts: 11946
Joined: Wed Oct 17, 2007 7:59 am
Location: France

Re: Can not install snort on ubuntu 64bit

New postby abolinhas » Wed Jun 08, 2011 9:44 pm

Cumprimentos / Best Regards

André Bolinhas
Twitter: @abolinhas
User avatar
abolinhas
 
Posts: 1015
Joined: Fri Jun 19, 2009 8:50 am
Location: Portugal
Artica servers number: 4
Linux System: Ubuntu
Technical skills: A Linux System Administrator

Re: Can not install snort on ubuntu 64bit

New postby abolinhas » Mon Jun 13, 2011 1:21 pm

Hi David,


I get this reply from Expert Exchange

As it says:
libipq.a(libipq.o): relocation R_X86_64_32S against `ipq_errmap' can
not be used when making a shared object; recompile with -fPIC

You might try that, here are a couple of links:
http://ubuntuforums.org/showthread.php?t=692371
http://www.gentoo.org/proj/en/base/amd6 ... t=1&chap=3

Looks like your configure should have these addional options
CXXFLAGS=-fPIC CFLAGS=-fPIC CPPFLAGS=-fPIC
Cumprimentos / Best Regards

André Bolinhas
Twitter: @abolinhas
User avatar
abolinhas
 
Posts: 1015
Joined: Fri Jun 19, 2009 8:50 am
Location: Portugal
Artica servers number: 4
Linux System: Ubuntu
Technical skills: A Linux System Administrator

Re: Can not install snort on ubuntu 64bit

New postby admin » Mon Jun 13, 2011 1:57 pm

Attached file is the new artica-make that using -fPIC
But this did not solve the issue.
compilation using this
Code: Select all
./configure --prefix=/usr  --with-libpcap-libraries=/usr/lib64 --libdir=/usr/lib64  --includedir="\${prefix}/include" --mandir="\${prefix}/share/man" --infodir="\${prefix}/share/info" --sysconfdir=/etc --localstatedir=/var CXXFLAGS=-fPIC CFLAGS=-fPIC CPPFLAGS=-fPIC


/usr/bin/ld: /usr/lib64/libipq.a(libipq.o): relocation R_X86_64_32S against `ipq_errmap' can not be used when making a shared object; recompile with -fPIC
/usr/lib64/libipq.a: could not read symbols: Bad value


still exists.
Attachments
artica-make.tar.gz
(876.75 KiB) Downloaded 407 times
User avatar
admin
Site Admin
 
Posts: 11946
Joined: Wed Oct 17, 2007 7:59 am
Location: France

Re: Can not install snort on ubuntu 64bit

New postby abolinhas » Tue Jun 14, 2011 9:48 am

I get another reply from EE

I think wrong snort packet or bad download. Please try download clear


What do you think ?
Cumprimentos / Best Regards

André Bolinhas
Twitter: @abolinhas
User avatar
abolinhas
 
Posts: 1015
Joined: Fri Jun 19, 2009 8:50 am
Location: Portugal
Artica servers number: 4
Linux System: Ubuntu
Technical skills: A Linux System Administrator

Next

Return to IDS with Snort

Who is online

Users browsing this forum: No registered users and 1 guest

cron