Ubuntu 20.04 Snort3 Installation

I am installing Snort3 from source code to a brand new Ubuntu 20.04 desktop VM. I am following the Snort3_3.1.0.0_on_Ubuntu installation manual from Snort's website. The initial install went smooth, but I am running into some minor issues when trying to install the rules from PulledPork. At the bottom of page 10, when I try to download the latest rulesets by passing:

sudo /usr/local/bin/pulledpork.pl -c /usr/local/etc/pulledpork/pulledpork.conf -l -P -E -H SIGHUP

I am getting two errors:

Use of uninitialized value in concatenation (.) or string at /usr/local/bin/pulledpork.pl line 1379
Use of uninitialized value $pid_path in string ne at /usr/local/bin/pulledpork.pl line 2391
Rule Stats...
New 0
Deleted 1
Enabled Rules 1
Dropped Rules 0
Disabled Rules 0
Total Rules 1
IP Blocklist Stats
Total IPs: 814

I checked both lines (1379 & 2391) and both lines are exactly as how the installation manual instructed me to do.

The other issue I am having is, when I pass:

sudo systemctl enable snort3

I get the following two errors:

/lib/system/system/snort3.serve:8: Missing '=', ignoring line.
/lib/system/system/ethtool.service:5: Unknown key name 'Requires' in section 'Service', ignoring.

Again, I followed the instructions as stated in the manual. I've checked everything multiple times to ensure nothing was out of place or misspelled.

Thank you.

1 Answer

OK. First, what manual did you use? I must assume this one? Lots of people online have been advising apt install like you would in Kali, but this assumes the OS repository has compiled a compatible build. Best to compile, build, and install from source. I assume you did so, or you would not have the results you list above before attempting to get rules with pulledpork. Your errors list the lines where you may have syntax errors or typos.

On older versions of Snort/Ubuntu I had issue with not adding the oink code correctly (needs an "=" ?) and with errors in the rules link. I literally had to go to the Talos downloads and right click to copy the link, then past into pulledpork.conf. I will let you know on my next install on this new pc if I run into these issues.