We help IT Professionals succeed at work.

Snort installation problem with CentOS 4.6

palserv
palserv asked
on
Hello,

When i try to install Snort in my box CentOS 4.6, i got this error :

error: Failed dependencies:
        libpcap.so.0.9.4 is needed by snort-2.8.0.1-1.i386
        rtld(GNU_HASH) is needed by snort-2.8.0.1-1.i386
        libmysqlclient.so.15 is needed by snort-mysql-2.8.0.1-1.i386
        libmysqlclient.so.15(libmysqlclient_15) is needed by snort-mysql-2.8.0.1-1.i386
        libpcap.so.0.9.4 is needed by snort-mysql-2.8.0.1-1.i386
        rtld(GNU_HASH) is needed by snort-mysql-2.8.0.1-1.i386

Whats this problem?

Regards
Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2014

Commented:
You need to install the products listed.  I would suggest using yum to install Snort.  It should fetch all the software needed to install Snort.

Either su'ed as root or using the sudo command:

     yum install snort

and reply y to download and install or use:

     yum -y install snort

to have it automatically download and install.

Author

Commented:
I already do it and i got nothing

Setting up Install Process
Setting up repositories
update                    100% |=========================|  951 B    00:00    
base                      100% |=========================| 1.1 kB    00:00    
addons                    100% |=========================|  951 B    00:00    
extras                    100% |=========================| 1.1 kB    00:00    
Reading repository metadata in from local files
Excluding Packages in global exclude list
Finished
Parsing package install arguments
No Match for argument: snort
Nothing to do
yum install mysql libpcap glibc

Author

Commented:
Nothing happened , i already have Cpanel installed

[root@yafa ]# yum install libpcap glibc
Setting up Install Process
Setting up repositories
update                    100% |=========================|  951 B    00:00     
base                      100% |=========================| 1.1 kB    00:00     
addons                    100% |=========================|  951 B    00:00     
extras                    100% |=========================| 1.1 kB    00:00     
Reading repository metadata in from local files
Excluding Packages in global exclude list
Finished
Parsing package install arguments
Nothing to do
[root@yafa ]# 

Open in new window

Author

Commented:
Nothing happened , i already have Cpanel installed

[root@yafa ]# yum install libpcap glibc
Setting up Install Process
Setting up repositories
update                    100% |=========================|  951 B    00:00     
base                      100% |=========================| 1.1 kB    00:00     
addons                    100% |=========================|  951 B    00:00     
extras                    100% |=========================| 1.1 kB    00:00     
Reading repository metadata in from local files
Excluding Packages in global exclude list
Finished
Parsing package install arguments
Nothing to do
[root@yafa ]# 

Open in new window

Author

Commented:
Nothing happened , i already have Cpanel installed

[root@yafa ]# yum install libpcap glibc
Setting up Install Process
Setting up repositories
update                    100% |=========================|  951 B    00:00     
base                      100% |=========================| 1.1 kB    00:00     
addons                    100% |=========================|  951 B    00:00     
extras                    100% |=========================| 1.1 kB    00:00     
Reading repository metadata in from local files
Excluding Packages in global exclude list
Finished
Parsing package install arguments
Nothing to do
[root@yafa ]# 

Open in new window

You excluded mysql, which you need - or rather mysql-libs on rhel4.

I also just realized - I think you're trying to install an RPM build to redhat5, not 4.  The version of libpcap that it is looking for is one that comes on 5, 4 has an older version.  You should find a version build for el4, or you'll have to get libraries from other places, and that could get messy.

You could also grab the srpm for snort from their web page, but then you'll need devel libraries installed to compile it.
CERTIFIED EXPERT
Top Expert 2014

Commented:
How about issuing the commands

rpm -qa > installed.txt
grep mysql installed.txt
grep libpcap installed.txt
grep glibc installed.txt
grep snort installed.txt
rm installed.txt

This will show you if you have any of these already installed.  It appears that either you already have some of these installed or the yum repositories you are using do not have any of these.
From the output of his posted yum command base and updates were enabled, so those should definitely have the required libraries - just not the right versions.  Should be the right mysql libs, but not libpcap.  Could either grab a newer libpcap rpm, compile libpcap from source and force the rpm, or get a version of a snort rpm build for rhel4.
CERTIFIED EXPERT
Top Expert 2014

Commented:
I would have assumed that too.  However, why did nothing happen when he attempting to install snort using yum.

I guess it it is possible that what ever repositories he is using does not have snort on it, or he has the most recent level already installed.
Snort isn't in any of the centos repositories, either for 4 or 5.  But he should be able to pull in the dependencies from the repo, as long as the rpm is built for the right version that he's running.
The 3rd party Dag repository has snort RPMs for EL4.

Either download the RPM here:
http://dag.wieers.com/rpm/packages/snort/snort-2.3.3-1.2.el4.rf.i386.rpm
or the mysql one if you need that...
http://dag.wieers.com/rpm/packages/snort/snort-mysql-2.3.3-1.2.el4.rf.i386.rpm

OR
just grab this RPM and install it to enable the DAG repo in yum:
http://dag.wieers.com/rpm/packages/rpmforge-release/rpmforge-release-0.3.4-1.el4.rf.i386.rpm
After you install that rpm you can then just
"yum install snort" (or "yum install snort-mysql") and it will pull everything you need in.

Explore More ContentExplore courses, solutions, and other research materials related to this topic.