Sguil on CentOS 4.6

From NSMWiki
Jump to: navigation, search

Purpose of This Document

The purpose of this document is to show how to install and configure Sguil 0.7.0 on a CentOS 5.1 system using the synful-sguilcvs.repo maintained by fifarek. (This install will result in the sguil server and sensor on the same box)

Boot from CentOS 5.1 "#1" CD

  • Choose text install
linux text
  • Choose "Custom" install, firewall in "warn" state
  • At "Package Group Selection" chose NOTHING leaving a base install of 740 MB
  • Ran "yum update" and allowed updates to install
yum update
  • As per http://synfulpacket.net/sguilcvs/readme.first, created synful-sguilcvs.repo
nano /etc/yum.repos.d/synful-sguilcvs.repo
  • Pasted the following into this file and saved it
[sguil]
name=Sguil Repo at synfulpacket.net
baseurl=http://synfulpacket.net/sguilcvs/$releasever
gpgcheck=0
  • Added "exclude=libnet*" to the "[extras]" section of CentOS-Base.repo
  • To prevent "Error: Missing Dependency: libpcap.so.0.8.3 is needed by package ppp" error when installing sguil-server, remove the ppp package from the base install
 yum remove ppp
Retrieved from "http://nsmwiki.org/index.php?title=Sguil_on_CentOS_4.6&oldid=2158"