Sguil on CentOS 5.1

From NSMWiki

Jump to: navigation, search

Purpose of This Document

The purpose of this document is to show how to install and configure Sguil 0.7.0 on a CentOS 5.1 system using the synful-sguilcvs.repo maintained by fifarek. (This install will result in the sguil server and sensor on the same box)

Boot from CentOS 5.1 "netinst" (network install) CD

  • Choose text install 
linux text
  • Allow the stages to download from the server
  • Choose "Custom" install, firewall in "warn" state
  • At "Package Group Selection" chose NOTHING leaving a base install of 740 MB
  • Ran "yum update" and allowed updates to install 
yum update
  • As per http://synfulpacket.net/sguilcvs/readme.first, created synful-sguilcvs.repo 
nano /etc/yum.repos.d/synful-sguilcvs.repo
  • Pasted the following into this file and saved it 
[sguil]
name=Sguil Repo at synfulpacket.net
baseurl=http://synfulpacket.net/sguilcvs/$releasever
gpgcheck=0
  • Added "exclude=libnet*" to the "[extras]" section of CentOS-Base.repo
  • To prevent "Error: Missing Dependency: libpcap.so.0.8.3 is needed by package ppp" error when installing sguil-server, remove the ppp package from the base install 
 yum remove ppp
Retrieved from "http://nsmwiki.org/Sguil_on_CentOS_5.1"
Personal tools