Best distro to use for Snort

hywaydave23 · 08-29-2005, 10:15 AM

What would be the best and easiest Linux distro to use for Snort? Thanks.

perfect_circle · 08-29-2005, 10:40 AM

I don't really get the question. Any distro will do. I'm using snort with slackware.
Arch linux comes with a precompiled snort package
http://www.archlinux.org/packages.ph...tupdate=&pp=50
if that matters at all, but I haven't tried it yet

knoppix-std also has snort installed and its a live cd distro:
http://www.knoppix-std.org/tools.html

hywaydave23 · 08-29-2005, 10:42 AM

I know any distro would do, but I'm going to be using it in a work environment. I'd probably want the one that's the most secure right out of the box. Of course I'd have to do some additional tweaking for security purposes.

Has anyone used Centos? I was thinking of using that.

guild · 08-29-2005, 01:21 PM

that's actually a different question, right? i mean, snort should work with any distro. so what you are really asking is what is the most secure distro using a default install...

hywaydave23 · 08-29-2005, 03:23 PM

Yes, and I would like to know how Centos is? Is it fairly decent? I have not heard of it until today and saw that it was basically a clone of the Red Hat Enterprise version.

guild · 08-29-2005, 05:35 PM

i'm sure that others can give a better suggestion, but if i was really worried about security, i guess i would start with NSA version of linux:

http://www.nsa.gov/selinux/

i have absolutely no experience with it though. i would hope some of the other regulars on this forum might make some suggestions.

Capt_Caveman · 08-29-2005, 11:33 PM

CentOS is based off Redhat, so it's going to have a number of services running by default that you should probably turn off if they're unnecessary. CentOS version 4 does include an SELinux implementation like Redhat with a targeted policy that protects several commonly used daemons (check the release notes for which ones). If you do decide to use CentOS, I would suggest doing a minimal installation and really gutting it.

There are a number of security-oriented distros like trustix and hardened gentoo that come with more secure configurations out of the box. Personally I would recommend using something you are famliar with and spending some time hardening it, rather than using a distro you are not comfortable with and making a configuration error. There are a number of general guides on securing/hardening servers in the Security References thread near the top of the forum that should help you out.