apt -y install build -essential
apt -y install libpcap-dev libpcre3-dev libdumbnet-dev
apt -y install mysql-server libmysqlclient-dev mysql-client autoconf libtool
apt -y install bison flex

cd ~
mkdir snort_source
cd snort_source
wget http://snort.org/downloads/snort/daq-2.0.6.tar.gz (또는 파일에서 끌어오기 apt install lrzsz 필요)

tar -xvzf daq-2.0.7.tar.gz
cd daq-2.0.7
./configure && make && make install (오류발생!!)

cd ~
touch /etc/snort/sid-msg.map
cat /etc/snort/snort.conf -n | egrep "output unified2"
    550 # output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types
    551 output unified2: filename snort.log, limit 128, nostamp, mpls_event_types, vlan_event_types
    (550번과 551번 라인 확인)

cd snort_source
wget https://github.com/firnsy/barnyard2/archive/master.tar.gz
tar zxvf master.tar.gz
cd barnyard2-master
autoreconf -fvi -I ./m4

ln -s /usr/include/dumbnet.h /usr/include/dnet.h
getconf LONG_BIT
64비트임을 알려줌

./configure --with-mysql
--with-mysql-libraries=/usr/lib/x86_64-linux-gnu
make && make install
cd /usr/local/bin/barnyard2 -V (오류)



~최신 블로그 내용 참고하기!!~
https://velog.io/@hackk/%EB%84%A4%ED%8A%B8%EC%9B%8C%ED%81%AC-%EB%B3%B4%EC%95%88-Snort%EC%99%80-barnyard2-%EC%97%B0%EB%8F%99%ED%95%98%EA%B8%B0

/etc/snort/snort.conf
    output unified2: filename snort.log, limit 128
    output alert_unified2: filename snort.alert, limit 128, nostamp

mysql -u root -p
    create database snort;
    create user snort@localhost identified by '123456';
    grant all privileges on snort.* to snort@localhost;
    flush privileges;
    exit

cd barnyard2-master
./autogen.sh
./configure --with-mysql=/usr/include/mysql/ --with-mysql-libraries=/usr/lib/aarch64-linux-gnu/

make
maek install

cp /var/log/snort/snort_source/barnyard2-master/etc/barnyard2.conf /etc/snort

mkdir /var/log/banyard2
touch /var/log/snort/barnyard2.waldo
chown snort.snort /var/log/snort/barnyard2.waldo

#MySQL 데이터 베이스 생성
#barnyard2-master/schemas 경로에서
mysql -p < create_mysql snort

/etc/snort/barnyard2.conf

barnyard2 설정파일 내용
# Snort에서 탐지한 네트워크 규칙을 어느 데이터베이스에 로깅할지 정보를 입력합니다.
    output database: log, mysql, user=snort password=root dbname=snort host=localhost

    input_type : file
    input_file: /var/log/snort

    input unified2

    #config reference_file: /etc/snort/reference.config
    config reference_file: /var/log/snort/snort.log
    config classification_file: /etc/snort/classification.config
    config gen_file: /etc/snort/gen-msg.map
    #config sid_file: /etc/snort/sid-msg.map

sudo chmod o-r /etc/snort/barnyard2.conf

cd snort_source/barnyard2-master/src/output-plugins
nano spo_alert_fwsam.c
    중간에 typedef int socket 지움
nano spo_database.h
    my_bool -> bool

/usr/local/bin/barnyard2 -V (완료!)

cp /var/log/snort/snort_source/barnyard2-master/etc/barnyard2.conf /etc/snort (경로 꼭 확인하고 설정하기!!)


설치완료
Barnyard2 spooler: Event cache size set to [2048]
Log directory = /var/log/barnyard2

        --== Initialization Complete ==--

          -*> Barnyard2 < *-
/ ,,_ \ Version 2.1.14 (Build 337)
|o" )~| By Ian Firns (SecurixLive): http://www.securixlive.com/
+ '''' + (C) Copyright 2008-2013 Ian Firns < firnsy@securixlive.com>


[Testing]
sudo /usr/local/bin/snort -q -u snort -g snort -c /etc/snort/snort.conf -i enp0s3
(usr/local/bin/snort 없음)

sudo barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -w /var/log/snort/barnyard2.bookmark -g snort -u snort
    Unable to open waldo file '/var/log/snort/barnyard2.bookmark
    (반야드2.북마크 없음)

mysql -u snort -p snort (접속 됨!)
select count(*) from event; (이벤트없음)