# $Id: INSTALL,v 1.53 2006/01/28 21:27:03 andreas_o Exp $ #
Quick installation instructions for Oinkmaster
1) Put oinkmaster.pl in some suitable directory, for example
/usr/local/bin/. Put oinkmaster.conf in /etc/ or /usr/local/etc/
(this is where Oinkmaster will search for it by default).
You may also want to copy the man page (oinkmaster.1) to
something like /usr/local/man/man1/.
2) Edit oinkmaster.conf that you copied in step 1). The defaults should
be fine for most users, although one thing you must change is
"url = ", which specifies the location of the rules archive.
The URL to use depends on which version of Snort you run and also what
type of rules you want to use. Some may require registration. See Q1
in the FAQ for more information.
3) Decide in which directory you want to put the new rules. If you
have Snort up and running already, you should use the directory where
you keep the rules files. It's a very good idea to create a backup of
it first. You must run Oinkmaster as a user that has read/write access
to your rules directory and all rules files in it. It should however
*NOT* be a privileged user such as root!
Never run Oinkmaster as root.
Assuming your rules directory is /etc/snort/rules/, you can now update
those rules by running:
oinkmaster.pl -o /etc/snort/rules
Extra installation notes
If you're new to Oinkmaster, it's recommended that you read the entire
README and FAQ. You may also run oinkmaster.pl -h to list all available
command line options. They are described in more detail in the Oinkmaster
manual page. See the FAQ if you need to setup proxy configuration.
In oinkmaster.conf you will tell Oinkmaster things like which rules or
files you want to disable/enable/modify/ignore. If you already have
several rules commented out (or removed) in your current rules files, you
must add "disablesid" statements for those SIDs to oinkmaster.conf so
they don't get re-enabled after updating the rules (there is a help
script for that, see makesidex.pl in the contrib directory). Remember
that after switching to Oinkmaster for updating the rules, all permanent
modifications to the rules must be done by editing oinkmaster.conf, not
by editing the rules files directly.
If you need more help, see the documentation at
http://oinkmaster.sourceforge.net/ or ask on the Oinkmaster mailing list.