Installing Snort on Kali Linux

Snort is no longer available in Kali repositories

Here are the steps to install snort on Kali

• Backup kali's sources.list

mv /etc/apt/sources.list /etc/apt/sources.list.bak

• Remove updates

find /var/lib/apt/lists -type f -exec rm {} \;

• Change sources.list content

sudo nano /etc/apt/sources.list

Paste content given below

deb http://archive.ubuntu.com/ubuntu/ focal main restricted universe multiverse<br>
deb-src http://archive.ubuntu.com/ubuntu/ focal main restricted universe multiverse<br>

deb http://archive.ubuntu.com/ubuntu/ focal-updates main restricted universe multiverse<br>
deb-src http://archive.ubuntu.com/ubuntu/ focal-updates main restricted universe multiverse<br>

deb http://archive.ubuntu.com/ubuntu/ focal-security main restricted universe multiverse<br>
deb-src http://archive.ubuntu.com/ubuntu/ focal-security main restricted universe multiverse<br>

deb http://archive.ubuntu.com/ubuntu/ focal-backports main restricted universe multiverse<br>
deb-src http://archive.ubuntu.com/ubuntu/ focal-backports main restricted universe multiverse<br>

deb http://archive.canonical.com/ubuntu focal partner<br>
deb-src http://archive.canonical.com/ubuntu focal partner<br>

If you are using kali as a virtual machine then paste this instead
As core Ubuntu repositories do not have the ARM repositories in them

deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports focal main restricted universe multiverse<br>
deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports focal-updates main restricted universe multiverse<br>
deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports focal-security main restricted universe multiverse<br>

deb [arch=i386,amd64] http://us.archive.ubuntu.com/ubuntu/ focal main restricted universe multiverse<br>
deb [arch=i386,amd64] http://us.archive.ubuntu.com/ubuntu/ focal-updates main restricted universe multiverse<br>
deb [arch=i386,amd64] http://security.ubuntu.com/ubuntu focal-security main restricted universe multiverse<br>

• Add the specified public keys

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 871920D1991BC93C

• Update

sudo apt update

• Now install snort

sudo apt install snort

Comments

[randydotwong]

Great article! Solved my problem on getting Snort installed on a VM.

I would like to point out that a couple of references to sources.list accidentally dropped the last s. You may want to correct that.

[Victoria]

Good job 😌

[yosef]

Thanks for this, worked like a charm.

Is there any cleanup needed to restore the old repositories back?

[Cyber Warlock]

Hi there,

I like the post, but unfortunately it's not really working for me. Could you please help out?

E: Failed to fetch archive.ubuntu.com/ubuntu/dists/fo... 404 Not Found [IP: 185.125.190.39 80]
E: Failed to fetch archive.ubuntu.com/ubuntu/dists/fo... 404 Not Found [IP: 185.125.190.39 80]
E: Failed to fetch archive.ubuntu.com/ubuntu/dists/fo... 404 Not Found [IP: 185.125.190.39 80]
E: Failed to fetch archive.ubuntu.com/ubuntu/dists/fo... 404 Not Found [IP: 185.125.190.39 80]
E: Some index files failed to download. They have been ignored, or old ones used instead.

┌──(root㉿kali-IDS)-[/home/cyber-warlock]
└─# apt install snort
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package snort

Even after following your steps it's still unable to find the snort package. Also several repo's aren't responding.

[Shaodmin]

I ran into a similar issue using a VM. When I swapped the sources.list out for the second one above (deb [arch=...), snort installed just fine.

[Kifaru Malale]

as the newbie , please am asking how did you do that?

[Kifaru Malale]

same problem as with me, and am still struggling out here, i am a begginer in this stuff, someone out there should please come and suggest something that is going to help us please

[Kifaru Malale]

└─$ sudo apt install snort
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Package snort is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'snort' has no installation candidate