4

I am trying to install Snort on Ubuntu 21.04 from source files as per instructions on the Snort website. I have followed videos on Youtube and got past a number of issues, but I am stuck at:

sp_rpc_check.c:32:10: fatal error: rpc/rpc.h: No such file or directory
   32 | #include <rpc/rpc.h>
      |          ^~~~~~~~~~~
compilation terminated.
make[4]: *** [Makefile:478: sp_rpc_check.o] Error 1
make[4]: Leaving directory '/usr/snort-2.9.18/src/detection-plugins'
make[3]: *** [Makefile:428: all] Error 2
make[3]: Leaving directory '/usr/snort-2.9.18/src/detection-plugins'
make[2]: *** [Makefile:547: all-recursive] Error 1
make[2]: Leaving directory '/usr/snort-2.9.18/src'
make[1]: *** [Makefile:505: all-recursive] Error 1
make[1]: Leaving directory '/usr/snort-2.9.18'
make: *** [Makefile:370: all] Error 2

Have tried sudo apt install libntirpc-dev as per another thread here on AskUbuntu.

I am relatively newbie. have done sudo apt update and sudo apt upgrade.

From the snort website, https://www.snort.org/#get-started, have done all of:

wget https://www.snort.org/downloads/snort/daq-2.0.7.tar.gz

wget https://www.snort.org/downloads/snort/snort-2.9.18.tar.gz
tar xvzf daq-2.0.7.tar.gz


cd daq-2.0.7
./configure && make && sudo make install
tar xvzf snort-2.9.18.tar.gz


cd snort-2.9.18

but when running :

./configure --enable-sourcefire && make && sudo make install

get the error described above

I have also sorted libpcap, libpcre and dnet issues out. So it is just this rpc issue now. Thanks

Artur Meinild
  • 31,035
omboidal
  • 41

6 Answers6

2

My OS is Debian, you can:

  1. Install the corresponding package with header files (what the -dev indicates).

    sudo apt install libntirpc-dev

  2. Find where all the header files live.

    dpkg -L libntirpc-dev

    You can see some outputs like this:

    /usr/include/ntirpc/rpc/rpc.h

  3. Append the header directory to configure. (the build wants rpc/rpc.h which is in /usr/include/ntirpc)

    ./configure --enable-optimizations --includedir=/usr/include/ntirpc/
zx485
  • 2,865
sunmin
  • 21
1

If your /usr/include/rpc folder does not include the rpc.h file and you already installied libntirpc-dev, try linking the header into the standard directory as described here! Another solution I found, was to use ./configure CFLAGS=-I/usr/include/tirpc described by @steeldriver in another answer here as a comment! The upvoted solution did not work for me unfortunately, even though it also includes the library directory path...

Gerry
  • 11
0

Decision is simple. You need to put missing files from here https://github.com/lattera/glibc/tree/master/sunrpc/rpc to /usr/include/rpc It's not secure, but working xD Look here

Андрей Горшков
  • 1
0

I did the snort configuration in Kali distribution

sp_rpc_check.c:32:10: fatal error: rpc/rpc.h: No such file or directory
   32 | #include <rpc/rpc.h>

Fix the problem as follows:

  1. Search for a library that includes rpc (apt-file search rpc/rpc.h)
  2. Installing (apt-get install libntirpc-dev)
  3. Copying files from the ntircp folder to rcp folder
  4. Run: make
  5. Modifying the path of the file not found
  6. Repeat the process until mistakes resolved

Ex. 1:

Copying files from ntirpc to rpc

sp_rpc_check.c:32:10: fatal error: rpc/rpc.h: No such file or directory
   32 | #include <rpc/rpc.h>

/include/ntirpc# cp rpc.h /usr/include/rpc

/snort_source/snort-2.9.18.1# make

Ex.2:

Editing types.h

/usr/include/rpc/types.h:189:10: fatal error: misc/abstract_atomic.h: No such file or directory
  189 | #include <misc/abstract_atomic.h>

Change the line from:

#include <misc/abstract_atomic.h>

to:

#include </usr/include/rpc/misc/abstract_atomic.h>

Then

/snort_source/snort-2.9.18.1# make

etc., ...

I modified the following files:

wait_queuq.h
clnt.h
rpc.h
pool_queue.h
svc.h
portable.h
types.h

as required by make.

Approx: 40 lines of code

Greenonline
  • 2,182
ElTeniente
  • 1
0

i had the same problem but got no help all over the internet then i figure out it myself. basically the file are there but somehow the snort looking in some other directories. so all the files needed are placed in /usr/include/ntirpc/ but you have to copy each file accordingly to its own directories

for example to solve the first error you need to copy the file in the dir /usr/include/ntirpc/rpc/rpc.h to the dir /usr/include/rpc/

that will solve the first error but there are alot of other errors coming up in the installation but the same process.

if the error is misc/anyfile then copy the file from /usr/include/ntirpc/misc/ to the location /usr/incldue/misc

if the erroor says anyfile.h remember to just copy it into the /usr/include/

WARIOR KHAN
  • 1
-1

Ask the packaging system:

dpkg -S /usr/include/rpc/rpc.h

That will tell you which package provides /usr/include/rpc/rpc.h. Install that package. Read man dpkg.

waltinator
  • 37,856