2. Installation
2.1 How to obtain KSnuffle
KSnuffle is available via the
KSnuffle
home page. It is available as source; binary and source RPMs may be
forthcoming for RedHat. It may also be available from the KDE
server or one of the mirrors.
2.2 Requirements
KSnuffle-0.5 has been built with:
- RedHat Linux 6.1
- KDE 1.1.2
- Qt 1.44
- egcs-1.1.2 (2.91.66) (G++ is known to have problems)
Ksnuffle it may or may not build or run properly with other versions.
As noted in the caveats section, it relies
on libpcap-0.4 and glib2 (aka libc6). Also, ksnuffle operates
outside the defined libpcap API; I am only able to test this for
Linux.
2.3 Compilation and installation
For the source version, on a system as described above, just type
% ./configure
% make
% make install
(the latter as root).
For the RPM version (if it exists!)
% rpm -ihv ksnuffle-0.5.rpm
2.4 Setuid-root installation
If KSnuffle is installed as a setuid-root program,
then, when run by root, it can be configured to allow other non-root users
to monitor the network. If it not installed setuid-root, then only root
can use it.
If this facility is required, use the command chmod ug+s ksnuffle
on the installed program. Alternatively, run KSnuffle as root and use
the control on the User Setup page.
Again, I can only verify this function on Linux.
2.5 Installing a remote sniffer
Ksnuffle can be used to sniff interfaces on remote
machines via a remote sniffer process. To install this:
-
Copy rsnuffle from the KDE binaries directory to a suitable
place (eg., /usr/sbin) on the remote machine
-
Add an entry into file /etc/services on the remote machine like
rsnuffle 900/tcp
-
Add en entry into the file /etc/inetd.conf on the remote
machine like rsnuffle stream tcp nowait root /usr/sbin/rsnuffle rsnuffle
-
Create a password file for rsnuffle /etc/rsnuffle.conf.
Each line should have the form ipaddr:password or
ipaddr/mask:password, where ipaddr is an IP address,
mask represents a network mask (eg., 24 represents
255.255.255.0) and password is a password.
-
/etc/rsnuffle.conf should be owned by root, and must not be
readable or writable other than root (ie., set permissions
-rw-------)
A connection to rsnuffle is authenticated against the first
entry in /etc/rsnuffle.conf which matches the caller's IP address.
Next
Previous
Table of Contents