LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 02-01-2005, 11:02 AM   #1
havelino
LQ Newbie
 
Registered: Jan 2005
Location: The Netherlands
Distribution: Debian 3.0 Sarge
Posts: 29

Rep: Reputation: 15
Unhappy Snort daemon


System settings:
kernel: 2.6.10
kde: 3.3.2
snort: 2.2.0

I'm trying 2 setup snort to run on startup with the following options:
-vde -c /etc/snort/snort.conf -l /home/.../snort_log

insert with dpkg-reconfigure snort
cat snort.debian.conf
# This file is used for options that are changed by Debian to leave
# the original lib files untouched.
# You have to use "dpkg-reconfigure snort" to change them.

DEBIAN_SNORT_STARTUP="boot"
DEBIAN_SNORT_HOME_NET="ANY"
DEBIAN_SNORT_OPTIONS="-vde -c/etc/snort/snort.conf -l/home/.../snort_log"
DEBIAN_SNORT_INTERFACE="eth0"
DEBIAN_SNORT_STATS_RCPT="root"
DEBIAN_SNORT_STATS_THRESHOLD="1"

the problem is that snort doesn't log anything
if I run the following in a console:
snort -vde -c/etc/snort/snort.conf -l/home/.../snort_log
It works perfect!

I checked the paths but they where also correct.

So does somebody know what i'm doing wrong?

TNX

Hugo
 
Old 02-01-2005, 11:32 PM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
After a reboot, do you see the Snort process running in the output of ps?
Anything in the system logs or dmesg?

if I run the following in a console:
snort -vde -c/etc/snort/snort.conf -l/home/.../snort_log
It works perfect!


Does it just start or will it actually log alerts to the snort_log file?
Try manually starting snort at boot by putting an entry in /etc/rc.local to see if it has to do with the debian start script.
 
Old 02-03-2005, 04:13 AM   #3
havelino
LQ Newbie
 
Registered: Jan 2005
Location: The Netherlands
Distribution: Debian 3.0 Sarge
Posts: 29

Original Poster
Rep: Reputation: 15
tnx 4 the tips

I find nothing in dmesg and in the syslog files.
I really don't know where the rc.local file is in the Debian.

Maybee this is the prob, investigating
 
Old 02-03-2005, 06:12 AM   #4
havelino
LQ Newbie
 
Registered: Jan 2005
Location: The Netherlands
Distribution: Debian 3.0 Sarge
Posts: 29

Original Poster
Rep: Reputation: 15
Problem fixed.

There are 2 ways to fix this:

change the snort.common.parameters 2 your needs or
make a new file where you tell how snort has to start when youre system boots.

In the file:
#! /bin/sh
snort -de -c /etc/snort/snort.conf -l /home/.../snort_log/ -D


http://www.debian.org/doc/FAQ/ch-cus...tombootscripts
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Error when starting up snort: bash:!/bin/sh/usr/local/bin/snort :Eent not found cynthia_thomas Linux - Software 1 11-11-2005 03:59 PM
kernel panic after starting snort daemon dracolich Linux - Security 3 07-14-2005 07:08 PM
snort failed: snort: symbol lookup error: undefined symbol: usmAES192PrivProtocol Emmanuel_uk Linux - Security 1 07-10-2005 11:29 AM
reconfigure snort daemon startup script hari_seldon99 Linux - Security 1 05-18-2004 02:40 AM
I want to start Snort as a service/daemon Olusegun Linux - Software 3 10-15-2002 11:35 AM


All times are GMT -5. The time now is 03:06 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration