LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 03-28-2004, 12:11 AM   #1
stakhous
Member
 
Registered: May 2003
Location: PA
Posts: 82

Rep: Reputation: 15
Snort refuses to read config file


I'm running RH 9.0 and I just installed snort-2.1.1 by running

./configure ; make install

Everything seems to work out fine. I can run snort by itself and it works fine.

snort -A fast -i eth1 -D

But when I specify snort.conf to implement the rules....

snort -A fast -i eth1 -c ./snort.conf

Running in IDS mode

<cut>

Initializing rule chains...

<cut>

telnet_decode arguments:
Ports to decode telnet on: 21 23 25 119
ERROR: Undefined variable name: (snort.conf:563): 10
Fatal Error, Quitting..

Any suggestions would be much appreciated.
 
Old 03-28-2004, 04:40 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,944
Blog Entries: 54

Rep: Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731
ERROR: Undefined variable name: (snort.conf:563): 10
"vi snort.conf +563" and check the variable.
Else post that part (-/+ 10 lines) of your conf
 
Old 03-28-2004, 07:20 PM   #3
stakhous
Member
 
Registered: May 2003
Location: PA
Posts: 82

Original Poster
Rep: Reputation: 15
This is a new error, I figured out the old on.


ERROR: snort.conf(285) => Invalid file name for IIS Unicode Map file.
Fatal Error, Quitting..

<line 285>
preprocessor http_inspect: global \
iis_unicode_map unicode.map 1252
<line 285>

This is a brand new snort.conf, one I haven't messed with. And I checked /rules and it does contain unicode.map.


Thanks, oh and I never new you could vi straight to the error with a +<line#> ... very cool.
 
Old 03-29-2004, 12:30 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,944
Blog Entries: 54

Rep: Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731
preprocessor http_inspect: global iis_unicode_map unicode.map 1252
Path to file. Add this line at the top of your snort.conf (adjust location):
var RULE_PATH /etc/snort/rules
Then chng line:
preprocessor http_inspect: global iis_unicode_map $RULE_PATH/unicode.map 1252
Now run Snort in test mode, add flag "-T".
 
Old 05-07-2004, 08:48 AM   #5
CerealKiller
LQ Newbie
 
Registered: May 2004
Posts: 1

Rep: Reputation: 0
I had the same problem. You have to copy the unicode.map file to the same location as the snort.conf file. (Or change the path in snort.conf like suggested above, but that didn't work on my installation)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Read parameters from config file (file parser?) alaios Programming 8 07-09-2012 11:29 AM
read options from config file biiiep Programming 4 05-05-2005 03:30 AM
logrotate appeares to not read the config file zby Debian 1 06-30-2004 10:34 AM
Snort ?config? problem: empty alert file Gyuszko Linux - Security 4 01-06-2004 03:41 PM
Unable to read config file............ FXRS Linux - Software 7 07-03-2003 08:36 AM


All times are GMT -5. The time now is 11:34 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration