LinuxQuestions.org - Snort error on middlebox: Undefined variable name

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - Snort error on middlebox: Undefined variable name (https://www.linuxquestions.org/questions/linux-security-4/snort-error-on-middlebox-undefined-variable-name-705704/)

Snort error on middlebox: Undefined variable name

Hey guys,

I'm in the process of setting up a middlebox for my cluster, and I'm trying to get snort running. When I run sudo /etc/rc.d/snort start, I get this:

Code:

:: Starting Intrusion Database System: SNORT                            [BUSY] Running in IDS mode

...

Initializing rule chains...

ERROR: Undefined variable name: (/etc/snort/rules/community-smtp.rules:6): SMTP_SERVERS

Fatal Error, Quitting..

I was thinking about commenting out line six but I'm not sure. Also, I use oinkmaster to update I rules. Let me know if you want to see my oinkmaster.conf or my snort.conf

Quote:

Originally Posted by wsduvall (Post 3448691)

ERROR: Undefined variable name: (/etc/snort/rules/community-smtp.rules:6): SMTP_SERVERS

'grep "var SMTP_SERVERS" /path/to/snort.conf' and see if it's commented out.

Quote:

Originally Posted by wsduvall (Post 3448691)

I was thinking about commenting out line six but I'm not sure.

Can be kept commented out if you run no SMTP servers on your network.

BTW, it's "Intrusion Detection System" not "Intrusion Database System".

Thanks so much! (I didn't write the RC file :P)