Snort problem

MartyMcFly · 04-03-2007, 12:12 AM

I'm trying to start snort service and having an error (this is the end of the log):

Code:

Apr  3 02:02:15 [snort] FATAL ERROR: /etc/snort/snort.conf(573) unknown preprocessor "ftp_telnet"_

It's snort v2.6.1.3-r1. I've installed it from scratch using Gentoo Portage, just like this article explains:

http://gentoo-wiki.com/HOWTO_Snort

Googling around I've found that this could happen if you were using an old conf file. My snort.conf is the one Portage is delivering... so I don't think this is an old .conf (from snort v2.4 or something like that).

It seems like it's a missing preprocessors problem, but not only that one. The ones that follow in the .conf file are missing too. I've commented the lines of ftp_telnet and got new similar ones:

Code:

Apr  3 02:10:28 [snort] FATAL ERROR: /etc/snort/snort.conf(622) unknown preprocessor "smtp"

Any ideas? Should I report this to Gentoo bugzilla?

gloomy · 04-03-2007, 04:25 AM

The delivered snort.conf is just an example - try to write one from a scratch.

I noticed some time ago that the example file tries to load the preprocessors from a wrong directory (/usr/local/lib/snort_dynamicpreprocessor/), while the correct one is /usr/lib/snort_dynamicpreprocessor.

Those are all Gentoo-specific, and therefore, if you have more similar problems, go with the mentioned bugzilla.

MartyMcFly · 04-03-2007, 11:26 AM

Thanks for your answer gloomy. The thing is... I've just noticed I don't have any of those dirs!

Code:

$ ll /usr/lib/ | grep snort
drwxr-xr-x   2 root root     224 Apr  3 00:44 snort_dynamicengine

$ ll /usr/local/lib/
total 0

It seems like the emerge tool didn't install them (?) Do I have to install them manually? Aren't they in Portage?

MartyMcFly · 04-18-2007, 10:38 AM

Does anyone have a clue about this?