Ubuntu & Snort, remove package

brandon77077 · 09-11-2014, 10:43 AM

I've already found a thread with the answer to my question, so I just need more help understanding how to implement it.

I've followed the article here:

And am at a point where the ACID config page is blank.

I created a quick phpinfo() page, and PHP is working properly.

Googled the issue and found: seclists.org/snort/2004/q3/412

So my questions is......how do I remove the PHP module they are referring too?

apt-get --purge isn't cutting it.

Basically I need help understanding their solution below. I'm not a novice but no Linux guru either.

Quote:

Well to reply to my own message, it seems that the default options php4 is
built with in the FreeBSD ports is insufficient to run ACID. It doesn't
include GD, session support or pcre.

I uninstalled the mod_php4 package, edited lang/php4/Makefile and added to
the CONFIGURE_ARGS --with-pcre --enable-bcmath --enable session --with-gd
--with-mysql -with-zlib-dir=/usr --enable-sockets then build from
www/mod_php4

I had to add the -with-zlib-dir=/usr because when I added --with-gd it died
not finding libz and I added --with-mysql just for the hell of it. pcre is
needed for running queries.

The new mod_php4 package seems to work just fine now. Maybe I should ask the
port maintainer to add these as options.

-Sean Brown Thanks!

buttugly · 09-11-2014, 01:39 PM

http://seclists.org/snort/2004/q3/412

If you read paragraph 1, you will see "FreeBSD ports". Since you are running Ubuntu I don't believe this applies to you as the php you installed was most likely not a freebsd port.

As far as what the guy actually did, removed the package he installed and then he compiled from source after editing the make file.

I looked at the original page you followed and it appears if you followed the destructions you should have php5.

Unfortunately I think you are back to square 1 with troubleshooting. There are a lot of steps involved with that setup with lots of opportunities for mistakes. Best suggestion I have is do it again, pay extrordinary attention to version numbers of everything and any quotes in config files. If any versions are different, your probably going to have to go to the release notes to see what might require a different syntax or something else altogether.

Lastly, ask your question on that page, they wrote it and most likley have the t-shirt and know how to fix it. Posting here is always a good idea but do both.

Thanks for the linux digest site, gonna go poke around in there.

Kevin