Snort + Other Packages On 2.0 Embedded

jp141 · Oct 26, 2010, 5:33 PM

Hi,

So, due to the watchdog time-outs on my firebox hardware with 1.2.3 I switched to 2.0 with its extra offload/TCP options.

Touch wood it is running miles better and no watchdog errors!

But I have a problem, I cant seem to get any packages to install, I have tried File Manager and Snort, they say they have installed ok but you dont get any menu's for them, then if you try and do a reinstall you get this error php: /pkg_mgr_install.php: XML error: no packagegui object found!

I have looked through the known issues and forums but I cant seem to find anything relating to this.

I am running:

2.0-BETA4 (i386)
built on Mon Oct 25 03:35:05 EDT 2010
FreeBSD 8.1-RELEASE-p1

Snort:
Stable
2.8.6.1 pkg v. 1.35
platform: 2.0

I know this is Beta and this is not a nag, if its not working its not working, im fine with that.

But does anyone have any ideas?

azzido · Oct 27, 2010, 3:15 AM

Packages are not supported on embedded; partially because it uses read-only file system. You need to run full pfSense if you want to use packages.

cmb · Oct 27, 2010, 6:54 AM

Packages are fully supported on embedded - most of them at least. Snort probably doesn't run well on any embedded version as I don't think it's tested much or at all there, and it's so bloated it's not reasonable for most embedded platforms.

jp141 · Oct 27, 2010, 8:29 AM

Thanks everyone, most packages worked fine on 1.2.3 embedded. Snort also ran fine so there is no reason it should not work on 2.0 too.

The watchguard is a 1.2Mhz Celeron with 512mb ram so they should do!

jp141 · Oct 27, 2010, 10:31 AM

I have tested the 2.0 full install in a VM and things install fine so it is definatly a 2.0 + embedded issue.

Problem is I don't really want to run full from a CF card :(

jp141 · Nov 3, 2010, 3:14 PM

Anyone got any ideas on this one?

louis-m · Nov 4, 2010, 7:14 AM

can you not run full from an industrial cf card?

lol · Nov 4, 2010, 8:41 AM

Hi,

I bypassed this problem by doing like this :

Install with pkg_add in console
Reinstall with the GUI

It works for me. ;)

jp141 · Nov 4, 2010, 6:23 PM

@lol:

Hi,

I bypassed this problem by doing like this :

Install with pkg_add in console

Reinstall with the GUI

It works for me. ;)

Sounds good, do you have any more info on how to do this?

lol · Nov 5, 2010, 3:50 AM

Hi,
I proceed like that :

I Triyed to Install snort (or whatever else) via the Webgui but it failed failed.

Connect in SSH
Open a shell (hit 8)

/etc/rc.conf_mount_rw

pkg_add -r snort

/etc/rc.conf_mount_ro

exit

Go to the WebGUi, And if Snort doesn't appear, reinstall it. You should not have error.

jp141 · Nov 6, 2010, 9:30 AM

I tried that but I am getting:

pkg_add -r snort
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.1-release/Latest/snort.tbz… Done.
pkg_add: warning: package 'snort-2.8.5.3_1' requires 'pcre-8.02', but 'pcre-8.10' is installed

=========================================================================
Snort uses rcNG startup script and must be enabled via /etc/rc.conf
Please see /usr/local/etc/rc.d/snort
for list of available variables and their description.
Configuration files are located in /usr/local/etc/snort directory.

NOTE: Starting with Snort 2.4.0 (released on 2005-04-22)
the rules are no longer included with the distribution.
Please download them from http://www.snort.org/rules/.
You might consider installing security/oinkmaster port to simplify
rules downloads and updates.