Snort + Other Packages On 2.0 Embedded

azzido

Packages are not supported on embedded; partially because it uses read-only file system. You need to run full pfSense if you want to use packages.

cmb

Packages are fully supported on embedded - most of them at least. Snort probably doesn't run well on any embedded version as I don't think it's tested much or at all there, and it's so bloated it's not reasonable for most embedded platforms.

jp141

Thanks everyone, most packages worked fine on 1.2.3 embedded. Snort also ran fine so there is no reason it should not work on 2.0 too.

The watchguard is a 1.2Mhz Celeron with 512mb ram so they should do!

jp141

I have tested the 2.0 full install in a VM and things install fine so it is definatly a 2.0 + embedded issue.

Problem is I don't really want to run full from a CF card :(

jp141

Anyone got any ideas on this one?

louis-m

can you not run full from an industrial cf card?

lol

Hi,

I bypassed this problem by doing like this :

Install with pkg_add in console
Reinstall with the GUI

It works for me. ;)

jp141

@lol:

Hi,

I bypassed this problem by doing like this :

Install with pkg_add in console

Reinstall with the GUI

It works for me. ;)

Sounds good, do you have any more info on how to do this?

lol

Hi,
I proceed like that :

I Triyed to Install snort (or whatever else) via the Webgui but it failed failed.

Connect in SSH
Open a shell (hit 8)

/etc/rc.conf_mount_rw

pkg_add -r snort

/etc/rc.conf_mount_ro

exit

Go to the WebGUi, And if Snort doesn't appear, reinstall it. You should not have error.

jp141

I tried that but I am getting:

pkg_add -r snort
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.1-release/Latest/snort.tbz… Done.
pkg_add: warning: package 'snort-2.8.5.3_1' requires 'pcre-8.02', but 'pcre-8.10' is installed

=========================================================================
Snort uses rcNG startup script and must be enabled via /etc/rc.conf
Please see /usr/local/etc/rc.d/snort
for list of available variables and their description.
Configuration files are located in /usr/local/etc/snort directory.

NOTE: Starting with Snort 2.4.0 (released on 2005-04-22)
the rules are no longer included with the distribution.
Please download them from http://www.snort.org/rules/.
You might consider installing security/oinkmaster port to simplify
rules downloads and updates.