Snort 2.9.2.3 pkg v. 2.5.0 Issues
-
Can we get Snort to save blocked hosts that can survive a reboot??
-
Can we get Snort to save blocked hosts that can survive a reboot??
I can take a look at this. I don't use that feature, and thus have never investigated it. How are enabled/disabled rules holding up now? Do your changes survive rule updates and restarts?
-
Remove and Install latest v2.5.3
Got this behind the install frame window
Warning: file(/usr/local/etc/snort/rules/emerging-virus.rules): failed to open stream: No such file or directory in /usr/local/pkg/snort/snort.inc on line 947 Warning: Invalid argument supplied for foreach() in /usr/local/pkg/snort/snort.inc on line 953Got this when I stop and started the snort interface
22:55 mardi 22 janvier 2013 Warning: file(/usr/local/etc/snort/rules/emerging-virus.rules): failed to open stream: No such file or directory in /usr/local/pkg/snort/snort.inc on line 947 Warning: Invalid argument supplied for foreach() in /usr/local/pkg/snort/snort.inc on line 953 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 129 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 130 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 131 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 132 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 133 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 136I can add some more robust error checking to prevent this. Did you by chance make any rule category changes during the uninstall/re-install process? Just asking to help me better isolate where the problem might be.
Thanks,
Bill -
I havent had a rule update yet, so will revert back as soon as I have :)
Can we get Snort to save blocked hosts that can survive a reboot??
I can take a look at this. I don't use that feature, and thus have never investigated it. How are enabled/disabled rules holding up now? Do your changes survive rule updates and restarts?
-
Snort doesnt respect whitelisted Alias on the WAN side. Got blocked out and had to use the back entrance :D
-
And another thing….everytime I enable/disable a rule, it throws me back to the top of the page....that makes a lot of scrolling all the time!! Can it be changed somehow? So you either go back to where you were or not move at all?
-
And another thing….everytime I enable/disable a rule, it throws me back to the top of the page....that makes a lot of scrolling all the time!! Can it be changed somehow? So you either go back to where you were or not move at all?
I will try. That one may be a bit difficult to pull off with the way PHP handles POST back with forms. I agree on it being a pain with scrolling.
-
Thanks mate!! You are doing the PFSense community a big favor here!
Thank you :)
-
Dude…..Can you give me your account number so I can transfer some funds for your work? I would like to donate a little to your working efforts!
-
Dude…..Can you give me your account number so I can transfer some funds for your work? I would like to donate a little to your working efforts!
Thank you for the offer, but I don't have one. I'm contributing my efforts gratis since I also use the product. I made the changes originally for my own benefit, and decided to see if the community could benefit from them as well.
I still have a few little quirks to clean up that some folks have identified.
-
Its always there if you need it ;)
Have you considered the ability to sort all coloumns of the blocked IP's tab??
So one can sort it on number, IP Alert description and time?
And the same on the alerts tab?
-
Its always there if you need it ;)
Have you considered the ability to sort all coloumns of the blocked IP's tab??
So one can sort it on number, IP Alert description and time?
And the same on the alerts tab?
Yes on that, and also to sort the SIDs on the RULES tab. Tried to pull that off to begin with, but the way PHP handles multidimension arrays and sorting was giving me fits. Decided to put the changes out first to introduce the functionality, and then come back and add the bells and whistles.
Bill
-
Remove and Install latest v2.5.3
Got this behind the install frame window
Warning: file(/usr/local/etc/snort/rules/emerging-virus.rules): failed to open stream: No such file or directory in /usr/local/pkg/snort/snort.inc on line 947 Warning: Invalid argument supplied for foreach() in /usr/local/pkg/snort/snort.inc on line 953Got this when I stop and started the snort interface
22:55 mardi 22 janvier 2013 Warning: file(/usr/local/etc/snort/rules/emerging-virus.rules): failed to open stream: No such file or directory in /usr/local/pkg/snort/snort.inc on line 947 Warning: Invalid argument supplied for foreach() in /usr/local/pkg/snort/snort.inc on line 953 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 129 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 130 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 131 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 132 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 133 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/pkg/snort/snort.inc:947) in /usr/local/www/snort/snort_interfaces.php on line 136However snort seems to be running fine.
I cycle power on the DSL modem and it did not block the WAN IP. Its seems to behave ok.
Update on this report: I found the cause. I was doing some poor error checking. Basically what's happening is that upon package remove and re-install, the Rules directory is empty of all files, but your saved "selected categories" (which are really just the filenames with no content) are saved in the pfSense config.xml file. So when you remove and re-install Snort with the "save configuration option" checked, it remembers your previous rule categories.
Upon the first startup following the package re-installation, it tries to read those files to get the rule contents, but because a Rules update has not been done and the Rules directory is empty, it pops up the error you see. This error will show different files for different folks depending on what rule categories they had previously enabled.
I can add an easy fix for this to basically check that the files exist before trying to read them. My mistake for not thinking of that to start with… :-[
I am collecting up the fixes for these little glitches and will submit them to Ermal for an update.
Bill
-
Damn nice!! Nothing more to say :)
-
I fixed the missing file issue by just adding the checks.
Supermule you can already sort afaik in the gui by clcking on the headers, no?
-
Snort doesnt respect whitelisted Alias on the WAN side. Got blocked out and had to use the back entrance :D
Can you explain here and you are taling about pfblocker or about the default homelist generated?
-
¨Whitelist in Snort…you create an alias and use that as whitelist. IP adresses listed in this doesnt get respected if on the WAN side. Local servers are fine, but external IP doesnt get whitelisted.
-
Nope…
@ermal:
I fixed the missing file issue by just adding the checks.
Supermule you can already sort afaik in the gui by clcking on the headers, no?
-
@ermal:
I fixed the missing file issue by just adding the checks.
Supermule you can already sort afaik in the gui by clcking on the headers, no?
Hi Ermal:
By my count, there were four places in the code where this potential issue existed. Three in snort.inc, and one in snort_check_for_rule_updates.php. They are in the following functions:
snort_build_sid_msg_map()
snort_load_rules_map()
snort_generate_conf()
snort_apply_customizations()Bill
-
Have been following this closely & This is awesome. Thanks bmeeks!
