Dashboard gone after deinstall of Snort
-
On a perfect working firewall 2.0.2, Dashboard widgets are gone but Snort Alerts.
You cannot add or delete anything.
-
UPDATE: It all comes back when the SNORT package is reinstalled!!!!!!!!!!!!!
-
UPDATE: It all comes back when the SNORT package is reinstalled!!!!!!!!!!!!!
The little fine-print at the bottom of the image in your post identifies the problem –
The Snort-Widgets apparently depends on the snort.inc file. Notice those error messages are saying that file cannot be found. That's because when you remove Snort, all of Snort's files go with it.
I would say the fix for this is the responsibility of the Snort-Widgets developer. If that package needs some specific Snort functions from that include file, it should incorporate them into its own file structure and not depend on the Snort package being there. Alternatively, it should safely check for the existence of Snort on the box prior to trying to use some of the Snort package's files.
Bill
-
Yes but it makes the rest of the dashboard go away! Its unusable…you cannot do anything at all unless you reinstall SNORT.
-
What if you uninstall the widget first and then uninstall snort?
-
Then its still working fine!
-
The Snort-Widget is the problem in this instance and not Snort itself. I'm about ready to generate the GitHub Pull Request for some more major Snort package improvements. I found lots of areas for stability improvements and added some new functionality for Community Rules and other stuff.
Once I get that Pull Request submitted, I can take a look at the Snort-Widget and see how to address the issue. There may be a way to to make the two packages auto-dependent on each other such that removing Snort auto-removes the Snort-Widget, and conversely, the Snort-Widget not install unless Snort is already installed.
Bill
-
Just send you an email ;)
-
That would be a NICE way to do it!
The Snort-Widget is the problem in this instance and not Snort itself. I'm about ready to generate the GitHub Pull Request for some more major Snort package improvements. I found lots of areas for stability improvements and added some new functionality for Community Rules and other stuff.
Once I get that Pull Request submitted, I can take a look at the Snort-Widget and see how to address the issue. There may be a way to to make the two packages auto-dependent on each other such that removing Snort auto-removes the Snort-Widget, and conversely, the Snort-Widget not install unless Snort is already installed.
Bill
-
That would be a NICE way to do it!
I agree 100%, but package developers are somewhat at the mercy of the pfSense core system because a "package" does not get control until very late in the install process.
-
Just checked the Snort Widget and its the problem of the require_once at line 58 in the snort_alerts.widgets.php file.
You can just add a if (file_exists) and the problem should be gone.Question is: Shouldn't deinstalling Snort also disable the Snort Widget?
-
Question is: Shouldn't deinstalling Snort also disable the Snort Widget?
Yeah, that's a valid point. Does anyone know who the Snort Widget maintainer is? I've never used it and am completely unfamiliar with its operation.
Bill
-
-
I did some fixes in the past and Ermal pushed them.
Would you consider making the change you suggested to the Snort Widget package and submitting it on GitHub for Ermal and team to review? I have a large number of pending Snort GUI changes submitted and in review now, and adding this in to that list would clutter it up I'm afraid.
Also, I think it's better if the Widget controls its own destiny by checking for the existence of any include files it wants to load, but does not own, before trying to load them. If it does not find the include file, it can surmise Snort is not installed and thus shutdown gracefully or otherwise avoid crashing the Dashboard GUI.
Bill
-
Did not notice your message…. :-
But I saw today someone (probably you!) updated the Widget. -
Did not notice your message…. :-
But I saw today someone (probably you!) updated the Widget.Yes, I made three changes to the Snort Dashboard Widget over the last couple of days. One was to put in the check for the "snort.inc" file being there before attempting "include it", and another was to properly handle the new timestamps with YEAR in them. The third change was to add an uninstall routine to the widget so that it cleans up after itself and removes its settings from the Dashboard's configuration variable. This stops the errors and messed up Dashboard when the widget package is removed, or Snort is removed and the widget not removed.
The new package is 0.3.3, and hopefully it works for everyone. You should be able to remove and reinstall. That seems to work best.
Bill
-
Updated to reflect push of Snort Dashboard Widget ver 0.3.4
A new version of the Snort Dashboard Widget
will hopefully go out soonis now out. The new version is 0.3.4. If you have the Snort Dashboard Widget installed, you most definitely want to update it to this latest version!I
justdiscovered a rather nasty little bug that causes the Snort Dashboard Widget to crash the package startup for Snort upon a reboot of the firewall. It only shows up when the widget is installed. I have tested the fix for this and it works. I inadvertently "included" an incorrect include file as part of the uninstall routine I added for the widget… :-[Bill
