Snort 2.9.4.1 pkg v. 2.5.5 Issue(s)

judex

I had those start issues after updates and added "sleep 3" to the start script yesterday. Since then snort started fine after an update where all 3 ruletypes were new and also after an update where no new rules got downloaded.

Looks good!

Greets, Judex

bmeeks

@judex:

I had those start issues after updates and added "sleep 3" to the start script yesterday. Since then snort started fine after an update where all 3 ruletypes were new and also after an update where no new rules got downloaded.

Looks good!

Greets, Judex

Good. Glad that seems to be a good interim solution. Different users may have to try slightly longer sleep times depending on how long Snort typically takes to shutdown on their hardware. As I said in a previous post, this would depend on how robust the hardware is and how many rules are active. I know in my case with Snort running on three interfaces on an Atom 330 box, it takes several seconds for Snort to shutdown. It takes much longer for it to start up. That's due to my lower-end hardware and the rules I normally run.

Bill

Supermule

The fix didnt work. Both boxes killed despite the difference in the .sh file.

Box 1 with the modded file:

Apr 19 00:06:06 kernel: pid 49942 (snort), uid 0: exited on signal 11
Apr 19 00:06:06 kernel: em0: promiscuous mode disabled
Apr 19 00:06:05 snort[49942]: FATAL ERROR: Flowbits: flowbits name is limited to any alphanumeric string including .-_
Apr 19 00:06:05 snort[49942]: FATAL ERROR: Flowbits: flowbits name is limited to any alphanumeric string including .-_
Apr 19 00:06:01 php: : The Rules update has finished.
Apr 19 00:06:01 php: : Snort has restarted with your new set of rules…
Apr 19 00:05:59 SnortStartup[33057]: Snort SOFT START For Internet(36256_em0)…
Apr 19 00:05:58 php: : Building new sig-msg.map file for WAN...
Apr 19 00:05:56 php: : Resolving and auto-enabling any flowbit-required rules for WAN...
Apr 19 00:05:54 php: : Updating rules configuration for: WAN ...
Apr 19 00:05:49 php: : EmergingThreats rules file update downloaded succsesfully
Apr 19 00:05:46 php: : There is a new set of EmergingThreats rules posted. Downloading...
Apr 19 00:05:46 php: : Snort GPLv2 Community Rules file update downloaded succsesfully
Apr 19 00:05:45 php: : There is a new set of Snort GPLv2 Community Rules posted. Downloading...
Apr 19 00:05:44 php: : Snort Rules Attempts: 1
Apr 19 00:04:51 php: : There is a new set of Snort VRT rules posted. Downloading...
Apr 19 00:04:51 php: : Snort MD5 Attempts: 2

Box 2 nothing changed:

Apr 19 00:09:23 php: : The Rules update has finished.
Apr 19 00:09:23 php: : Snort has restarted with your new set of rules...
Apr 19 00:09:21 SnortStartup[60130]: Snort SOFT START For Internet(9626_em0)…
Apr 19 00:09:21 snort[7492]: Could not remove pid file /var/run/snort_em09626.pid: No such file or directory
Apr 19 00:09:21 snort[7492]: Could not remove pid file /var/run/snort_em09626.pid: No such file or directory
Apr 19 00:09:20 kernel: em0: promiscuous mode disabled
Apr 19 00:09:20 snort[7492]: *** Caught Term-Signal
Apr 19 00:09:20 snort[7492]: *** Caught Term-Signal
Apr 19 00:09:19 SnortStartup[58451]: Snort STOP For Internet(9626_em0)…
Apr 19 00:09:19 php: : Building new sig-msg.map file for WAN...
Apr 19 00:09:17 php: : Resolving and auto-enabling any flowbit-required rules for WAN...
Apr 19 00:09:15 php: : Updating rules configuration for: WAN ...
Apr 19 00:09:13 php: : EmergingThreats rules file update downloaded succsesfully
Apr 19 00:09:11 php: : There is a new set of EmergingThreats rules posted. Downloading...
Apr 19 00:09:10 php: : Snort GPLv2 Community Rules file update downloaded succsesfully
Apr 19 00:09:09 php: : There is a new set of Snort GPLv2 Community Rules posted. Downloading...
Apr 19 00:09:08 php: : Failed Rules Filesize: 251
Apr 19 00:09:08 php: : Snort VRT rules file download failed...
Apr 19 00:09:08 php: : Snort Rules Attempts: 5
Apr 19 00:06:04 php: : There is a new set of Snort VRT rules posted. Downloading...
Apr 19 00:06:04 php: : Snort MD5 Attempts: 3

gogol

I am still testing because I am not sure about things.
Be careful about changes in /usr/local/etc/rc.d/snort.sh because the file can be recreated when you change something and your changes are lost.
I had this prior to a manual update, so I had an update with the old /usr/local/etc/rc.d/snort.sh file:

/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/snort/snort_check_for_rule_updates.php >> /tmp/snort_update.log

and snort crashed:

Apr 19 10:46:56	php: : The Rules update has finished.
Apr 19 10:46:56	php: : Snort has restarted with your new set of rules...
Apr 19 10:46:54	kernel: pid 86248 (snort), uid 0: exited on signal 11
Apr 19 10:46:54	SnortStartup[30864]: Snort SOFT START For WAN(54477_em0)...
Apr 19 10:46:53	snort[86248]: Could not remove pid file /var/run/snort_em054477.pid: No such file or directory
Apr 19 10:46:53	kernel: em0: promiscuous mode disabled
Apr 19 10:46:53	snort[86248]: *** Caught Term-Signal
Apr 19 10:46:52	SnortStartup[29535]: Snort STOP For WAN(54477_em0)...
Apr 19 10:46:51	php: : Building new sig-msg.map file for WAN...
Apr 19 10:46:42	php: : Resolving and auto-enabling any flowbit-required rules for WAN...
Apr 19 10:46:35	php: : Updating rules configuration for: WAN ...
Apr 19 10:46:25	php: : EmergingThreats rules file update downloaded succsesfully
Apr 19 10:46:20	php: : There is a new set of EmergingThreats rules posted. Downloading...
Apr 19 10:46:20	php: : Snort Rules Attempts: 1
Apr 19 10:45:59	php: : There is a new set of Snort VRT rules posted. Downloading...
Apr 19 10:45:59	php: : Snort MD5 Attempts: 1

I did this manual update because I did not want to wait for an automatic update. BTW: changing the interval in the Global Settings of Snort did not change anything in /etc/crontab. The interval there stays at 12 hours. Another bug?

@Supermule In my opinion has that Flowbits Fatal Error on box 1 nothing to do with the rules update problem. More with a syntax error in a flowbits rule. Did you change anything? And I see that on box 2 there is an update of the VRT rules within 15 minutes from box 1, that is why the update fails (at least if you use identical OINK codes).
And why do you use the GPLv2 Community rules as they are a subset of the VRT rules? I am saying this to rule out possible extra problems.

Supermule

Didnt change a thing compared to running it on 2.0.2.

I use identical OINK codes. I guess thats not good?
I am not a paid subscriber, so the GPLv2 rules I believe is not part of the VRT ruleset?

bmeeks

@Supermule:

Didnt change a thing compared to running it on 2.0.2.

I use identical OINK codes. I guess thats not good?
I am not a paid subscriber, so the GPLv2 rules I believe is not part of the VRT ruleset?

Gogol is correct about the 15-minute window with Snort VRT. It is a limit imposed by them to limit traffic I guess.

As for the snort.sh script getting overwritten, it is true that several actions in the GUI will cause the generation of a new snort.sh file. For example, adding or deleting an interface, or enabling or disabling Barnyard2 on an interface, are all GUI edits that will cause a new snort.sh file to get created. Not saying you did that, but just go back and check that the snort.sh file still contains the mod you made.

Oh, and Gogol is also correct about the Flowbits syntax error and subsequent FATAL ERROR on startup. That's not related to the issue we've been chasing. There is either a typo in somebody's text rule that came down in one of the updates, or your downloaded file got corrupted somehow. I lean toward option #1 with maybe a typo in the rule.

My production firewall got updates at midnight U.S. Eastern last night for both VRT and ET and restarted with no problems. I run Snort on three interfaces. So the fact this is not affecting everyone makes it hard to nail down for sure. I still think I'm on the right track, though.
Bill

Supermule

I will send you info on your mail. Then you can see it "live" :)

bmeeks

@Supermule:

I will send you info on your mail. Then you can see it "live" :)

OK. I have to be away from my PC for a while. It's currently 9:00 AM where I am, and my wife has me a list of things to take care of before this evening when some family arrives for a weekend visit… ;D

Bill

sronsen

I updated to pfSense 2.0.3 last evening and Snort was updated automatically as well, despite the fact that Snort updates have been problematic for me for several years and, if given a choice, I would never have selected upgrading both Snort and pfSense at the same time.

My issue is the inability to start Snort. Attempting to start from the command-line gives this message: "/libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout". Nothing related to snort is being logged in the system log. The new update logs shows that the rules updates were successful. I have removed and reinstalled Snort several times, including manual removals of Snort files and reboots before re-installs. Nothing seems to help.

Any suggestions?

Supermule

Just send you the link and its a 5mn video :)

kilthro

Bill,
I am going to put my posts here so you are not having to go between two topics.. Ok going back into the file today, I see that the sleep command was gone from my edit yesterday. Now, the only thing I can think of is I made a change to the gui and it overwrote the file back at its defaults. This is most likely what caused the fail this morning when I updated my rules manually. So I added the sleep command back and then deleted the md5 files. With snort running I clicked the update rules and it went through successfully without leaving snort in the stopped phase.

Right now auto updates are turned off. So I went into the gui and turned them back on daily. I then rechecked the snort sh file and the sleep command is gone again. So my tests on that command not working were skewed since I didnt realize those changes would get removed if I touched the gui.

So since the manual test was successful, I am going to enable the auto updates, then edit the file with the sleep command and see if it works just fine.

bmeeks

@kilthro:

Bill,
I am going to put my posts here so you are not having to go between two topics.. Ok going back into the file today, I see that the sleep command was gone from my edit yesterday. Now, the only thing I can think of is I made a change to the gui and it overwrote the file back at its defaults. This is most likely what caused the fail this morning when I updated my rules manually. So I added the sleep command back and then deleted the md5 files. With snort running I clicked the update rules and it went through successfully without leaving snort in the stopped phase.

Right now auto updates are turned off. So I went into the gui and turned them back on daily. I then rechecked the snort sh file and the sleep command is gone again. So my tests on that command not working were skewed since I didnt realize those changes would get removed if I touched the gui.

So since the manual test was successful, I am going to enable the auto updates, then edit the file with the sleep command and see if it works just fine.

Yeah, I posted in another thread (or maybe this one, I'm losing track… :D) about how certain changes in the GUI will cause the snort.sh shell script to be recreated. This is necessary, for instance, should someone add or delete an interface, or enable or disable Barnyard2 on an interface. Other configuration changes can also trigger the recreation of snort.sh.

I'm working on a permanent fix now.

Bill

bmeeks

@sronsen:

I updated to pfSense 2.0.3 last evening and Snort was updated automatically as well, despite the fact that Snort updates have been problematic for me for several years and, if given a choice, I would never have selected upgrading both Snort and pfSense at the same time.

My issue is the inability to start Snort. Attempting to start from the command-line gives this message: "/libexec/ld-elf.so.1: /usr/local/lib/libdnet.1: unsupported file layout". Nothing related to snort is being logged in the system log. The new update logs shows that the rules updates were successful. I have removed and reinstalled Snort several times, including manual removals of Snort files and reboots before re-installs. Nothing seems to help.

Any suggestions?

This error message almost always means you have mixed 32-bit and 64-bit libraries on the system. These "unsupported layout" errors have happened before for many other packages besides just Snort, and each time it's caused by having a mix of 32-bit and 64-bit stuff on a system. In particular this error can happen when 64-bit libs wind up on a 32-bit box. I can't tell you how this might have happened, but I'm pretty sure that's what is wrong now.

You didn't mention in your post whether you were using the 32-bit or 64-bit version of pfSense 2.0.3. From the error, I'm guessing maybe 32-bit pfSense and you have somehow picked up some 64-bit libraries along the way. Did you by chance have any other packages installed besides Snort?

Here is my suggestion for you. Go to the Installed Packages tab and remove Snort by clicking the X icon.

Get command line access to the box and issue the three commands below.


rm -rf /usr/local/etc/snort
rm -rf /usr/local/lib/snort
rm -rf /usr/local/etc/snort

If possible, now reboot the firewall.
When it comes back up, install Snort again from the Available Packages tab.

I still can't guarantee you this will fix it, though. With a mix of 32-bit and 64-bit stuff, I hate to say it but you might be better saving off the configuration and rebuilding the box from a fresh ISO image. Search the forums here for the "unsupported file layout" message and you should find several other posts about it. See what was suggested to those folks for a fix.

Bill

gogol

@Supermule:

Didnt change a thing compared to running it on 2.0.2.

I use identical OINK codes. I guess thats not good?
I am not a paid subscriber, so the GPLv2 rules I believe is not part of the VRT ruleset?

No problem using the same OINK code on another box, but an update of the VRT rules will fail if the update is within 15 minutes. You just have to take that into account.
If you are not paying for the VRT rules, you will get a 30 days old ruleset. The GPLv2 ruleset is a subset of the VRT ruleset (http://blog.snort.org/2013/03/the-sourcefire-vrt-community-ruleset-is.html), but you get them on the day they are released.

bmeeks

Guys:

I think I have a good fix for the Snort restart issues after rule updates. I'm testing it out on my own box and on some VMs over the weekend. If all goes well, I will create a Github Pull Request for the pfSense team probably Sunday afternoon or evening. I have some family commitments this weekend that will prohibit me from working on and submitting the request until then.

Sorry for the small delay,
Bill

kilthro

Its ok Bill. Enjoy the time with the Family. Thanks for the update!

Supermule

Take it easy mate! Family is more important than Pfsense :)

Enjoy!

@bmeeks:

Guys:

I think I have a good fix for the Snort restart issues after rule updates. I'm testing it out on my own box and on some VMs over the weekend. If all goes well, I will create a Github Pull Request for the pfSense team probably Sunday afternoon or evening. I have some family commitments this weekend that will prohibit me from working on and submitting the request until then.

Sorry for the small delay,
Bill

kilthro

Bill
Just following up. The sleep command did allow my rules to auto update this morning. So this will work until you are able to push out the fix.

Thanks.

gogol

Log after updating ET rules and only "rc_start" mod (no sleep timer). I just have to wait for VRT rules update:


Apr 20 12:04:49	kernel: em0: promiscuous mode enabled
Apr 20 12:04:18	kernel: em0: promiscuous mode disabled
Apr 20 12:04:17	snort[91873]: SMTP reload: Changing the file_depth requires a restart.
Apr 20 12:04:10	barnyard2[92336]: database: Closing connection to database "snort"
Apr 20 12:04:10	php: : The Rules update has finished.
Apr 20 12:04:10	php: : Snort has restarted with your new set of rules...
Apr 20 12:04:08	SnortStartup[94539]: Snort SOFT START For WAN(54477_em0)...
Apr 20 12:04:07	php: : Building new sig-msg.map file for WAN...
Apr 20 12:03:59	php: : Resolving and auto-enabling any flowbit-required rules for WAN...
Apr 20 12:03:51	php: : Updating rules configuration for: WAN ...
Apr 20 12:03:50	php: : EmergingThreats rules file update downloaded succsesfully
Apr 20 12:03:47	php: : There is a new set of EmergingThreats rules posted. Downloading...
Apr 20 12:03:47	php: : Snort VRT rules are up to date...
Apr 20 12:03:47	php: : Snort MD5 Attempts: 1

Note: barnyard2 does not restart! I left out the other barnyard2 entries and snort.sh has changed. Barnyard2 is closing after the check for the pidfile? This should be fixed too.