PfSense 2.4.0-RC - snort installation error
-
I installed snort on 2.4.0 RC a few days ago and did not have any problems. Also no problem when I updated to the latest version today.
-
Thank you for the replies!
This firewall was upgraded from 2.3.4-RELEASE-p1 with snort, pfblockerng and squid. With 2.3.4 everything was fine.
I'm using the Sync feature in snort to sync with two other sites I'm running so that may be the problem …
The sync feature use the xmlrpc sync and the package use the saved configuration when doing a reinstall so, snort try to use the xmlrpc sync and fail ... could that be it ?
If that is the problem how can I get the xlmrpc sync disabled in the config file when not having snort installed ?
-
Do a clean install and restore the configuration from a backup. It's likely that your system has unaccounted leftover files from previous versions that are now causing problems.
-
@bmeeks: XMLRPC is done differently (and whole lot more simple) on 2.4. Look at Squid, FreeRADIUS or other packages for code to use on 2.4. Current one is broken. Actually, Suricata is already OK so just copy from there.
-
@bmeeks: XMLRPC is done differently (and whole lot more simple) on 2.4. Look at Squid, FreeRADIUS or other packages for code to use on 2.4. Current one is broken. Actually, Suricata is already OK so just copy from there.
Thanks for the tip. I will take a look. I have not looked at the old XMLRPC code in Snort for a few years.
Bill
-
I installed snort on 2.4.0 RC a few days ago and did not have any problems. Also no problem when I updated to the latest version today.
This particular problem will only show up if you have firewall pairs using synchronization between them. Since most users do not use that configuration (especially home users), they will not see the error. Also why I missed it since I have not tested a sync pair of firewalls in quite some time.
Bill
-
Thanks for the tip. I will take a look. I have not looked at the old XMLRPC code in Snort for a few years.
Yeah I think I was the last person who touched it and that was back in 2.2.x days. :D
-
Good to know I'm a odd user :)
I got it running now. Backed up the config .. edited the config.xml disabling sync in the <snortsync>section .. restored the modified backup. Now its ok but I assume I can forget about sync for now. Hopefully there is an update to snort in the near future.
I have two SG-2440 and one SG-8860 running at three different sites. They all have the same config so I use the sync feature in pfblockerng, squid and snort. I have turned off sync in all packages for now to be safe until I learned a little more about 2.4. Anyone who knows if sync works in pfblockerng or squid running 2.4.0-RC?</snortsync>
-
Both Squid and pfBNG are just fine with 2.4 and XMLRPC sync.
-
Good to know I'm a odd user :)
I got it running now. Backed up the config .. edited the config.xml disabling sync in the <snortsync>section .. restored the modified backup. Now its ok but I assume I can forget about sync for now. Hopefully there is an update to snort in the near future.</snortsync>
I will submit an update for Snort to fix this in the near future. Can't give an exact promise date. I'm in the path to get some of Hurricane Irma as she dies down from a hurricane to a tropical storm. I live in southern Georgia a little east of center, so exactly what we get here in terms of wind is going to be determined by just how far west Irma gets before making that big turn to the north the weather guys are predicting. Might lose my Internet connection for a day or two …
Bill
-
I will submit an update for Snort to fix this in the near future. Can't give an exact promise date. I'm in the path to get some of Hurricane Irma as she dies down from a hurricane to a tropical storm. I live in southern Georgia a little east of center, so exactly what we get here in terms of wind is going to be determined by just how far west Irma gets before making that big turn to the north the weather guys are predicting. Might lose my Internet connection for a day or two …
Bill
Thank you for your effort to try make it work despite the weather disaster 8)
Both Squid and pfBNG are just fine with 2.4 and XMLRPC sync.
Tested now with squid and pfblockerng and it's working great. Thank you :)
-
The fix for the XMLRPC error has been submitted for review and approval by the pfSense developers. Here is a link to the pull request: https://github.com/pfsense/FreeBSD-ports/pull/418.
Thanks to @doktornotor for the tip to copy and paste his working code from the Suricata package.
Bill
-
@bmeeks, I hope you weathered Irma alright. That was a nasty storm.
-
@bmeeks, I hope you weathered Irma alright. That was a nasty storm.
Yep, turned out to be not much at my house. Just a few small twigs down and five inches of rain, but we've had double that amount of rain in past storms. I lost no trees, but some neighbors lost a few big pine trees. Didn't even lose power at my house, but others in neighborhoods nearby did lose it and some are still out. I guess I was lucky for this one. We had wind gusts in the 40s here according to the local airport data. This was less than the initial predictions. Irma sort of started to die out rather quickly on the way north through Florida.
Bill
-
The fix for the XMLRPC error has been submitted for review and approval by the pfSense developers. Here is a link to the pull request: https://github.com/pfsense/FreeBSD-ports/pull/418.
Thanks to @doktornotor for the tip to copy and paste his working code from the Suricata package.
Bill
Updated all three firewalls with the new snort version today. Sync works perfect :) Thank you !
