How to navigate disk inside Netgate appliance from GUI?

[NogBadTheBad]

@rloeb Get a sftp client like transmit:-

[Gertjan]

@rloeb said in How to navigate disk inside Netgate appliance from GUI?:

and users who actually need to be able to navigate from the GUI to view (and download) logs and tcp dumps.

Users that download files like "tcp dumps" ... and can do something - like understanding them - these files ?
Now these are the real admins !!
Just give them an access, as they already know what to do for the rest.

Ntw : the syslog could be send to a centralized syslog server.

[rloeb]

@teamits You can download a file if your know it's full path. That feature is part of the "command prompt" page. That's the reason I want users to be able to navigate the directory tree -- to find the file they want to download. (It would be easier if Netgate published the locations of relevant files. Example: Snort has a feature that automatically captures packets that generate an alert, but nowhere is there any mention of where those packet capture files are stored.)

[SteveITS]

@rloeb said in How to navigate disk inside Netgate appliance from GUI?:

download a file if your know it's full path

I stand corrected, guess I never used that page for that. :)

Try 'find / -name "*.pcap"' if you know the extension, perhaps limited to /var instead of /. Or "find / -type f -mtime -1" for files in the last day.

[rloeb]

@teamits Thank you.

[rloeb]

@rloeb Note: If you use WinSCP to navigate the disk in a Netgate pfsense appliance, you cannot download the files that are captured by the process I was using. Access is denied when you attempt to download. I don't understand why access is denied, although I can appreciate why "write" or "modify" access would be denied.

[Gertjan]

Strange.

Just tested WinSCP myself.
When packet capturing from this web page https://pfsense.local.net/diag_packet_capture.php ( it tells me where the captured file is kept ) :

$fp = "/root/";
$fn = "packetcapture.cap";

I could load the /root/packetcapture.cap file with a click :

[rloeb]

@gertjan .../diag_packet_capture.php is the page displayed from the pfsense menu: Diagnostics|Packet Capture. I do not find any information there about where the captured packet is stored. (However, there may be such information if packets are captured using the packet capture capabilities on that page, which I didn't attempt.)

The packets captured from Services|Snort|Edit Interface|LAN|Alert Settings|Enable Packet Captures are stored in a directory: /var/log/snort/snort_igbnnnnnn (nnnnnn = 6 digits; new directory created each time instantiated) as a .log file. If "Enable Unified2 Logging" is also checked, then a .U2 file is also created in the same directory.

That directory cannot be opened by WinSCP (permission denied). The only way I have found to display or download either file is by using Diagnostics|Command Prompt within Snort.

[Gertjan]

@rloeb

Didn't know you were using snort.

Thought it was :

[rloeb]

@gertjan Regardless, your help has been invaluable. I learned a bunch!

[stephenw10]

You can just browse (and open) files in Diag > Edit File. Often easiest.

Steve

[rloeb]

@stephenw10 My issue was finding the file to view/edit :-)

[stephenw10]

Right but you can click browse there and look for it if you have some vague idea.