3. Snort, problem with startup services

Snort, problem with startup services

  • S

    After fresh install PF 1.2.3 with snort beta (or normal), i can t started the service. What could be the problem?

    I have P4 2.8MHz, 3GB ram,… before it works OK,... only the difference is, new rules/category.

    How can i add more memory to snort? Do i need any change to done in config file?

    Thanks for your support

    LOG FILE:

    Dec 26 07:39:08 SnortStartup[62064]: MEM after 0em1 START 63M
    Dec 26 07:39:08 SnortStartup[62059]: Snort HARD Reload For 0em1…
    Dec 26 07:39:08 syslogd: kernel boot file is /boot/kernel/kernel
    Dec 26 07:38:44 syslogd: kernel boot file is /boot/kernel/kernel
    Dec 26 07:38:44 syslogd: exiting on signal 15
    Dec 26 07:37:34 SnortStartup[61568]: MEM after 0em1 START 62M
    Dec 26 07:37:34 SnortStartup[61563]: Snort HARD Reload For 0em1…
    Dec 26 07:37:34 syslogd: kernel boot file is /boot/kernel/kernel
    Dec 26 07:36:39 SnortStartup[60939]: MEM after 0em1 START 63M
    Dec 26 07:36:39 SnortStartup[60934]: Snort HARD Reload For 0em1…

    0
  • J

    @simby:

    After fresh install PF 1.2.3 with snort beta (or normal), i can t started the service. What could be the problem?

    I have P4 2.8MHz, 3GB ram,… before it works OK,... only the difference is, new rules/category.

    How can i add more memory to snort? Do i need any change to done in config file?

    Thanks for your support

    LOG FILE:

    Dec 26 07:39:08 SnortStartup[62064]: MEM after 0em1 START 63M
    Dec 26 07:39:08 SnortStartup[62059]: Snort HARD Reload For 0em1…
    Dec 26 07:39:08 syslogd: kernel boot file is /boot/kernel/kernel
    Dec 26 07:38:44 syslogd: kernel boot file is /boot/kernel/kernel
    Dec 26 07:38:44 syslogd: exiting on signal 15
    Dec 26 07:37:34 SnortStartup[61568]: MEM after 0em1 START 62M
    Dec 26 07:37:34 SnortStartup[61563]: Snort HARD Reload For 0em1…
    Dec 26 07:37:34 syslogd: kernel boot file is /boot/kernel/kernel
    Dec 26 07:36:39 SnortStartup[60939]: MEM after 0em1 START 63M
    Dec 26 07:36:39 SnortStartup[60934]: Snort HARD Reload For 0em1…

    Try to start the serves manually and post the error.

    0
  • S

    Is this ok? :)

    Thanks for helping me James

    –== Initializing Snort ==--
    Initializing Output Plugins!       
    Initializing Preprocessors!       
    Initializing Plug-ins!             
    Parsing Rules file /usr/local/etc/snort/snort.conf
    PortVar 'HTTP_PORTS' defined :  [ 80 2301 3128 7777 7779 8000 8008 8028 8080 8180 8888 9999 ]
    PortVar 'SHELLCODE_PORTS' defined :  [ any ]                                               
    PortVar 'ORACLE_PORTS' defined :  [ 1024:65535 ]                                           
    PortVar 'AUTH_PORTS' defined :  [ 113 ]                                                     
    PortVar 'DNS_PORTS' defined :  [ 53 ]                                                       
    PortVar 'FINGER_PORTS' defined :  [ 79 ]                                                   
    PortVar 'FTP_PORTS' defined :  [ 21 ]                                                       
    PortVar 'IMAP_PORTS' defined :  [ 143 ]                                                     
    PortVar 'IRC_PORTS' defined :  [ 6665:6669 7000 ]                                           
    PortVar 'MSSQL_PORTS' defined :  [ 1433 ]                                                   
    PortVar 'NNTP_PORTS' defined :  [ 119 ]                                                     
    PortVar 'POP2_PORTS' defined :  [ 109 ]                                                     
    PortVar 'POP3_PORTS' defined :  [ 110 ]                                                     
    PortVar 'SUNRPC_PORTS' defined :  [ 111 32770:32779 ]                                       
    PortVar 'RLOGIN_PORTS' defined :  [ 513 ]                                                   
    PortVar 'RSH_PORTS' defined :  [ 514 ]                                                     
    PortVar 'SMB_PORTS' defined :  [ 139 445 ]                                                 
    PortVar 'SMTP_PORTS' defined :  [ 25 ]                                                     
    PortVar 'SNMP_PORTS' defined :  [ 161 ]                                                     
    PortVar 'SSH_PORTS' defined :  [ 22 ]                                                       
    PortVar 'TELNET_PORTS' defined :  [ 23 ]                                                   
    PortVar 'MAIL_PORTS' defined :  [ 25 143 465 691 ]                                         
    PortVar 'SSL_PORTS' defined :  [ 25 443 465 636 993 995 ]                                   
    PortVar 'DCERPC_NCACN_IP_TCP' defined :  [ 139 445 ]                                       
    PortVar 'DCERPC_NCADG_IP_UDP' defined :  [ 138 1024:65535 ]                                 
    PortVar 'DCERPC_NCACN_IP_LONG' defined :  [ 135 139 445 593 1024:65535 ]                   
    PortVar 'DCERPC_NCACN_UDP_LONG' defined :  [ 135 1024:65535 ]                               
    PortVar 'DCERPC_NCACN_UDP_SHORT' defined :  [ 135 593 1024:65535 ]                         
    PortVar 'DCERPC_NCACN_TCP' defined :  [ 2103 2105 2107 ]                                   
    PortVar 'DCERPC_BRIGHTSTORE' defined :  [ 6503:6504 ]                                       
    Detection:                                                                                 
      Search-Method = AC-BNFA-Q                                                               
    Frag3 global config:                                                                       
        Max frags: 65536                                                                       
        Fragment memory cap: 4194304 bytes                                                     
    Frag3 engine config:                                                                       
        Target-based policy: WINDOWS                                                           
        Fragment timeout: 180 seconds                                                           
        Fragment min_ttl:  1                                                                   
        Fragment ttl_limit (not used): 5                                                       
        Fragment Problems: 0                                                                   
    Stream5 global config:                                                                     
        Track TCP sessions: ACTIVE                                                             
        Max TCP sessions: 8192                                                                 
        Memcap (for reassembly packet storage): 8388608                                         
        Track UDP sessions: ACTIVE                                                             
        Max UDP sessions: 131072                                                               
        Track ICMP sessions: INACTIVE                                                           
        Log info if session memory consumption exceeds 1048576                                 
    Stream5 TCP Policy config:                                                                 
        Reassembly Policy: WINDOWS                                                             
        Timeout: 30 seconds                                                                     
        Min ttl:  1                                                                             
        Maximum number of bytes to queue per session: 1048576                                   
        Maximum number of segs to queue per session: 2621                                       
        Options:                                                                               
            Static Flushpoint Sizes: YES                                                       
        Reassembly Ports:                                                                       
          21 client (Footprint)                                                                 
          22 client (Footprint)                                                                 
          23 client (Footprint)                                                                 
          25 client (Footprint)                                                                 
          42 client (Footprint)                                                                 
          53 client (Footprint)                                                                 
          79 client (Footprint)                                                                 
          80 client (Footprint)                                                                 
          109 client (Footprint)                                                               
          110 client (Footprint)                                                               
          111 client (Footprint)                                                               
          113 client (Footprint)                                                               
          119 client (Footprint)                                                               
          135 client (Footprint)                                                               
          136 client (Footprint)                                                               
          137 client (Footprint)                                                               
          139 client (Footprint)                                                               
          143 client (Footprint)                                                               
          161 client (Footprint)                                                               
          443 client (Footprint) server (Footprint)                                             
    Stream5 UDP Policy config:                                                                 
        Timeout: 30 seconds                                                                     
        Options:                                                                               
            Ignore Any -> Any Rules: YES                                                       
    HttpInspect Config:
        GLOBAL CONFIG
          Max Pipeline Requests:    0
          Inspection Type:          STATELESS
          Detect Proxy Usage:      NO
          IIS Unicode Map Filename: /usr/local/etc/snort/unicode.map
          IIS Unicode Map Codepage: 1252
        DEFAULT SERVER CONFIG:
          Server profile: All
          Ports: 80 2301 3128 7777 7779 8000 8008 8028 8080 8180 8888 9999
          Server Flow Depth: 1460
          Client Flow Depth: 300
          Max Chunk Length: 500000
          Max Header Field Length: 0
          Max Number Header Fields: 0
          Inspect Pipeline Requests: YES
          URI Discovery Strict Mode: NO
          Allow Proxy Usage: NO
          Disable Alerting: NO
          Oversize Dir Length: 500
          Only inspect URI: NO
          Normalize HTTP Headers: NO
          Normalize HTTP Cookies: NO
          Ascii: YES alert: NO
          Double Decoding: YES alert: NO
          %U Encoding: YES alert: YES
          Bare Byte: YES alert: NO
          Base36: OFF
          UTF 8: YES alert: NO
          IIS Unicode: YES alert: NO
          Multiple Slash: YES alert: NO
          IIS Backslash: YES alert: NO
          Directory Traversal: YES alert: NO
          Web Root Traversal: YES alert: NO
          Apache WhiteSpace: YES alert: NO
          IIS Delimiter: YES alert: NO
          IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
          Non-RFC Compliant Characters: 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07
          Whitespace Characters: 0x09 0x0b 0x0c 0x0d
    rpc_decode arguments:
        Ports to decode RPC on: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779
        alert_fragments: INACTIVE
        alert_large_fragments: ACTIVE
        alert_incomplete: ACTIVE
        alert_multiple_requests: ACTIVE
    ERROR: Unable to open rules file: ../rules/local.rules or /usr/local/etc/snort/../rules/local.rules
    Fatal Error, Quitting..

    0
  • J

    simby

    Sorry, this all my fault.

    There is a bug in snort-dev, rule files are not being copied over after updates.
    Rules are only being copied after interface creation.

    Fix

    Manually copy "cp /usr/local/etc/snort/rules* /usr/local/etc/snort/snort_myinterface/rules

    or

    Delete all your interfaces.
    Update your rules.
    Create your interfaces.

    Merry Christmas
    James

    0
  • S

    Thanks, fixed now. Do i need to do this on every update of snort rules?

    0
  • S

    now i have this problem:

    Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so… ERROR: Failed to load /usr/local/lib/snort_dynamicengine/libsf_engine.so: Cannot open "/usr/local/lib/snort_dynamicengine/libsf_engine.so"
    Fatal Error, Quitting..

    0
  • J

    @simby:

    now i have this problem:

    Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so… ERROR: Failed to load /usr/local/lib/snort_dynamicengine/libsf_engine.so: Cannot open "/usr/local/lib/snort_dynamicengine/libsf_engine.so"
    Fatal Error, Quitting..

    Reinstall the snort-dev package I added code today.

    Fallow my changes at https://rcs.pfsense.org/users/robiscool

    James

    0
  • S

    Thanks!!! & for link :)

    0
  • T

    pfsense 1.2.3-RELEASE
    snort-dev  2.8.4.1_7 pkg v. 1.8

    short Rules tab error:
    please work Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 35 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 36 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 37 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 38 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 39

    cant save/apply enable new rules

    snort to dashboard  gives 404 - Not Found

    0
  • J

    @ToxIcon:

    pfsense 1.2.3-RELEASE
    snort-dev  2.8.4.1_7 pkg v. 1.8

    short Rules tab error:
    please work Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 35 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 36 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 37 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 38 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/snort/snort_rules.php:390) in /usr/local/www/guiconfig.inc on line 39

    cant save/apply enable new rules

    snort to dashboard  gives 404 - Not Found

    Updated code…...
    Am all done with snort_blocked.php and snort_alerts.php.

    snort_rules.php is to slow.

    Im adding code to make it faster.

    James

    0
  • S

    On alerts blocked we have this error:

    Warning: array_unique(): The argument should be an array in /usr/local/www/snort/snort_blocked.php on line 345 Warning: Invalid argument supplied for foreach() in /usr/local/www/snort/snort_blocked.php on line 350 ;)

    0
  • J

    I have just tested and the code works.

    Do you have the latest code ?

    Do you have alerts that are not blocked ?

    James

    0
  • S

    Yes, i have the last code from today,… i will add you later picture.

    0
  • S

    Picture,… can you please fix this log reporting to fix the new theme :)




    0
  • J

    @simby:

    Picture,… can you please fix this log reporting to fix the new theme :)

    Updated code to deal with corrupted alerts file, said error should be fixed now.

    Now Im working on snort_rules.php trying to make it faster.

    James

    0
  • T

    snort-dev 2.8.4.1_7 pkg v. 1.8

    PROTO:255  (portscan) UDP Filtered Portsweep  Prep  x.x.x.x  empty  ->  x.x.x.x  empty  122:23:0  01/03-16:46:06

    what snort rule triggers the alert above

    0
Log in to reply
 

Products

Applications

Support

Services

News

Resources

Company

Our Mission

As host of the pfSense open source firewall project, Netgate believes in enhancing network connectivity that maintains both security and privacy. We also believe everyone should be able to afford it.

Subscribe to our Newsletter

Product information, software announcements, and special offers. See our newsletter archive for past announcements.

© Copyright 2002 - 2019 Rubicon Communications, LLC | Privacy Policy