Issues with Snort on 2.0

  • Not sure if this should go here or Packages… I made the jump to 2.0 with my new hardware and i'm able to get snort to install, download rules, and start with not issues.. But once I reboot, snort wont start and I get this in the system log that the user account for snort is unknown.. Any ideas?

    SnortStartup[27957]: Snort HARD Reload For 5687_em1…
    snort[27906]: FATAL ERROR: User "snort" unknown.
    snort[27906]: FATAL ERROR: User "snort" unknown.

  • reload the newest snort and it should be fixed

  • reload as in re-install the package? Was a fix applied since my post from yesterday? Also note, i'm using snapshot from 3-31. I would use the lastest one but need upnp services for some devices.

  • It was fixed in the package yesterday, reinstall Snort.

  • that did the trick!! thank you!! ;D

  • I think I see a bug with the auto blocker in Snort.. Correct me if i'm wrong here. If snort auto blocks an IP because of of a rule trigger, should I still see the IP being blocked in the firewall log?

Log in to reply