Snort 2.9.2.3 pkg v. 2.5.0 Issues

dwood

Ermal, when enabling sensitive data pre-processor, whitelisted IPs are possibly ignored. I've added an IMAP provider to the whitelist, however this whitelisted IP is being blocked by sensitive data email rule. Adding to suppress list seems to work after restarting interfaces. AMD64, 2.0.1

Cheers,
Dennis.

breusshe

So, to deal with the error I'm getting after the latest reinstall, I dumped my config and uninstalled Snort. I reinstalled, and started to reconfigure. On the "Server" tab in one of the instances I'm configuring, I tried adding some port numbers, which I've done in the past, and got the following message:

The following input errors were detected:

Only aliases are allowed

For instance, I'm trying to set "Define IMAP_PORTS" to the value: 143,993. The field states that "143" is the default and suggests examples "25,443" and "5060:5090". However, the above error message seems to imply I need to use some sort of alias now. Is this a new bug?

judex

That is a new feature!
https://github.com/bsdperimeter/pfsense-packages/commit/92fc14e2e523e2c314868fd861a80d0a25bd7549
Judged by last days commits ermal is unstoppable at the moment ;D

Fesoj

breusshe,

aliases are defined under Firewall: Aliases:

Worked for me when I modified the HOME_NET.

breusshe

@ermal:

Just add yourself the mysql-server package.

Yeah, I've tried that before. The problem is that mysql-server isn't part of the pfsense repository and the release that pfsense 2.0.1 is built from doesn't exist any longer in FreeBSD's repos. So, to get server, I have to upgrade mysql-client, which forces me to update other stuff as well. None of it is from the normal repos for pfsense which causes problems with package upgrades in the future. So, to do this, I'd have to get mysql-server (of the correct version) and its dependencies added to the pfsense repos and installable from the Package Manager.

breusshe

@judex:

That is a new feature!
https://github.com/bsdperimeter/pfsense-packages/commit/92fc14e2e523e2c314868fd861a80d0a25bd7549
Judged by last days commits ermal is unstoppable at the moment ;D

Ah, okay. I'll add aliases there. Thanks, Judex and Fesoj.

breusshe

@breusshe:

Just did the reinstall. I get this error:

FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"

The funny part is I'm not even using bad-traffic.so. Not sure why it is even loading.

Uninstall and wipe of config, then reinstall seems to have fixed this. Not sure what was causing it. But, snort starts up just fine now. Just waiting to see if I can catch alerts.

Fesoj

This is just inquiring on how to do updates in an economical way.

In emergency situations one could always update from github (github.com/bsdperimeter/pfsense-packages).

The regular package updates seem to come from http://files.pfsense.com/packages/8/All/, but it takes some time after updating the repository before the regular package update has the latest version (hours?). Since not every package update is accompanied by a change of the version string, it is rather difficult to see, whether the advertised updates from the forum are going to be installed or not. Currently snort-2.9.2.3-i386.pbi is still from yesterday 2012-Jul-15 21:11:02, so a regular update (System: Packages:) doesn't really update anything. It looks to me that some of the recent messages can be explained by this setup.

It's not about making things faster, but to know when the update will actually be available. I wouldn't mind having a 4 digit version string for the package. Another method would be to base the update on the associated md5 hashes.

Am I here off base, or does this remark that make some sense?

Cino

@breusshe:

@breusshe:

Just did the reinstall. I get this error:

FATAL ERROR: Failed to load /usr/local/lib/snort/dynamicrules/bad-traffic.so: /usr/local/lib/snort/dynamicrules/bad-traffic.so: Undefined symbol "freeRuleData"

The funny part is I'm not even using bad-traffic.so. Not sure why it is even loading.

Uninstall and wipe of config, then reinstall seems to have fixed this. Not sure what was causing it. But, snort starts up just fine now. Just waiting to see if I can catch alerts.

i figured out what is causing this.. ermal submitted a change based on what is left on our system when you uninstall snort https://github.com/bsdperimeter/pfsense-packages/commit/380d7cbe464a271c47fa57d4a890e1d61019fd08 I told him about this morning. These files are linked files to the pbi folders.. You we are doing a reinstall/reinstall gui.. Its removing the linked files.. Because how pbi's behave with the pfsense package manager… I recommend that you uninstall a package then install it when you doing an upgraded.. I recommend this because if you select to re-install the package, some reason or another, the pbi binary isn't re-installed.... Now this is behavior on pfSense 2.1.. 2.0.1, i would do the same thing

Cino

@Fesoj:

This is just inquiring on how to do updates in an economical way.

In emergency situations one could always update from github (github.com/bsdperimeter/pfsense-packages).

The regular package updates seem to come from http://files.pfsense.com/packages/8/All/, but it takes some time after updating the repository before the regular package update has the latest version (hours?). Since not every package update is accompanied by a change of the version string, it is rather difficult to see, whether the advertised updates from the forum are going to be installed or not. Currently snort-2.9.2.3-i386.pbi is still from yesterday 2012-Jul-15 21:11:02, so a regular update (System: Packages:) doesn't really update anything. It looks to me that some of the recent messages can be explained by this setup.

It's not about making things faster, but to know when the update will actually be available. I wouldn't mind having a 4 digit version string for the package. Another method would be to base the update on the associated md5 hashes.

Am I here off base, or does this remark that make some sense?

Whentever changes are made to github.com/bsdperimeter/pfsense-packages, you are able to get them within 5 minutes or less(I think its real-time).. Binaries are a different story… jimp has a builder that builds them base on what changes happen to github.com/bsdperimeter/pfsense-tools... Not sure if its a auto or manual process for them to move the files over to files.pfsense.org

as far as seeing a package update within the package manager. that is up to the maintainer to increase the version number of the package.

pfsense team, correct me if i'm wrong on this

dwood

Same thing here..had to remove 2.5.0. WAN IP x.x.x.0 network was being blocked. PFsense log than alerted on WAN down, and removed it from routing group (dual wan).

Cheers,
Dennis.

mschiek01

Snort was running with preproc active a rules update was processed and snort stopped with the following error.

Jul 16 20:56:27 php: /snort/snort_download_rules.php: Snort has restarted with your new set of rules…
Jul 16 20:56:26 snort[25975]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 16 20:56:26 snort[25975]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 16 20:56:26 snort[25975]: Initializing rule chains…
Jul 16 20:56:26 snort[25975]: Initializing rule chains…
Jul 16 20:56:26 snort[25975]: +++++++++++++++++++++++++++++++++++++++++++++++++++
Jul 16 20:56:26 snort[25975]: +++++++++++++++++++++++++++++++++++++++++++++++++++

joako

Same here.

However mine seems to be caused by an invalid snort.conf. This can not be fixed by hand because it's deleted and regenerated each time snort is run.

snort[55098]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_21199_em0//usr/local/etc/snort/preproc_rules/sensitive-data.rules/": No such file or directory.

include $PREPROC_RULE_PATH/sensitive-data.rules**/**

UPDATE: Cleared it up with package reinstall and of course re-download rules. Working as before.

eri--

@dwood:

Same thing here..had to remove 2.5.0. WAN IP x.x.x.0 network was being blocked. PFsense log than alerted on WAN down, and removed it from routing group (dual wan).

Cheers,
Dennis.

As i put in the other thread.
There is an issue that was solved with blocking not parsing correctly the whitelist.
Just re-install the binary.

digdug3

Sometimes the alerts go wrong and give you a N/A in the blocked tab

Clipboard01.jpg_thumb

Cino

@mschiek01:

Snort was running with preproc active a rules update was processed and snort stopped with the following error.

Jul 16 20:56:27 php: /snort/snort_download_rules.php: Snort has restarted with your new set of rules…
Jul 16 20:56:26 snort[25975]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 16 20:56:26 snort[25975]: FATAL ERROR: /usr/local/etc/snort/preproc_rules/sensitive-data.rules(1) Unknown ClassType: sdf
Jul 16 20:56:26 snort[25975]: Initializing rule chains…
Jul 16 20:56:26 snort[25975]: Initializing rule chains…
Jul 16 20:56:26 snort[25975]: +++++++++++++++++++++++++++++++++++++++++++++++++++
Jul 16 20:56:26 snort[25975]: +++++++++++++++++++++++++++++++++++++++++++++++++++

woke up to the same error this this morning. i looked in the preprocessor.rules file and commented the line and turned off sensitive data..

a google search states its because of sensitive data not being not being turned on… i have it on for testing and have 2 rules suppress. strange.....


alert ( msg: "SDF_COMBO_ALERT"; sid: 1; gid: 139; rev: 1; metadata: rule-type preproc ; classtype:sdf; )

EDIT: manual update (after removing the md5 files), and I dont have the above issue with sensitive data on… going to copy the rules over to my pc and compare them when/if this happens again

Fesoj

I installed the latest version and snort is running fine, but there might be an issue with the perl package that affects other packages.

During the last 2 weeks I removed and installed the snort package only. After one of the latest updates the perl files were gone, but pkg_info still reported about 2 perl packages installed. I noticed the missing files by the failure of other packages (e.g. lightsquid). After forcing a reinstall (pkg_add -f) of the latest perl package everything worked again as expected.

I am not sure whether this odd behavior is due to the snort package, but if you find that some things don't work any more, check for the existence of the perl package (and the system log).

Cino

@Fesoj:

I installed the latest version and snort is running fine, but there might be an issue with the perl package that affects other packages.

During the last 2 weeks I removed and installed the snort package only. After one of the latest updates the perl files were gone, but pkg_info still reported about 2 perl packages installed. I noticed the missing files by the failure of other packages (e.g. lightsquid). After forcing a reinstall (pkg_add -f) of the latest perl package everything worked again as expected.

I am not sure whether this odd behavior is due to the snort package, but if you find that some things don't work any more, check for the existence of the perl package (and the system log).

are you running 2.0.x? If so, here is why(i think anyways) https://github.com/bsdperimeter/pfsense-packages/commit/90a78d1150d6cf90b9fb60c2237d8c12b112c7d0. its been removed from the package.

with 2.1 being pbi packages, its alittle different

Fesoj

Cino,

yes, I am running 2.0.1.

bump version to 2.5.0 and remove perl from build requirments since it…

The extracts from snort.inc don't show what happens to those perl files, but the title seems to point to the villain.

Anyway, pkg_add -f remedies the situation.

breusshe

@Cino:

EDIT: manual update (after removing the md5 files), and I dont have the above issue with sensitive data on… going to copy the rules over to my pc and compare them when/if this happens again

I can confirm this solution. I deleted the MD5 files from /usr/local/etc/snort, turned on sensitive data, ran the rules update manually, and snort started right up. I'll post if thise problem repeats itself in the next day or two.