dobry den!
ako topic vravi, starosti mi robi daemon Snort-a ktory nestartuje :
# /etc/rc.d/snort start
:: Starting Intrusion Database System: SNORT [FAIL]
otazkou je preco?
dmesg neazaznamena po takomto neuspesnom starte ziadnu chybu.
Snort sa ale spusti prikazom "snort"...
dalej by som sa chcel opytat: lebo aj ked sa snort prikazom "snort" spusti, mal by precitat dodatocnu konfiguraciu v /etc/conf.d/snort kde sa nachadza okrem ineho aj nastavenie interface-u na ktorom pocuva. Ked tu int. zmenim snort na tuto zmenu nereaguje. Reaguje vsak ak interface explicitne ucrim pomocou '-i eth1'
preco teda necita tento subor?
dakujem za odpovede!
Snort daemon nestartuje
Pre pridávanie komentárov sa musíte prihlásiť.
v logoch je iba vystupny subor pre alerty...
/var/log/messages.log je prazdny.. uplne :o
dmesg nespravi nic nove ked snort zlyha
/var/log/messages.log je prazdny.. uplne :o
dmesg nespravi nic nove ked snort zlyha
aku mas vlastne linuxovu distribuciu ?
v profile mam velmi jasno napisane 'archlinux'
samozrejme ze viem zo je to startovaci skript. Pisal si ze ti nejde spustit snort tymto skriptom a chyba sa nikde nezaloguje. Tak som si myslel ze dobry startovaci bod by sa bolo pozriet na tento skript. V centose mam v tomto skripte zadefinovany aj subor do ktoreho sa loguje aj konfiguracny subor, ktory sa bude pouzivat
# cat /etc/rc.d/snort
#!/bin/bash
. /etc/rc.conf
. /etc/rc.d/functions
# source application-specific settings
[ -f /etc/conf.d/snort ] && . /etc/conf.d/snort
PID=`pidof -o %PPID /usr/bin/snort`
case "$1" in
start)
stat_busy "Starting Intrusion Database System: SNORT"
[ -z "$PID" ] && /usr/bin/snort ${SNORT_OPTIONS} -u ${USER} -g ${GROUP} \
-i ${INTERFACE} -c ${SNORT_CONF}
if [ $? -gt 0 ]; then
stat_fail
else
add_daemon snort
stat_done
fi
;;
stop)
stat_busy "Stopping Intrusion Database System: SNORT"
[ ! -z "$PID" ] && kill $PID &> /dev/null
if [ $? -gt 0 ]; then
stat_fail
else
rm_daemon snort
stat_done
fi
;;
restart)
$0 stop
sleep 1
$0 start
;;
*)
echo "usage: $0 {start|stop|restart}"
esac
exit 0
:) :)
/usr/bin/snort ${SNORT_OPTIONS} -u ${USER} -g ${GROUP} \-i ${INTERFACE} -c ${SNORT_CONF}
skus /etc/conf.d/snort -c /etc/conf.d/snort
otazka je preco to nerobi sam ked je to specifikovane v konfiguraku a on o no vie(dufam)
# source application-specific settings[ -f /etc/conf.d/snort ] && . /etc/conf.d/snort
snort o nom nevie, a hlavne mu nerozumie. Meno a cestu k skutocnemu konfiguraku by si sa mal dozvediet z
SNORT_CONF=v /etc/conf.d/snort. Ci o nom snort bude default vediet, alebo ho budes musiet nan upozornit prepinacom -c neviem, rovnako ako ci je mozne interface specifikovat len z prikazoveho riadku prepinacom -i alebo aj v snortovom konfiguracnom subore.# cat /etc/conf.d/snort
#
# Parameters to be passed to snort
#
# options taken from Fedora
# http://cvs.fedoraproject.org/viewcvs/devel/snort/sysconfig.snort?rev=1.2&view=markup
# Where is the snort.conf file.
SNORT_CONF="/etc/snort/snort.conf"
# What user account should we run under.
USER="snort"
# What group account should we run under.
GROUP="snort"
# define the interface we listen on
INTERFACE="eth1"
# If you are using prelude, delete the '-A fast' option
SNORT_OPTIONS="-A full -b -l /var/log/snort -D -p"
do /var/log/snort loguje, ale alerty, nie chyby programu...
SNORT_CONF="/etc/snort/snort.conf" je defaultne, a nastavene podla mojich potrieb.
/usr/bin/snort -A full -b -l /var/log/snort -p -u snort -g snort -i eth1 -c /etc/snort/snort.confnahodou nenapise nieco uzitocne? Je to jednoducha substitucia podla
/usr/bin/snort ${SNORT_OPTIONS} -u ${USER} -g ${GROUP} -i ${INTERFACE} -c ${SNORT_CONF}a parametrov z /etc/conf.d/snort, -D je vynechane zamerne./usr/bin/snort -A full -b -l /var/log/snort -p -u snort -g snort -i eth1 -c /etc/snort/snort.conf
Running in IDS mode
--== Initializing Snort ==--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file "/etc/snort/snort.conf"
ERROR: Unable to open rules file "/etc/snort/snort.conf": No such file or directory.
Fatal Error, Quitting..
ERROR: parser.c(5244) Could not stat dynamic module path "/usr/lib/snort_dynamicrules": No such file or directory.Fatal Error, Quitting..