Snort mailing list archives
Re: OpenPcap() error
From: Erek Adams <erek () snort org>
Date: Tue, 18 Mar 2003 14:02:24 -0500 (EST)
On Tue, 18 Mar 2003, Robert Cole wrote:
config set_gid: snort config set_uid: snortThat's what I have and I get the group null error. When I change them to their respective numbers I get an error about not able to look up the user from the id (1000). Commented out and the log rule corrected snort runs. :) But it would still be nice to run snort as a user/group. :)
Ummm... You've got something wrong on your side. I'm testing this and get _no_ errors using those two statements. useradd snort groupadd snort [add those two lines to the very top of snort.conf] snort -T /tmp/snort.conf -l /tmp/ [...snip...] Snort sucessfully loaded all rules and checked all rule chains! Snort exiting Looks like you either don't have them listed in /etc/group and /etc/{passwd,shadow}. If you do, add the space after the colon. What's the output of: grep snort /etc/{group,passwd,shadow}
Also snort doesn't seem to pay attention to the config daemon param. I still have to use -D if I want it to load up that way. Why is that?
Again, it works for me: config daemon Starts Snort in Daemon mode. No problem.... I'd suggest skipping whatever startup script you're using. Start with making Snort work. You may be fighting with a problem with the script instead of a problem with Snort. If you can do a: snort -T -c /path/to/snort.conf It will check it's config. If it's wrong, it will fail. If it's correct, it will just cleanly exit. If that happens.... snort -c /path/to/snort Should make it work. Also, you've never mentioned what version you are using. If it's not 1.9.1 or greater, upgrade to 1.9.1. ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson ------------------------------------------------------- This SF.net email is sponsored by: Does your code think in ink? You could win a Tablet PC. Get a free Tablet PC hat just for playing. What are you waiting for? http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- OpenPcap() error Robert Cole (Mar 17)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Phil Wood (Mar 19)
- Re: OpenPcap() error Robert Cole (Mar 19)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Erek Adams (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)
- Re: OpenPcap() error Alberto Gonzalez (Mar 18)
- Re: OpenPcap() error Robert Cole (Mar 18)