Re: MacOSX bus error, snort-2.8.3.1 install (James Lay)

[Todd Wease <twease () sourcefire com>]

Hi John,

Try altering your script to not use sudo for configure and make.  I
don't believe the environment variables TWO_LEVEL_NAMESPACE and
MACOSX_DEPLOYMENT_TARGET will be exported to the sudo environment. 
Untar Snort into your users directory and do this instead of copying it
to /usr/local/src.  I don't believe it's necessary to rerun the
autotools unless you have a really old Mac OS (they weren't running in
your script anyway).  The making of the .so symbolic links aren't
necessary and the glibtool command shouldn't be necessary.  Try the
attached script.  Also there seem to be a few errors in your
snort.conf.  Try changing:

preprocessor file
/usr/local/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.dylib
to
dynamicpreprocessor file
/usr/local/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.dylib

and

dynamicengine
/usr/local/snort-2.8.3.1/lib/snort_dynamicengine/libsf_engine.dylib
to
dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.dylib

Let us know how it goes.

Thanks,
Todd


John Kraus wrote:
> Mr. Lay,
>
> Thanks very much for your suggestion.  As my attached installation
> output and script seem to indicate, I think I have correctly set the
> environmental variables, LD_TWOLEVEL_NAMESPACE=1 and
> MACOSX_DEPLOYMENT_TARGET=10.5.  (I have updated the zip file from my
> previous post, by the way.)  Nevertheless, the bus error persists.
>
> Here is a summary of warnings that show up in my installation output:
>
> spo_unified2.c:242: warning: 'write_pkt_buffer_mpls' defined but not used
>
> ranlib: warning for library: libintsnort.a the table of contents is
> empty (no object file members in the library define global symbols)
>
> ranlib: warning for library: libtarget_based.a the table of contents
> is empty (no object file members in the library define global symbols)
>
> Plus NUMEROUS instances of:
>
> libtool: install: warning: remember to run `libtool --finish
> /usr/local/lib/snort_dynamicpreprocessor'
>
> To reiterate, for those who missed my previous post, I am encountering
> a bus error in my effort to install Snort 2.8.3.1 on a Mac.  For
> further details, please see my zipped and attached installation
> script, output and snort.conf files.  I have tried suggestions from
> prior posts to this list on this subject to no avail.  Thanks in
> advance for any suggestions.
>
> John Kraus
>
>       1. Re: MacOSX bus error, snort-2.8.3.1 install (James Lay)
>     Message: 1
>     Date: Tue, 30 Dec 2008 06:50:17 -0700
>     From: James Lay <jlay () slave-tothe-box net
>     <mailto:jlay () slave-tothe-box net>>
>     Subject: Re: [Snort-users] MacOSX bus error, snort-2.8.3.1 install
>     To: Snort <snort-users () lists sourceforge net
>     <mailto:snort-users () lists sourceforge net>>
>     Message-ID: <C57F7529.3C7C2%jlay () slave-tothe-box net
>     <mailto:C57F7529.3C7C2%25jlay () slave-tothe-box net>>
>     Content-Type: text/plain; charset="us-ascii"
>
>
>     On 12/29/08 8:03 PM, "John Kraus" <johnkraus3 () gmail com
>     <mailto:johnkraus3 () gmail com>> wrote:
>
>     > I keep getting a bus error on my MacOSX after installing
>     Snort-2.8.3.1 and
>     > running in IDS mode, despite having followed, as best I can, the
>     installation
>     > instructions, previous posts to this list, and other advice
>     pertaining to this
>     > problem.
>     >
>     > <snip>
>     >
>     > Loading dynamic engine
>     > /usr/local/lib/snort_dynamicengine/libsf_engine.dylib... done
>     > Loading dynamic preprocessor library
>     >
>     /usr/local/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.dylib...
>     done
>     > Loading dynamic preprocessor library
>     >
>     /usr/local/lib/snort_dynamicpreprocessor/libsf_dns_preproc.dylib...
>     done
>     > Loading dynamic preprocessor library
>     >
>     /usr/local/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.dylib...
>     done
>     > Loading dynamic preprocessor library
>     >
>     /usr/local/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.dylib...
>     done
>     > Loading dynamic preprocessor library
>     >
>     /usr/local/lib/snort_dynamicpreprocessor/libsf_ssh_preproc.dylib...
>     done
>     > Bus error
>     >
>     > I would be grateful for any suggestions on solving the bus error
>     problem.
>     > Thanks,
>     >
>
>
>     Did you do:
>
>     export LD_TWOLEVEL_NAMESPACE=1
>     export MACOSX_DEPLOYMENT_TARGET=10.5
>
>
>     Before configuring?  I had the same issue and this fixed that.
>
>     James
>     -------------- next part --------------
>     An HTML attachment was scrubbed...
>
>
> ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------------
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

#!/bin/sh
echo 'bash install script for snort-2.8.3.1 on'
echo 'MAC OS X Version 10.5.6, 2.4 GHZ INTEL CORE 2 DUO, 4 GB 667 MHz DDR SDRAM'
echo 'by John Kraus, January 4, 2009' 
echo '~/myinstallscript'
echo
echo 'Todays Date'
echo 'date'
date
echo 'uname -a'
uname -a
echo
echo 'Confirm gcc installed, version'
echo 'gcc'
gcc
echo
echo 'rm -fr snort-2.8.3.1'
rm -fr snort-2.8.3.1
echo 'tar xzf snort-2.8.3.1.tar.gz'
tar xzf snort-2.8.3.1.tar.gz
echo 'Set,show environmental variables'
echo 'export LD_TWOLEVEL_NAMESPACE=1'
export LD_TWOLEVEL_NAMESPACE=1
echo 'export MACOSX_DEPLOYMENT_TARGET=10.5'
export MACOSX_DEPLOYMENT_TARGET=10.5
echo 'env'
env
pushd snort-2.8.3.1 > /dev/null 2>&1
echo ./configure --enable-dynamicplugin
./configure --enable-dynamicplugin
echo make
make
echo sudo make install
sudo make install
popd > /dev/null 2>&1
echo 'snort -V'
snort -V
echo
echo 'snort -c /usr/local/share/rules/snort.conf -T'
echo
snort -c /usr/local/share/rules/snort.conf -T

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users