RE: First run of snort

[hchlai () netscape net (Hugo Chun Hin Lai)]

Did you configure the snort user to have permission to read from your rule path?

Hugo



Jiju Menon <security4rrm () gmail com> wrote:

> 1/14
>
> Hello,
>
> Thank you for the help in locating the snort.conf file. The snort.conf
> file was in the /etc directory of the source code.
>
> This is what I did.....
>
> 1) In the snort.conf file I changed the following parameters for the first run.
>
> var HOME_NET <Internal IP/mask>
>
> var RULE_PATH /root/snortDir/snort-2.3.ORC2/rules
>
> 2) The snort was run as root with the command
>
> snort -c /etc/short/snort.conf
>
> Problem:
>
> ERROR: Unable to open rules file:
> /root/snortDir/snort-2.3.ORC2/rules/local.rules or
> /etc/snort//root/snortDir/snort-2.3.ORC2/rules/local.rules
> Fatal Error, Quitting..
>
> Why is this?
>
> I am also going through some help documents on the snort website. But
> I did not come across this problem.
>
> Thank You.
>
>
> -------------------------------------------------------
> The SF.Net email is sponsored by: Beat the post-holiday blues
> Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
> It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

__________________________________________________________________
Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register

Netscape. Just the Net You Need.

New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp


-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users