Re: Running Snort from User Account

[Joel Esler <jesler () sourcefire com>]

On Mar 4, 2013, at 7:20 AM, Tamara Fisher <tammi888 () gmail com> wrote:

> Hi, 
>
> I am trying to setup my implementation of snort for use by several team members mostly for rule testing. 
>
> I get the following error I get when I attempt to run with user credentials:
>
> ERROR: Can't start DAQ (-1) - socket: Operation not permitted!
> Fatal Error, Quitting..
>
> When I google the errors I get, most of the responses I see to people with my issues say 'run as root' 
>
> Of course everything works fine as root but I woulld like to be able to have my users use snort with their own 
> accounts. Is this not possible? 

How many copies of Snort are you wanting to run?  Wouldn't it be more advantageous to have one copy running as root, 
sniffing the interface, and have your users reviewing the logs?

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_feb

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!