similar to: Newbie problems with config file.

Package: logcheck-database Hey, I created a logcheck ignore file for Snort with stuff I don't particularly want to see every day. The one line with the warning in it is questionable, so leave it in or out at your discretion. Also, my regex skills are not as good as they could be, so there are probably mistakes, or things that could be simplified more. Rules are below: ^\w{3} [

I figured that someone reading this list might want to take a look at the proceeding, considering that the version of Snort in FreeBSD ports -is- affected. -----Forwarded Message----- > From: CERT Advisory <cert-advisory@cert.org> > To: cert-advisory@cert.org > Subject: CERT Advisory CA-2003-13 Multiple Vulnerabilities in Snort Preprocessors > Date: 17 Apr 2003 11:30:47 -0400

FYI Kris ----- Forwarded message from Kris Kennaway <kris@FreeBSD.org> ----- X-Original-To: kkenn@localhost Delivered-To: kkenn@localhost.obsecurity.org Delivered-To: kris@freebsd.org Delivered-To: ports-committers@freebsd.org From: Kris Kennaway <kris@FreeBSD.org> Date: Thu, 17 Apr 2003 14:45:03 -0700 (PDT) To: ports-committers@FreeBSD.org, cvs-ports@FreeBSD.org,

I have a dependency loop reported but I can not see how this can be: class monitor { class pulledpork ( $master) { exec { "/home/snort/bin/pulledpork -nc conf/$master/pp.conf": cwd => "/home/snort", subscribe => [File["/home/snort/conf/$master/pp"], File[ "/ home/snort/Rules/$master"] ], notify =>

Hi I am using puppet to mirror a directory of files, if any of these change then processes need to be restarted. class snort { package { ["snort", "perl-Archive-Tar", "barnyard2", "perl-libwww-perl", "perl- Crypt-SSLeay"]: ensure => present; } # package user{ "snort": managehome => true,

Ladies/Gents, /etc/init.d/snortd more snortd #!/bin/sh # Description: start up script for snort # chkconfig: 2345 40 60 # # Source function library. . /etc/rc.d/init.d/functions # case "$1" in # 'start') echo "Starting up Snort..." /prod/snort/bin/snort -c /prod/snort/etc/snort.conf -D -g snort -u snort -i eth0 -l /var/log/snort echo "Done." ;; #

I am working on a Red Hat 7.2 system which has been upgraded to the 2.4.9-13 kernel RPMs. The my machines has RPM e2fsprogs-1.23-2 installed but the upgrade from ext2 to ext3 was done manually rather than accepting the offer in the 7.0 to 7.2 upgrade. I did this by running tunefs2 -j on two partitions. I have had some problems following the instructions in the ext3-usage.html

----- Forwarded message from Louis Kowolowski <louisk@bend.com> ----- Date: Thu, 28 Aug 2003 11:37:42 -0700 From: Louis Kowolowski <louisk@bend.com> To: freebsd-security@freebsd.org Subject: snort, postgres, bridge User-Agent: Mutt/1.5.4i I've been prowling through the FreeBSD and Snort list archives in search of information on setting up snort on a FreeBSD bridge(4) that logs

Hi All, I am adding ip_queue module for snort inline IDS. I am using snort2.4.0 And iptables-1.3.4. Userspace Queuing(queue target) is enabled. It is built-in and not built as a module. The output of /proc/net/ip_queue is shown below: cat /proc/net/ip_queue> Peer PID : 0 Copy mode : 0 Copy range : 0 Queue length : 0 Queue max. length : 1024 IPTABLES 1.3.4 is

I've been prowling through the FreeBSD and Snort list archives in search of information on setting up snort on a FreeBSD bridge(4) that logs to a remote postgres box via a third interface (hme0) Snort is being started with the following command: /usr/local/bin/snort -A full -D -e -d -s -i fxp0 -c /usr /local/etc/snort.conf Where fxp0 and fxp1 are in the bridge output from sysctl:

Hi. I have to use a comercial Windows software in my work, called Cosilab. Last two months I was using Debian and wine 0.9.1 and everything went perfect. The Program works fine under wine and I haven't got any problems. Now I've updated my computer to an AMD64 with 2Ghz Processor and I do not know if the problem with wine is caused by the 64 bits processor or why... I try to run the

I made an atempt to run snort_inline and shorewall on the same system but I could not get snort to see the packets. Maybe someone with a little more iptables knowledge could tell me what I''m doing wrong or if its possible to have the systems setup so that it places packets that the firewall would allow into QUEUE. After setting up and starting shorewall I then issue the following

Hi All, I am facing a problem when using ULOG daemon and SNORT (inline mode) with iptables. My set up is like this. 1. I need ULOG daemon to log firewall logs to MYSQL database. 2. I need SNORT in inline mode for intrusion prevention. Both can work fine induvidually with iptables. But ULOG daemon cannot work when SNORT is also running. Probably the reason is that snort also hooks to

Hi! I just tried to run VirtualDub 1.5.10 with current wine from CVS. The program runs, but when the video playback is started (or even the video file is just loaded), all the screen except the window with the first video frame goes black. The video is played properly. All is alive and well, underlying windows/icons are there and they react on the mouse, windows can be moved (if You find their

Plus I would like to let you know that it works like a charm. Snort can now see those packets. -----Original Message----- From: shorewall-users-bounces@lists.shorewall.net [mailto:shorewall-users-bounces@lists.shorewall.net] On Behalf Of Thibodeau, Jamie L. Sent: Wednesday, March 30, 2005 9:25 AM To: Mailing List for Shorewall Users Subject: RE: [Shorewall-users] Shorewall and an inline

I have two DC's with Samba 4.2.1 (primary DC) and 4.2.3 (secondary DC). I have installed Samba 4 from the source code (configure,make,make install). I'm using rfc 2307. How can I update to Samba 4.6.3 version ? Is the same strucure samba 4.6 version and samba 4.2? Is there any incompatibility? Regards, Márcio Bacci

hello list, i''ve set up shorewall and snort inline on a linux box. it works, but snort only sees traffic from new connections. and this is because shorewall automatically generates rules to accept established and related connections. how can i force shorewall to queue everything, so that snort can scan the hole traffic like in IDS mode. The setup i have now is really simple, just 2 zones

I just installed wine on my RH 7.1 system and I also have windows 2000. Whenever I try and run a program using Wine I get a missing .dll file message however it seems like I do have the dll files in my c:\winnt\system32 directory. For example if I try and run winmx I get: err:module:fixup_imports Module (file) MFC42.DLL needed by C:\Program Files\WinMX\WinMX.exe not found The wine section

Hello all, Flame me if you must but I have a problem, I'm either too thick to work it out or the docs miss something vital to my machine. I have read through the docs and here is my problem.. I have installed wine from Mandrake 7.2 distribution - wine 20000909mdk1, but alas, it won't go. I have built a config file based on how to docs - refer below: [Drive C] "Path" =

Dear all, I''m setting up a new gateway for a small network (under 30 users)Gw will host the following services:shorewalldnsproxy i''m considering installing snort.can i do so on the same exact box ? is there any security risk of doing so ? box would have 4 ISPs and two internal interfaces. Any recommendation about the optimal setup of snort and shorewall (or if you suggest