What does the script do without snort rules ? about autosnort HOT 2 CLOSED

Hello there!

Sorry for the delay in response, I've been enjoying labor day stateside, so
I hope you can forgive the delay.

If you skip the step regarding the rules snapshot, this is what will happen:

snort will run, if you specifiy /usr/local/snort/bin/snort -i [interface]
with no problems. however, since there are no rules in the directory paths
specified and the SO rules and libraries don't exist, if you try to run
snort in daemon mode, it will say "hey, the SO rules and shared object libs
I need to run aren't there and simply crash.

you have two options to fix this:

1. download the 2.9.3.0 rule snapshot and re-run the script, this time
   telling it where the rule snapshot is. Should resolve any issues you run
   into snort refusing to run.

2. download the rule snapshot, untar it, copy the snort rules and dynamic
   (i.e. the SO rules) rules to the directories snort is looking for them in,
   specified in snort.conf

If you want my opinion, option 1 will be faster, even including the
uninstall and re-compile time it will take to re-do the script. If you want
to do step 2 and are unsure how/where to copy the snort rules tarball and
the rules contained in it, refer to www.snort.org, go to the docs section
and download the snort 2.9.3 on Ubuntu 10.04 install guide and look for the
section where the author untars the snort rules file. I forget the exact
command he uses off the top of my head and since I have no easy access to
this document, I must refer you to snort.org's documents instead.

I hope this helps, please feel free to ask more questions as you have them!

-DA_667

On Wed, Aug 29, 2012 at 9:17 PM, b.long [email protected] wrote:

I unintentionally skipped step #4https://github.com/da667/Autosnort/issues/4"Which directory you put your snort rules snapshot from
snort.org" . I hit enter twice (really, I was feeling a bit like bug
testing the script I think) and the script kept on running. Does it mean
snort will be running without rules at the end ?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/7.

when does reality end? when does fantasy begin?

from autosnort.

While I commented on this some time ago, I finally added an official entry to the README that explains what happens and how this can be remediated.

from autosnort.