On Wed, 5 Aug 2009 14:28:49 +0530 RAMAKISHOREBABU KOPPULA <rkbabu.koppula@xxxxxxxxx> wrote: > While system is booting I getting the following message" > > starting: snort [FAILED] > > What is this and how to rectify it? These are notes I made to myself when I saw the same thing, and researched the answer. Cryptic, but they should give you enough direction to get snort working. If the licensing allows, this might be a great thing to put in rpmfusion-free or rpmfusion-nonfree. It probably doesn't. In order to set up snort to monitor the system network traffic, it is necessary to install the snort package. But this is not enough, because the rules that snort uses are not packaged due to licensing issues. It is necessary to go to http://www.snort.org, sign up, log in, and download the latest snort_rules package. There are free(older) and pay(current) versions. Create a directory named snort_rules and put the package in that directory as it does not create its own directory. Unpack it using tar -zxvf and move the rules/*.rules files to /etc/snort/rules/. Cp the so_rules/precompiled/FC-9/x86_64/2.8.3.2/*.so to /usr/local/lib64/snort_dynamicrule/. The instructions to create the stubs and tell snort about them are in the README in the so_rules/src directory. They work. Because the package is already installed, only the dynamic detection directory has to be changed in /etc/snort/snort.conf to the /usr/local/lib64/snort_dynamicrule location. Everything else uses the main hierarchy. So the stub dump command becomes snort -c /etc/snort/snort.conf --dump-dynamic-rules=/etc/snort/so_rules Note that snort will not create these directories and will fail if they don't already exist. -- fedora-list mailing list fedora-list@xxxxxxxxxx To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
