Re: SnortCenter can't push to sensor

[twig les <twigles () yahoo com>]

I don't know what's up with your Snortcenter but if
you'd like to see how new/old your ruleset is, simply
cd into the directory where the .rules files are and
type 'ls -l'.  That will show the the date the files
were last updated on.

--- Guy Marcenac <guymarc () ifrance com> wrote:
> Hello,
>
> I run snort 1.9.0 with acid v0.9.6b22 on redhat
> linux 7.3.
> with mysql 3-23-53
> Works fine on my ppp0 DSL connection.
>
> I installed SnortCenter 0.9.4 in order to simplify
> rules management.
> created snortcenter db, set up parameter in
> config.php, activated mysql
> plugin, dowloaded rules, ..
> The snort agent is 0.1.6 and is running.
> While setting rules set, variables,... everything
> seems normal (usual from
> snort user point of view)
> Problem comes when I try to "push" the
> configuration:
> I get a loading screen for more than a while !
> and nothing happens.
> If I nevertheless start the snort daemon, sometimes,
> it can work, but I'm
> not sure of the ruleset it is using.
>
> All my "admin server", where snortcenter is
> installed, runs a https
> connection protected by an apache pwd.
>
> sensor config:
> localhost:2525
> admin/pwd
> ssl no
> interface ppp0
>
>
> miniserv.conf:
>  port=2525
>  bind=
>  root=/opt/snortagent/sensor/cgi
>  host=localhost
>  addtype_cgi=internal/cgi
>  realm=SnortCenter Sensor
>  logfile=/var/log/snort/miniserv.log
>  pidfile=/var/log/snort/miniserv.pid
>  errorlog=/var/log/snort/miniserv.error
>  logtime=168
>  ssl=0
>  env_SENSOR_CONFIG=/etc/snort
>  env_SENSOR_VAR=/var/log/snort
>  atboot=0
>  logout=/etc/snort/logout-flag
>  denyfile=\.pl$
>  log=1
>  blockhost_failures=5
>  blockhost_time=60
>  passdelay=1
>  syslog=1
>  allow=localhost
>  session=0
>  userfile=/etc/snort/sensor.users
>  keyfile=/etc/snort/sensor.pem
>
> --
> guy
-------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or
> unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


=====
-----------------------------------------------------------
If you give a man a fish, he can eat for a day
If you bludgeon him to death, you can eat the fish yourself                       
-----------------------------------------------------------

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus – Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users