Re: OpenPcap() error

[Erek Adams <erek () snort org>]

On Tue, 18 Mar 2003, Robert Cole wrote:

> >     config set_gid: snort
> >     config set_uid: snort
>
> That's what I have and I get the group null error. When I change them to their
> respective numbers I get an error about not able to look up the user from the
> id (1000).
>
> Commented out and the log rule corrected snort runs. :) But it would still be
> nice to run snort as a user/group. :)

Ummm...  You've got something wrong on your side.  I'm testing this and
get _no_ errors using those two statements.

        useradd snort
        groupadd snort
[add those two lines to the very top of snort.conf]
        snort -T /tmp/snort.conf -l /tmp/
[...snip...]
        Snort sucessfully loaded all rules and checked all rule chains!
        Snort exiting

Looks like you either don't have them listed in /etc/group and
/etc/{passwd,shadow}.  If you do, add the space after the colon.  What's
the output of:

        grep snort /etc/{group,passwd,shadow}

> Also snort doesn't seem to pay attention to the config daemon param. I still
> have to use -D if I want it to load up that way. Why is that?

Again, it works for me:

        config daemon

Starts Snort in Daemon mode.  No problem....

I'd suggest skipping whatever startup script you're using.  Start with
making Snort work.  You may be fighting with a problem with the script
instead of a problem with Snort.

If you can do a:

        snort -T -c /path/to/snort.conf

It will check it's config.  If it's wrong, it will fail.  If it's correct,
it will just cleanly exit.  If that happens....

        snort -c /path/to/snort

Should make it work.

Also, you've never mentioned what version you are using.  If it's not
1.9.1 or greater, upgrade to 1.9.1.

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.net email is sponsored by: Does your code think in ink? 
You could win a Tablet PC. Get a free Tablet PC hat just for playing. 
What are you waiting for?
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users