Re: Updating snort rules via pulledpork, failing

[Philip Robson via Snort-users <snort-users () lists snort org>]

Is this a fresh install?

If so I've found I needed to create a new snort key and add it to the conf
then run the rule update again.

On Fri, 18 May 2018, 17:16 bobby via Snort-users, <
snort-users () lists snort org> wrote:

> I am trying to update my snort rules via pulled pork. I noticed that the
> rules have not been updated for a while.  Here is the output from running
> the command:
>
> sudo /usr/local/bin/pulledpork.pl -c /etc/snort/pulledpork.conf -l
>
>     https://github.com/shirkdog/pulledpork
>       _____ ____
>      `----,\    )
>       `--==\\  /    PulledPork v0.7.4 - Helping you protect your bitcoin
> wallet!
>        `--==\\/
>      .-~~~~-.Y|\\_  Copyright (C) 2009-2017 JJ Cummings, Michael Shirk
>   @_/        /  66\_  and the PulledPork Team!
>     |    \   \   _(")
>      \   /-| ||'--'  Rules give me wings!
>       \_\  \_\\
>  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> Checking latest MD5 for snortrules-snapshot-29111.tar.gz....
>         They Match
>         Done!
> Checking latest MD5 for community-rules.tar.gz....
>         They Match
>         Done!
> IP Blacklist download of
> https://talosintelligence.com/documents/ip-blacklist....
> Reading IP List...
> Checking latest MD5 for opensource.gz....
>         They Match
>         Done!
> Checking latest MD5 for emerging.rules.tar.gz....
>         They Match
>         Done!
> Writing Blacklist File /etc/snort/rules/iplists/black_list.rules....
> Writing Blacklist Version 1633955891 to
> /etc/snort/rules/iplistsIPRVersion.dat....
> Writing /var/log/sid_changes.log....
>         Done
>
> No Rule Changes
>
> IP Blacklist Stats...
>         Total IPs:-----1629
>
> Done
> Please review /var/log/sid_changes.log for additional details
> Fly Piggy Fly!
>
> I don't see any errors.  What could be going on that they are not being
> updated?
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists snort org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
> Please follow these rules:
> https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette