le regole di snort sono abilitate da pullpork ma nello stesso momento vengono saltate?

0

Sto usando pullpork per la gestione delle regole. Ho abilitato le regole da 1: 1000 a 1: 5735 quelle regole sono abilitate ma nello stesso tempo vengono saltate.

Come output ho avuto:

    https://github.com/shirkdog/pulledpork
      _____ ____
     '----,\    )
      '--==\  /    PulledPork v0.7.3 - Making signature updates great again!
       '--==\/
     .-~~~~-.Y|\_  Copyright (C) 2009-2016 JJ Cummings
  @_/        /  66\_  [email protected]
    |    \   \   _(")
     \   /-| ||'--'  Rules give me wings!
      \_\  \_\
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Prepping rules from snortrules-snapshot-2990.tar.gz for work....
        Done!
Prepping rules from community-rules.tar.gz for work....
        Done!
Prepping rules from opensource.tar.gz for work....
        Done!
Prepping rules from emerging.rules.tar.gz for work....
        Done!
Reading rules...
Generating Stub Rules....
        An error occurred: ERROR: /etc/nsm/dataprotect-virtualbox-eth0/snort.conf(308) Perfmonitor: Unable to change mode of base stats file "/nsm/sensor_data/dataprotect-virtualbox-eth1/snort.stats" to mode:438: Operation not permitted.
        An error occurred: Fatal Error, Quitting..
        Done
Reading rules...
Reading rules...
Modifying Sids....
        Done!
Processing /etc/nsm/pulledpork/enablesid.conf....
        Modified 2090 rules
        Skipped 2090 rules (already disabled)
        Done
Processing /etc/nsm/pulledpork/dropsid.conf....
        Modified 0 rules
        Skipped 0 rules (already disabled)
        Done
Processing /etc/nsm/pulledpork/disablesid.conf....
        Modified 0 rules
        Skipped 0 rules (already disabled)
        Done
Setting Flowbit State....
        Enabled 128 flowbits
        Done
Writing /etc/nsm/rules/snort.rules....
        Done
Generating sid-msg.map....
        Done
Writing v1 /etc/nsm/sid-msg.map....
        Done
Writing /var/log/nsm/sid_changes.log....
        Done
Rule Stats...
        New:-------0
        Deleted:---27
        Enabled Rules:----33517
        Dropped Rules:----0
        Disabled Rules:---26243
        Total Rules:------59760
No IP Blacklist Changes
Done
Please review /var/log/nsm/sid_changes.log for additional details
Fly Piggy Fly!
Restarting Barnyard2.

Il disablesid.conf è vuoto

    
posta frank 19.07.2018 - 19:06
fonte

0 risposte

Leggi altre domande sui tag