snort.conf resetting itself?

Posted on 2006-03-24
Last Modified: 2010-04-20
I just upgraded my SLES9 box to SP2. In doing so, snort (which is one of the main uses of this machine) was upgraded to version 2.3.2 - Although I wasn't happy that I had to rewrite the .conf file to suit the needs of the newer version, I figured I'd go ahead and just do it.

Now, every night at 4am, snort dies - and when I check it out in the morning, I find that the following line in snort.conf has been altered:

var HOME_NET [list of my custom home nets, not as simple as just one subnet]

var HOME_NET $eth0_Address

This is what causes snort to die - since $eth0 does not resolve, and I use eth1 as my sniffer port anyway.

Of course with it dying at 4am, It's easy to assume that it's something in cron.daily that is causing this to happen -

so, I grepped every file in /etc/cron.daily for "snort.conf" or just "snort" and nothing was found. I have not modified anything in the cron.daily and everything is "stock" as provided by SLES.

I even tried setting the permissions on snort.conf so that even root does not have accesss to write to it - Yet this still occurs, and in the morning, I find the datestamp to be set to todays date, and the permissions back to rw-r----

Any thoughts?

Question by:Heem14
    LVL 8

    Expert Comment

    strange... there shouldn't be anything in cron that edits .conf files but what you can try to do is change the file attributes, as opposed to just it's permissions.

    chattr +iu snort.conf

    this will make the file immutable (unchangable even to the root account) and undeletable, again even to the root account.  The only way to regain access is to chattr -iu snort.conf

    you can view file attributes with the command
    LVL 12

    Author Comment

    ok. I've done this. Monday morning I'll know if this worked - and hopefully what ever was causing it to change will now throw an error due to the immutable status of the file.
    LVL 12

    Author Comment

    Sigh, Making it immutable had no effect. The file was still changed this morning, and snort dead.

    LVL 8

    Accepted Solution

    are you sure that $eth0 is causing the crash?  I started looking around and it seems that cron.daily has a script 5snort that emails notifications to you.  Some people have said that this tries to restart snort and crashes...  Is there a restart line in 5snort?  Maybe you could try moving that script out of cron.daily for a test?
    LVL 12

    Author Comment

    I have actually found the problem.

    It was in logrotate.d - and you are correct in that it tries to restart snort - and that is the cause of the crash - but, the reason it refuses to restart is due to the $eth0 change. I have since commented out this part of logrotate, and all is working well.

    Thanks for you help.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    6 Surprising Benefits of Threat Intelligence

    All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

    Suggested Solutions

    If you have a server on collocation with the super-fast CPU, that doesn't mean that you get it running at full power. Here is a preamble. When doing inventory of Linux servers, that I'm administering, I've found that some of them are running on l…
    Setting up Secure Ubuntu server on VMware 1.      Insert the Ubuntu Server distribution CD or attach the ISO of the CD which is in the “Datastore”. Note that it is important to install the x64 edition on servers, not the X86 editions. 2.      Power on th…
    Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
    Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now