IPS not starting

[filippocarletti]

Trying to activate the IPS on a newly installed system, an error is returned and the IPS doesn't protect the network (but the daemon is running).

Steps to reproduce

• Try to enable the IPS (old server manager on port 980)
• Or try to download the rules

Expected behavior

No error, working IPS

Actual behavior

Error: [1] Call to a member function set() on a non-object

The system log (messages) contain:
httpd: [2] Missing argument 2 for NethServer\Module\IPS::readStatus() - File /usr/share/nethesis/NethServer/Module/IPS.php, line 122
and
Error downloading http://talosintelligence.com/feeds/ip-filter.blf: 404 Not Found [ 404 ]

The Download rules button is ineffective.

Also, using the new cockpit server-manager (port 9090) the Download button seems to do some work, but the rules never appear.

[filippocarletti]

On a system where suricata was already configured and working, it keeps working, but a mail is sent every night:

/etc/cron.daily/pulledpork:
Error downloading http://talosintelligence.com/feeds/ip-filter.blf: 404 Not Found [ 404 ]

Talos has changed the download URL for the reputation blacklist.
New URL:
rule_url=https://talosintelligence.com/documents/ip-blacklist|IPBLACKLIST|open

[filippocarletti]

Since we are not using the reputation blacklist, we have two options:

1. disable the list download
2. fix the url

[filippocarletti]

Workaround: change line 24 of /etc/e-smith/templates/etc/pulledpork/pulledpork.conf/10rules

[filippocarletti]

In nethserver-testing: nethserver-pulledpork-2.1.5-1.2.g21204d5.ns7.noarch.rpm
/usr/bin/pulledpork -c /etc/pulledpork/pulledpork.conf -k -g -l should not report errors.

[mamengoni]

tested and verified.

/usr/bin/pulledpork -c /etc/pulledpork/pulledpork.conf -k -g -l not report errors

[nethbot]

in 7.8.2003/updates:

• nethserver-pulledpork-2.1.6-1.ns7.noarch.rpm x86_64 armhfp aarch64