Autosnort-Ubuntu/AVATAR project comes with problem config file

[nswalters]

Lines 325 and 326:

decompress_swf { deflate lzma } \
decompress_pdf { deflate }

These lines introduce an error: "ERROR: /opt/snort/etc/snort.conf(326) => Invalid keyword '}' for server configuration."

By commenting out those lines and adjusting line 324 (removing the trailing '' from the line), snort is able to run successfully.

For more information: seclists.org/snort/2016/q4/76

[da667]

Thanks for reporting this issue. I'll do some testing to see if they fixed it on snort.org. Currently this is the only way I pull the snort.conf file because the snort.conf file from the snort.org website is supposed to be the example template for whatever the current version is. More or less its /supposed/ to be good practice to use that copy as your baseline.

…

On Tue, Dec 20, 2016 at 7:06 PM, nswalters ***@***.***> wrote: Lines 325 and 326: decompress_swf { deflate lzma } \ decompress_pdf { deflate } These lines introduce an error: "ERROR: /opt/snort/etc/snort.conf(326) => Invalid keyword '}' for server configuration." By commenting out those lines and adjusting line 324 (removing the trailing '' from the line), snort is able to run successfully. For more information: seclists.org/snort/2016/q4/76 — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#47>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACFvf0ofdHS84ccgK9snAUSpy1eIz7oHks5rKG2SgaJpZM4LSb53> .

-- when does reality end? when does fantasy begin?