-
Notifications
You must be signed in to change notification settings - Fork 38
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
NFQ DAQ and unprivileged operation #11
Comments
Did you get any luck in running libdaq in reduced privileges? As far as I have tries all kind of setup scenarios, it does not work for me. The only setup that works for me is to run snort3 in such configuration: To disable promiscuity and disable GRO/LRO
Snort NIPS service file
Snippet of snort3 configuration file
IPTABLES rule
Apparmor profile for snor3
It works like this in IPS mode, and successfully drops offending packes, but I am not sure if this is a secure option to run snort3 as root. Anyone, comments are more than welcome. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I am trying to migrate Snort from 2.9.17 to 3.1.0.0
I run snort in inline mode with NFQ DAQ.
Till snort 2.9.17 snort used to work fine. But now that I am trying to run snort 3.1.0 it gives this error:
Looking at the NFQ module code I see that README file mentions this:
I think this comment indeed needs a re-validation based on how it worked in snort 2.9.17 (atleast for me)?
There can be two things why it worked in snort 2.9.17
I do not know about DAQ, NFQ and internals. But I do request a review on setting DAQ NFQ module as DAQ_TYPE_NO_UNPRIV
I use Arch Linux and I run snort 3 using this:
snort -Q -u snort -g snort -c /etc/snort/snort.lua -l /var/log/snort --tweaks local
The text was updated successfully, but these errors were encountered: