Re: af_packet

TBH I see quite a few reasons why plugins and Zeek should not be installed
like that article describes.

- everything should be packaged. This includes Zeek and all plugins, each
as a separate package. Running zkg to install plugin on production will
result in building code on the server (and we don't even have compilers
there).
- the sudo + pip install means you now have python packages installed for
the entire OS but outside of the OS control and packaging, making
vulnerability management difficult (most likely never detected, forgotten
and left there)
- looks like zeek user can sudo to root. There's no need for that dangerous
capability.
- cap_net_admin is not needed and dangerous
- assigning any capabilities to zeekctl is not needed and also dangerous
- and those 3 affiliation links at the bottom...

On Thu, Nov 21, 2019 at 7:46 AM [email protected] <[email protected]> wrote:

> Any particular reason you don’t want to use the package manager?  It’s
> designed to simplify the process.
>
> I wrote a how-to guide for installation on CentOS 8 that covers using the
> package manager:
> https://www.ericooi.com/zeekurity-zen-part-ii-zeek-package-manager/
>
> On Nov 21, 2019, at 9:25 AM, venkatesh bandari <[email protected]>
> wrote:
>
> Hello Team,
>
> Iam trying to install af_packet and i see we can only install using
> package manager.
>
> could you please help to answer if there is a alternative way  to install
> af_packet
>
> Thanks
> Venkatesh
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>
>
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek