NFQ question

Hello!

I'am trying to run snort 3 as an unprivilieged user snort.Below are my
configurations:

Create the group "snort":
  sudo groupadd snort

Create user "snort" and add the user to group "snort":
 sudo useradd snort -s /bin/bash -g snort

Set a password for user "snort":
 sudo passwd snort

Set ownership and permissions:
  sudo chown -R snort:snort /usr/local/etc/snort
  sudo chown -R snort:snort /var/log/snort
  sudo chmod 400 /usr/local/etc/snort/{snort.lua,snort_defaults.lua}
  sudo chmod -R 5755 /var/log/snort

Add user snort to group netdev:
 sudo usermod -a -G netdev snort
 sudo usermod -a -G sudo snort

I get no errors when attempting to start snort with:

sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua --daq-dir
/usr/local/lib/daq --daq nfq --daq-mode inline -s 65535 -k none -l
/var/log/snort -Q -D --plugin-path /usr/local/etc/snort/extra --tweaks
max_detect -u snort -g snort

Here are the output when attempting to start snort:

nfq DAQ configured to inline.
initializing daemon mode
child process is 5054
Commencing packet processing
++ [0] 1

Then I do "ps aux| grep snort" and no snort process has been started.

Any ideas??

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette