Re: NFQ question

I understand that you want to run Snort 3 as a daemon, but to get the reason why it’s failing you need to start it without the -D and it will print a DAQ error.
Documentation for new NFQ module<https://github.com/snort3/libdaq/blob/master/modules/nfq/README.nfq.md> vaguely states that it cannot operate in unprivileged mode, so I expect there’s no way to do that at the moment.

Thanks,
Vitalii!

From: Gustaf Florén <[email protected]>
Date: Tuesday, 13 February 2024 at 13:25
To: Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]>
Subject: Re: [Snort-users] NFQ question
Hello. I am  starting snort with :
sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq --daq nfq --daq-mode inline -s 65535 -k none -l /var/log/snort -Q -D --plugin-path /usr/local/etc/snort/extra --tweaks max_detect -u snort -g snort
including the -D option.
Could it be that only snort 2 can run nfq as an unprivilieged user and not snort 3 ??

Den tis 13 feb. 2024 kl 10:35 skrev Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]<mailto:[email protected]>>:
Hi Gustaf!

You can try without the -D option, it will help you check for daq initialization errors if any.
Snort 3 is written in such a way that it is daemonized before the packet threads start running, so if some kind of daq nfq initialization error occurs, you will not see it.

Thanks,
Vitalii!
From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of Gustaf Florén via Snort-users <[email protected]<mailto:[email protected]>>
Date: Monday, 12 February 2024 at 16:15
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] NFQ question
Hello!

I'am trying to run snort 3 as an unprivilieged user snort.Below are my configurations:

Create the group "snort":
  sudo groupadd snort

Create user "snort" and add the user to group "snort":
 sudo useradd snort -s /bin/bash -g snort

Set a password for user "snort":
 sudo passwd snort

Set ownership and permissions:
  sudo chown -R snort:snort /usr/local/etc/snort
  sudo chown -R snort:snort /var/log/snort
  sudo chmod 400 /usr/local/etc/snort/{snort.lua,snort_defaults.lua}
  sudo chmod -R 5755 /var/log/snort

Add user snort to group netdev:
 sudo usermod -a -G netdev snort
 sudo usermod -a -G sudo snort

I get no errors when attempting to start snort with:

sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq --daq nfq --daq-mode inline -s 65535 -k none -l /var/log/snort -Q -D --plugin-path /usr/local/etc/snort/extra --tweaks max_detect -u snort -g snort

Here are the output when attempting to start snort:

nfq DAQ configured to inline.
initializing daemon mode
child process is 5054
Commencing packet processing
++ [0] 1

Then I do "ps aux| grep snort" and no snort process has been started.

Any ideas??

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette