Re: NFQ question

It depends on what you use it for and how much you trust your router’s security.

One interesting way to limit potential unwanted access is to provide Snort 3 with capabilities that it needs and still run it from your default user.
As far as I know, netfilter_queue requires CAP_NET_RAW and CAP_NET_ADMIN, so you can do:


sudo setcap CAP_NET_RAW,CAP_NET_ADMIN+ep <SNORT3_BINARY_PATH>

and it should work fine without many potential risks. You can check more on capabilities here: capabilities(7) - Linux manual page (man7.org)<https://man7.org/linux/man-pages/man7/capabilities.7.html>.

NOTE: it may require working around some library path related errors, you can check fix here: shared libraries - Linux capabilities (setcap) seems to disable LD_LIBRARY_PATH - Stack Overflow<https://stackoverflow.com/questions/9843178/linux-capabilities-setcap-seems-to-disable-ld-library-path>

Thanks,
Vitalii!

From: Gustaf Florén <[email protected]>
Date: Wednesday, 14 February 2024 at 23:58
To: Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]>
Subject: Re: [Snort-users] NFQ question
Ok , yes I get the error "can not drop privilieges - daq module can not support unprivilieged mode operation". So it seems that currently it's not possible to run snort 3 with nfq as an unprivilieged user.
Is it a big security risk running snort as an IPS on a router as root?

/Gustaf

Den ons 14 feb. 2024 kl 09:13 skrev Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]<mailto:[email protected]>>:
I understand that you want to run Snort 3 as a daemon, but to get the reason why it’s failing you need to start it without the -D and it will print a DAQ error.
Documentation for new NFQ module<https://github.com/snort3/libdaq/blob/master/modules/nfq/README.nfq.md> vaguely states that it cannot operate in unprivileged mode, so I expect there’s no way to do that at the moment.

Thanks,
Vitalii!

From: Gustaf Florén <[email protected]<mailto:[email protected]>>
Date: Tuesday, 13 February 2024 at 13:25
To: Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]<mailto:[email protected]>>
Subject: Re: [Snort-users] NFQ question
Hello. I am  starting snort with :
sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq --daq nfq --daq-mode inline -s 65535 -k none -l /var/log/snort -Q -D --plugin-path /usr/local/etc/snort/extra --tweaks max_detect -u snort -g snort
including the -D option.
Could it be that only snort 2 can run nfq as an unprivilieged user and not snort 3 ??

Den tis 13 feb. 2024 kl 10:35 skrev Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]<mailto:[email protected]>>:
Hi Gustaf!

You can try without the -D option, it will help you check for daq initialization errors if any.
Snort 3 is written in such a way that it is daemonized before the packet threads start running, so if some kind of daq nfq initialization error occurs, you will not see it.

Thanks,
Vitalii!
From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of Gustaf Florén via Snort-users <[email protected]<mailto:[email protected]>>
Date: Monday, 12 February 2024 at 16:15
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] NFQ question
Hello!

I'am trying to run snort 3 as an unprivilieged user snort.Below are my configurations:

Create the group "snort":
  sudo groupadd snort

Create user "snort" and add the user to group "snort":
 sudo useradd snort -s /bin/bash -g snort

Set a password for user "snort":
 sudo passwd snort

Set ownership and permissions:
  sudo chown -R snort:snort /usr/local/etc/snort
  sudo chown -R snort:snort /var/log/snort
  sudo chmod 400 /usr/local/etc/snort/{snort.lua,snort_defaults.lua}
  sudo chmod -R 5755 /var/log/snort

Add user snort to group netdev:
 sudo usermod -a -G netdev snort
 sudo usermod -a -G sudo snort

I get no errors when attempting to start snort with:

sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq --daq nfq --daq-mode inline -s 65535 -k none -l /var/log/snort -Q -D --plugin-path /usr/local/etc/snort/extra --tweaks max_detect -u snort -g snort

Here are the output when attempting to start snort:

nfq DAQ configured to inline.
initializing daemon mode
child process is 5054
Commencing packet processing
++ [0] 1

Then I do "ps aux| grep snort" and no snort process has been started.

Any ideas??

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette