Snort installation problem
Shaun donovan via Snort-users <[email protected]> Sat, 27 Sep 2025 01:41:44 +0200
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============1392593501942945392==
Content-Type: multipart/alternative;
boundary="------------EoawiCyjPhONlMUj77ca5vhv"
Content-Language: en-GB
This is a multi-part message in MIME format.
--------------EoawiCyjPhONlMUj77ca5vhv
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Hi all.
I am new to snort and am trying to install it on Fedora Core 42 (snort=20
version 3.9.5.0). I followed the installation guide "Snort 3 on Oracle=20
Linux 8" and have got most everything working except two issues. These=20
are that snort cannot find wizard.hexes.client_first or=20
wizard.spells.client_first, nor can it find the configuration for=20
file_id. Here is the output I get when I run snort:
Loading /usr/local/snort/etc/snort/snort.lua:
Loading snort_defaults.lua:
Finished snort_defaults.lua:
Loading file_magic.lua:
Finished file_magic.lua:
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 references
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 classifications
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 alert_fast
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 file_log
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 output
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 rewrite
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 alerts
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 decode
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 host_tracker
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 hosts
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 network
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 packets
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 process
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 search_engine
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 so_proxy
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 appid
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 port_scan
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_ip
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_icmp
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_tcp
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_udp
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_user
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_file
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 arp_spoof
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 back_orifice
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dnp3
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dns
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 http_inspect
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 imap
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 modbus
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 netflow
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 pop
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 rpc_decode
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ssh
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ssl
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_smb
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_tcp
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_udp
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_http_proxy
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_http_server
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 gtp_inspect
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 smtp
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ftp_server
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ftp_client
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ftp_data
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 telnet
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 sip
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 normalizer
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 http2_inspect
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 wizard
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.hexes.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.hexes.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.hexes.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.hexes.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.hexes.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.spells.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.spells.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.spells.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.spells.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.spells.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.spells.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.spells.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.spells.client_first
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
wizard.spells.client_first
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 binder
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 host_cache
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 trace
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 daq
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 active
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ips
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 file_id
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find file_id.file_rule=
s
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find file_id.file_poli=
cy
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find file_id.enable_ty=
pe
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find=20
file_id.enable_signature
Finished /usr/local/snort/etc/snort/snort.lua:
Loading file_id.rules_file:
Finished file_id.rules_file:
Loading ips.rules:
Loading ../../rules/snort.rules:
Finished ../../rules/snort.rules:
Finished ips.rules:
Here is an excerpt of my snort.lua for the file_id configuration:
###########################
-- see file_magic.lua for file id rules
file_id =3D
{
=C2=A0=C2=A0 enable_type =3D true,
=C2=A0=C2=A0 enable_signature =3D true,
=C2=A0=C2=A0 file_rules =3D file_magic,
=C2=A0=C2=A0 file_policy =3D
=C2=A0=C2=A0 {
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 { use =3D { verdict =3D 'log', enable_fil=
e_type =3D true,=20
enable_file_signature =3D true } }
=C2=A0=C2=A0 }
}
###########################
and my understanding of the configuration for wizard is that it simply=20
uses default values:
###########################
wizard =3Ddefault_wizard
###########################
If anybody could push me in the right direction, I would be extremely=20
grateful. Been googling for hours....
Kind Regards.
Shaun
--------------EoawiCyjPhONlMUj77ca5vhv
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html>
<html>
<head>
<meta http-equiv=3D"content-type" content=3D"text/html; charset=3DUTF=
-8">
</head>
<body text=3D"#000000" bgcolor=3D"#FFFFFF">
<p>Hi all.</p>
<p>I am new to snort and am trying to install it on Fedora Core 42
(snort version 3.9.5.0). I followed the installation guide "Snort
3 on Oracle Linux 8" and have got most everything working except
two issues. These are that snort cannot find
wizard.hexes.client_first or wizard.spells.client_first, nor can
it find the configuration for file_id. Here is the output I get
when I run snort:</p>
<p>Loading /usr/local/snort/etc/snort/snort.lua:<br>
Loading snort_defaults.lua:<br>
Finished snort_defaults.lua:<br>
Loading file_magic.lua:<br>
Finished file_magic.lua:<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 references<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 classifications<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 alert_fast<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 file_log<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 output<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 rewrite<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 alerts<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 decode<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 host_tracker<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 hosts<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 network<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 packets<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 process<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 search_engine<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 so_proxy<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 appid<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 port_scan<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_ip<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_icmp<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_tcp<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_udp<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_user<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_file<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 arp_spoof<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 back_orifice<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dnp3<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dns<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 http_inspect<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 imap<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 modbus<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 netflow<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 pop<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 rpc_decode<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ssh<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ssl<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_smb<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_tcp<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_udp<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_http_proxy<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_http_server<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 gtp_inspect<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 smtp<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ftp_server<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ftp_client<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ftp_data<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 telnet<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 sip<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 normalizer<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 http2_inspect<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 wizard<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.hexes.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.hexes.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.hexes.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.hexes.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.hexes.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.spells.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.spells.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.spells.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.spells.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.spells.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.spells.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.spells.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.spells.client_first<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
wizard.spells.client_first<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 binder<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 host_cache<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 trace<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 daq<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 active<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ips<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 file_id<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
file_id.file_rules<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
file_id.file_policy<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
file_id.enable_type<br>
ERROR: /usr/local/snort/etc/snort/snort.lua: can't find
file_id.enable_signature<br>
Finished /usr/local/snort/etc/snort/snort.lua:<br>
Loading file_id.rules_file:<br>
Finished file_id.rules_file:<br>
Loading ips.rules:<br>
Loading ../../rules/snort.rules:<br>
Finished ../../rules/snort.rules:<br>
Finished ips.rules:<br>
</p>
<p>Here is an excerpt of my snort.lua for the file_id configuration:<=
/p>
<p>###########################<br>
<br>
-- see file_magic.lua for file id rules<br>
file_id =3D<br>
{<br>
=C2=A0=C2=A0 enable_type =3D true,<br>
=C2=A0=C2=A0 enable_signature =3D true,<br>
=C2=A0=C2=A0 file_rules =3D file_magic,<br>
=C2=A0=C2=A0 file_policy =3D<br>
=C2=A0=C2=A0 {=C2=A0 =C2=A0<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 { use =3D { verdict =3D 'log', enabl=
e_file_type =3D true,
enable_file_signature =3D true } } <br>
=C2=A0=C2=A0 }=C2=A0 =C2=A0<br>
}<br>
<br>
###########################</p>
<p>and my understanding of the configuration for wizard is that it
simply uses default values:</p>
<p>###########################</p>
<p>
<span style=3D"font-family:monospace"><span
style=3D"color:#000000;background-color:#ffffff;">wizard </span=
>=3D<span
style=3D"color:#000000;background-color:#ffffff;">
default_wizard</span><br>
</span>
</p>
<p>###########################</p>
<p>If anybody could push me in the right direction, I would be
extremely grateful. Been googling for hours....</p>
<p>Kind Regards.</p>
<p>Shaun<br>
</p>
</body>
</html>
--------------EoawiCyjPhONlMUj77ca5vhv--
--===============1392593501942945392==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users
To unsubscribe, send an email to:
[email protected]
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
--===============1392593501942945392==--