Re: Snort installation problem
Germaine ornella Mabong via Snort-users <[email protected]> Mon, 29 Sep 2025 16:04:07 +0100
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <CAH7SQA85QiomKyjvhgK=2vkG977Vd+-+MrSCnezm_Ab1nCnM_Q@mail.gmail.com> |
--===============3075711497313357295== Content-Type: multipart/alternative; boundary="0000000000001d762d063ff1f3b4" --0000000000001d762d063ff1f3b4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable D'accord Le lun. 29 sept. 2025, 16:02, Shaun donovan via Snort-users < [email protected]> a =C3=A9crit : > Hi all. > > I am new to snort and am trying to install it on Fedora Core 42 (snort > version 3.9.5.0). I followed the installation guide "Snort 3 on Oracle > Linux 8" and have got most everything working except two issues. These ar= e > that snort cannot find wizard.hexes.client_first or > wizard.spells.client_first, nor can it find the configuration for file_id= . > Here is the output I get when I run snort: > > Loading /usr/local/snort/etc/snort/snort.lua: > Loading snort_defaults.lua: > Finished snort_defaults.lua: > Loading file_magic.lua: > Finished file_magic.lua: > references > classifications > alert_fast > file_log > output > rewrite > alerts > decode > host_tracker > hosts > network > packets > process > search_engine > so_proxy > appid > port_scan > stream > stream_ip > stream_icmp > stream_tcp > stream_udp > stream_user > stream_file > arp_spoof > back_orifice > dnp3 > dns > http_inspect > imap > modbus > netflow > pop > rpc_decode > ssh > ssl > dce_smb > dce_tcp > dce_udp > dce_http_proxy > dce_http_server > gtp_inspect > smtp > ftp_server > ftp_client > ftp_data > telnet > sip > normalizer > http2_inspect > wizard > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.hexes.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.hexes.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.hexes.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.hexes.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.hexes.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.spells.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.spells.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.spells.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.spells.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.spells.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.spells.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.spells.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.spells.client_first > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > wizard.spells.client_first > binder > host_cache > trace > daq > active > ips > file_id > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find file_id.file_rule= s > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find file_id.file_poli= cy > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find file_id.enable_ty= pe > ERROR: /usr/local/snort/etc/snort/snort.lua: can't find > file_id.enable_signature > Finished /usr/local/snort/etc/snort/snort.lua: > Loading file_id.rules_file: > Finished file_id.rules_file: > Loading ips.rules: > Loading ../../rules/snort.rules: > Finished ../../rules/snort.rules: > Finished ips.rules: > > Here is an excerpt of my snort.lua for the file_id configuration: > > ########################### > > -- see file_magic.lua for file id rules > file_id =3D > { > enable_type =3D true, > enable_signature =3D true, > file_rules =3D file_magic, > file_policy =3D > { > { use =3D { verdict =3D 'log', enable_file_type =3D true, > enable_file_signature =3D true } } > } > } > > ########################### > > and my understanding of the configuration for wizard is that it simply > uses default values: > > ########################### > > wizard =3D default_wizard > > ########################### > > If anybody could push me in the right direction, I would be extremely > grateful. Been googling for hours.... > > Kind Regards. > > Shaun > _______________________________________________ > Snort-users mailing list > [email protected] > Go to this URL to change user options or unsubscribe: > https://lists.snort.org/mailman/listinfo/snort-users > > To unsubscribe, send an email to: > [email protected] > > Please visit http://blog.snort.org to stay current on all the latest > Snort news! > > Please follow these rules: > https://snort.org/faq/what-is-the-mailing-list-etiquette > --0000000000001d762d063ff1f3b4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto">D'accord=C2=A0</div><br><div class=3D"gmail_quote gma= il_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">Le lun. 29 sept. = 2025, 16:02, Shaun donovan via Snort-users <<a href=3D"mailto:snort-user= [email protected]">[email protected]</a>> a =C3=A9crit=C2=A0:<= br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde= r-left:1px #ccc solid;padding-left:1ex"><u></u> =20 =20 =20 <div text=3D"#000000" bgcolor=3D"#FFFFFF"> <p>Hi all.</p> <p>I am new to snort and am trying to install it on Fedora Core 42 (snort version 3.9.5.0). I followed the installation guide "Snor= t 3 on Oracle Linux 8" and have got most everything working except two issues. These are that snort cannot find wizard.hexes.client_first or wizard.spells.client_first, nor can it find the configuration for file_id. Here is the output I get when I run snort:</p> <p>Loading /usr/local/snort/etc/snort/snort.lua:<br> Loading snort_defaults.lua:<br> Finished snort_defaults.lua:<br> Loading file_magic.lua:<br> Finished file_magic.lua:<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 references<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 classifications<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 alert_fast<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 file_log<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 output<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 rewrite<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 alerts<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 decode<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 host_tracker<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 hosts<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 network<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 packets<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 process<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 search_engine<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 so_proxy<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 appid<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 port_scan<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_ip<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_icmp<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_tcp<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_udp<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_user<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 stream_file<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 arp_spoof<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 back_orifice<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dnp3<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dns<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 http_inspect<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 imap<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 modbus<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 netflow<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 pop<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 rpc_decode<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ssh<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ssl<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_smb<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_tcp<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_udp<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_http_proxy<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 dce_http_server<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 gtp_inspect<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 smtp<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ftp_server<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ftp_client<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ftp_data<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 telnet<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 sip<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 normalizer<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 http2_inspect<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 wizard<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.hexes.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.hexes.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.hexes.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.hexes.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.hexes.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.spells.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.spells.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.spells.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.spells.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.spells.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.spells.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.spells.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.spells.client_first<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find wizard.spells.client_first<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 binder<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 host_cache<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 trace<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 daq<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 active<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ips<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 file_id<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find file_id.file_rules<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find file_id.file_policy<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find file_id.enable_type<br> ERROR: /usr/local/snort/etc/snort/snort.lua: can't find file_id.enable_signature<br> Finished /usr/local/snort/etc/snort/snort.lua:<br> Loading file_id.rules_file:<br> Finished file_id.rules_file:<br> Loading ips.rules:<br> Loading ../../rules/snort.rules:<br> Finished ../../rules/snort.rules:<br> Finished ips.rules:<br> </p> <p>Here is an excerpt of my snort.lua for the file_id configuration:</p= > <p>###########################<br> <br> -- see file_magic.lua for file id rules<br> file_id =3D<br> {<br> =C2=A0=C2=A0 enable_type =3D true,<br> =C2=A0=C2=A0 enable_signature =3D true,<br> =C2=A0=C2=A0 file_rules =3D file_magic,<br> =C2=A0=C2=A0 file_policy =3D<br> =C2=A0=C2=A0 {=C2=A0 =C2=A0<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 { use =3D { verdict =3D 'log',= enable_file_type =3D true, enable_file_signature =3D true } } <br> =C2=A0=C2=A0 }=C2=A0 =C2=A0<br> }<br> <br> ###########################</p> <p>and my understanding of the configuration for wizard is that it simply uses default values:</p> <p>###########################</p> <p> <span style=3D"font-family:monospace"><span style=3D"color:#000000;ba= ckground-color:#ffffff">wizard </span>=3D<span style=3D"color:#000000;backg= round-color:#ffffff"> default_wizard</span><br> </span> </p> <p>###########################</p> <p>If anybody could push me in the right direction, I would be extremely grateful. Been googling for hours....</p> <p>Kind Regards.</p> <p>Shaun<br> </p> </div> _______________________________________________<br> Snort-users mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"nor= eferrer">[email protected]</a><br> Go to this URL to change user options or unsubscribe:<br> <a href=3D"https://lists.snort.org/mailman/listinfo/snort-users" rel=3D"nor= eferrer noreferrer" target=3D"_blank">https://lists.snort.org/mailman/listi= nfo/snort-users</a><br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 To unsubscribe, send an email to:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"mailto:[email protected]= .org" target=3D"_blank" rel=3D"noreferrer">[email protected]= g</a><br> <br> Please visit <a href=3D"http://blog.snort.org" rel=3D"noreferrer noreferrer= " target=3D"_blank">http://blog.snort.org</a> to stay current on all the la= test Snort news!<br> <br> Please follow these rules: <a href=3D"https://snort.org/faq/what-is-the-mai= ling-list-etiquette" rel=3D"noreferrer noreferrer" target=3D"_blank">https:= //snort.org/faq/what-is-the-mailing-list-etiquette</a><br> </blockquote></div> --0000000000001d762d063ff1f3b4-- --===============3075711497313357295== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============3075711497313357295==--