Re: [sentinix-list] Snortcenter: Snort Rules Updates:

Update:
Thanks for the input guys.
This is basically what I've done so far, 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~ URL to update Snort rules / sentinix uses snort ver. 2.0.4 /                                         ~
~ manually update the "/usr/local/snort/snortcenter/config.php" file to reflect the new URL~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



The "old" URL in snortcenter for rules updates is:

http://www.snort.org/dl/signatures/snortrules-stable.tar.gz



The "new" URL for snort rules updates is:

http://www.snort.org/dl/rules/snortrules-snapshot-2_0.tar.gz


It did update the snort rules from that file but it looked like it rejected around half of them with an "Unknown rule option" error, here is an example:

Unknown Rule option: msg:"ATTACK-RESPONSES id check returned userid"; content:"uid="; byte_test:5,<,65537,0,relative,string; content:" gid="; distance:0; within:15; byte_test:5,<,65537,0,relative,string; classtype:bad-unknown; sid:1882; rev:9;
-> byte_test

 I'm trying to figure out why it rejected that many rules.... if there is some formatting option out of whack I could pull a file down locally and edit it then upload it to all the machines (and the list).

"Some" rules is better than "no" rules but it would be nice to have them all...

 Any ideas? 

thanks,
Michael


-----Original Message-----
From: Michel Blomgren <[email protected]>
Sent: Apr 5, 2004 5:04 PM
To: The SENTINIX Mailing List <[email protected]>
Subject: Re: [sentinix-list] Snortcenter: Snort Rules Updates:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Monday 05 April 2004 21:17, Chris Locke wrote:
> I don't remember the exact file I changed, I think it was snortcenter's
> config.php file, but basically all I had to do was change the filename
> from snortwhatever.tar.gz to snort-newname.tar.gz Find the entry in the
> file and put the url into mozilla (or whatever you use) and see what the
> proper filename is. I am away from my system otherwise I would tell you
> exactly what it is.

Yes, the error you (M. Morgan) receive is because snortcenter can't find the 
file, unfortunatly, I have no idea whether the format inside the tarball has 
changed or just the filename, but I doubt the whole structure has changed.

>
> When I did update it spilled some error's about being confused by some
> of the rule's, but in the end it did update them. And the system seems

That's common, since snortcenter complains about unknown classifications (or 
something similar, if I remember correctly, I'm not at my system either :P).

> to be running fine. One thing I didn't like was that it reset my
> HOME_NET and EXTERNAL_NET variables back to any, so I had a million
> alerts before I knew what happened.

Oh... that's weird though!

	Michel

>
> -Chris Locke
> http://stageofbattle.org
>
> On Mon, 2004-04-05 at 14:52, M. Morgan wrote:
> > Hello all,
> >  While trying update Snort Rules via the Internet in Snortcenter I get
> > the error "No Update This Time", after some "googling" I found references
> > to a syntax error between the "new" Snort rules format at snort.org and
> > Snortcenter since the newest Snort release... (or something along those
> > lines).
> >
> >  Does anyone have information regarding this issue and/or a possible
> > solution?
> >
> > Your input is appreciated.
> >
> > Thanks,
> > Michael
> >
> > btw: I posted this question to the snort list as well and will flip the
> > resolution (if any) back on here if/when I find it.
> > _______________________________________________
> > SENTINIX mailing list
> > [email protected]
> > http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQFAccnuDsNYvU6O5AgRAigxAKCQtD5zBvitL9hEONM32eliqqitJgCcDUfP
39vqJww2zPx7o41aDr1Z19w=
=6j+k
-----END PGP SIGNATURE-----

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix