Date: Thu, 28 Aug 2003 11:37:42 -0700 From: Louis Kowolowski <louisk@bend.com> To: freebsd-security@freebsd.org Subject: snort, postgres, bridge Message-ID: <20030828183742.GA249@freespoon.cryptomonkeys.org>
next in thread | raw e-mail | index | archive | help
--TB36FDmn/VVEgNH/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable I've been prowling through the FreeBSD and Snort list archives in=20 search of information on setting up snort on a FreeBSD bridge(4) that logs to a remote postgres box via a third interface (hme0) Snort is being started with the following command: /usr/local/bin/snort -A full -D -e -d -s -i fxp0 -c /usr /local/etc/snort.conf=20 Where fxp0 and fxp1 are in the bridge output from sysctl: net.link.ether.bridge_cfg: fxp0:0,fxp1:0 net.link.ether.bridge: 1 net.link.ether.bridge_ipfw: 0 net.link.ether.bridge_ipf: 1 net.link.ether.bridge_ipfw_drop: 0 net.link.ether.bridge_ipfw_collisions: 0 The snort.conf is attached. I've attempted to start with a pretty generic config, just to ensure things work. The problem appears to be that snort simply doesn't log to the remote postgres box (yes, there are host entries in pg_hba.conf, and other databases are accessible remotely, so I believe that is not the issue). I've just been running trafshow to watch connections. Any hints/pointers/solutions welcome. Thanks --=20 Louis Kowolowski louisk@cryptomonkeys.org Crypto Monkeys: http://www.cryptomonkeys.org/~louisk IRC: outcast-consultants.biz#outcasts gpg info: http://www.cryptomonkeys.org/~louisk/gurgi.html gpg print: F04B 9A37 822A 4CE1 95CE 4D28 1AFF CCB7 DE4B A841 Everyone is a genius. It's just that some people are too stupid to realize it. --TB36FDmn/VVEgNH/ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (FreeBSD) iD8DBQE/Tkv2Gv/Mt95LqEERAvKYAJ46V4jnroIHen3IG5mJdJwCb+/usACfQzzn JPcnlclR283BC0fVCcLEZYs= =JjdX -----END PGP SIGNATURE----- --TB36FDmn/VVEgNH/--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030828183742.GA249>