From owner-freebsd-security@FreeBSD.ORG Thu Aug 28 11:37:50 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6592616A4BF for ; Thu, 28 Aug 2003 11:37:50 -0700 (PDT) Received: from e250.cryptomonkeys.org (102Net-254.sou.edu [140.211.102.254]) by mx1.FreeBSD.org (Postfix) with ESMTP id 53B4543FFD for ; Thu, 28 Aug 2003 11:37:47 -0700 (PDT) (envelope-from louisk@bend.com) Received: from e250.cryptomonkeys.org (localhost [127.0.0.1]) h7SIbgVd093732 for ; Thu, 28 Aug 2003 11:37:42 -0700 (PDT) (envelope-from louisk@e250.cryptomonkeys.org) Received: (from louisk@localhost) by e250.cryptomonkeys.org (8.12.9/8.12.9/Submit) id h7SIbgfh093717 for freebsd-security@freebsd.org; Thu, 28 Aug 2003 11:37:42 -0700 (PDT) (envelope-from louisk) Date: Thu, 28 Aug 2003 11:37:42 -0700 From: Louis Kowolowski To: freebsd-security@freebsd.org Message-ID: <20030828183742.GA249@freespoon.cryptomonkeys.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="TB36FDmn/VVEgNH/" Content-Disposition: inline User-Agent: Mutt/1.5.4i Subject: snort, postgres, bridge X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Aug 2003 18:37:50 -0000 --TB36FDmn/VVEgNH/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable I've been prowling through the FreeBSD and Snort list archives in=20 search of information on setting up snort on a FreeBSD bridge(4) that logs to a remote postgres box via a third interface (hme0) Snort is being started with the following command: /usr/local/bin/snort -A full -D -e -d -s -i fxp0 -c /usr /local/etc/snort.conf=20 Where fxp0 and fxp1 are in the bridge output from sysctl: net.link.ether.bridge_cfg: fxp0:0,fxp1:0 net.link.ether.bridge: 1 net.link.ether.bridge_ipfw: 0 net.link.ether.bridge_ipf: 1 net.link.ether.bridge_ipfw_drop: 0 net.link.ether.bridge_ipfw_collisions: 0 The snort.conf is attached. I've attempted to start with a pretty generic config, just to ensure things work. The problem appears to be that snort simply doesn't log to the remote postgres box (yes, there are host entries in pg_hba.conf, and other databases are accessible remotely, so I believe that is not the issue). I've just been running trafshow to watch connections. Any hints/pointers/solutions welcome. Thanks --=20 Louis Kowolowski louisk@cryptomonkeys.org Crypto Monkeys: http://www.cryptomonkeys.org/~louisk IRC: outcast-consultants.biz#outcasts gpg info: http://www.cryptomonkeys.org/~louisk/gurgi.html gpg print: F04B 9A37 822A 4CE1 95CE 4D28 1AFF CCB7 DE4B A841 Everyone is a genius. It's just that some people are too stupid to realize it. --TB36FDmn/VVEgNH/ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (FreeBSD) iD8DBQE/Tkv2Gv/Mt95LqEERAvKYAJ46V4jnroIHen3IG5mJdJwCb+/usACfQzzn JPcnlclR283BC0fVCcLEZYs= =JjdX -----END PGP SIGNATURE----- --TB36FDmn/VVEgNH/--