0

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule.

alert tcp any any -> any 5466 (msg:"FTP command execution"; flow:to_server,established; content:"/admin_lua_script.html"; content:"os.execute"; content:"Wing FTP Server"; nocase;)

Can anyone see anything wrong with this rule?

I'm a student writing these rules for a final year project, not sure how to show a stack trace. Here is the error output:

Stopping Network Intrusion Detection System : snort (eth0 ...done).
[....] Starting Network Intrusion Detection System : snort (eth0 using /etc/snort/snort.conf ...ERROR: failed (check /var/log/daemon.log, /var/log/syslog and /v[FAILg/snort/)) failed!

Here is the tail of syslog:

root@kali:/var/log# tail /var/log/syslog
Feb 18 13:06:51 kali snort[4274]:     alert_large_fragments: INACTIVE
Feb 18 13:06:51 kali snort[4274]:     alert_incomplete: INACTIVE
Feb 18 13:06:51 kali snort[4274]:     alert_multiple_requests: INACTIVE
Feb 18 13:06:51 kali snort[4274]: FTPTelnet Config:
Feb 18 13:06:51 kali snort[4274]:     GLOBAL CONFIG
Feb 18 13:06:51 kali snort[4274]:       Inspection Type: stateful
Feb 18 13:06:51 kali snort[4274]:       Check for Encrypted Traffic: YES alert: NO
Feb 18 13:06:51 kali snort[4274]:       Continue to check encrypted data: NO
Feb 18 13:06:51 kali rsyslogd-2177: imuxsock begins to drop messages from pid 4274 due to rate-limiting
Feb 18 13:09:01 kali /USR/SBIN/CRON[4375]: (root) CMD (  [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -ignore_readdir_race -cmin +$(/usr/lib/php5/maxlifetime) ! -execdir fuser -s {} 2>/dev/null \; -delete)

I heard there was a command for snort which shows you which part of the snort rule was in the wrong format, what is it?

  • 1
    Can we get a stack trace? Error output? Logs? – baordog Feb 18 '15 at 14:49
  • I chopy/pasted your rule into my test system and it parsed without error. Your output, to me, didn't look rule related so I changed the rule such that I knew it should throw an error... which it of course did. Here's the output I received with the intentionally broken rule... Initializing rule chains... ERROR: /etc/snort/rules/test.rules(1) ***Rule--PortVar Parse error: (pos=1,error=not a number). The "(1)" in the output is the offending rule number (in my test there is only this one rule in test.rules). Run snort -T -c /etc/snort/snort.conf (substitute the path to your .conf). – user1801810 Jun 6 '15 at 23:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.