Welcome, Guest. Please login or register.
Did you miss your activation email?
Friday 06 December 2024, 12:49:30 am

Login with username, password and session length

Visit the Official Endian Reference Manual  HERE
14261 Posts in 4377 Topics by 6517 Members
Latest Member: Sandro
Search:     Advanced search
+  EFW Support
|-+  Support
| |-+  General Support
| | |-+  Editing snort.conf
0 Members and 1 Guest are viewing this topic. « previous next »
Pages: [1] Go Down Print
Author Topic: Editing snort.conf  (Read 11007 times)
sawilla
Full Member
***
Offline Offline

Posts: 12


« on: Saturday 29 May 2010, 12:42:28 am »

When I edit snort.conf, my changes are overwritten when the Intrusion Prevention System is disabled/enabled. Specifically, I need to add an "ignore_scanners { <IPs> }" directive to the sfportscan preprocesser in /etc/snort/snort/snort.conf. After doing this, if I disable then enable IPS, my changes get overwritten. How can I make the changes stick?
Logged
mrkroket
Hero Member
*****
Offline Offline

Posts: 495


« Reply #1 on: Saturday 29 May 2010, 01:16:19 am »

Probably on templates. There must be some snort.conf.tmpl near your snort.conf file....
Logged
sawilla
Full Member
***
Offline Offline

Posts: 12


« Reply #2 on: Saturday 29 May 2010, 01:22:59 am »

That did it, thanks!
Logged
Pages: [1] Go Up Print 
« previous next »
Jump to:  

Page created in 0.063 seconds with 18 queries.
Powered by SMF 1.1 RC2 | SMF © 2001-2005, Lewis Media Design by 7dana.com