|
Title: Editing snort.conf Post by: sawilla on Saturday 29 May 2010, 12:42:28 am When I edit snort.conf, my changes are overwritten when the Intrusion Prevention System is disabled/enabled. Specifically, I need to add an "ignore_scanners { <IPs> }" directive to the sfportscan preprocesser in /etc/snort/snort/snort.conf. After doing this, if I disable then enable IPS, my changes get overwritten. How can I make the changes stick?
Title: Re: Editing snort.conf Post by: mrkroket on Saturday 29 May 2010, 01:16:19 am Probably on templates. There must be some snort.conf.tmpl near your snort.conf file....
Title: Re: Editing snort.conf Post by: sawilla on Saturday 29 May 2010, 01:22:59 am That did it, thanks!
|