Intrusion Detection with BASE.

Discussion in 'HOWTO-Related Questions' started by emurray1122, Jan 9, 2007.

  1. emurray1122

    emurray1122 New Member

    Unable to get snort to download. Using wget http://www.snort.org/dl/snort-2.6.1.2.tar.gz

    connection refused

    Tried the one in the doc same. Tried to browse out to see if the files were there with a different path. . . . connection refused.

    Any ideas? I can download with my windows box, burn to CD and then see if that works.

    Liz M
     
  2. martinfst

    martinfst Member Moderator

    You're using the wrong link. Opening this page in a browser gives
    Code:
    Oink!! The page you requested doesn't exist.
    Try to use:
    Code:
    [URL="http://www.snort.org/dl/current/snort-2.6.1.2.tar.gz"]http://www.snort.org/dl/current/snort-2.6.1.2.tar.gz[/URL]
     
  3. emurray1122

    emurray1122 New Member

    Tried it -- didn't work

    Connection refused

    Another thing I noticed was after installing ispconfig, MySQL is showing up on the netstat -tap

    Could it be because I've install ISPConfig and it is preventing the connections? I've tried to download several files for this build and can't do it from the server
     
    Last edited: Jan 9, 2007
  4. martinfst

    martinfst Member Moderator

    Did you enable the firewall? I'm not using Bastille myself (switched to shorewall), but it looks like something is blocked. Any router in between your server and the Internet that may have restrictions?
     
  5. emurray1122

    emurray1122 New Member

    Firewall

    I am able to download the files to my Windows workstation. OK. I moved the server out to the same subnet as my workstation and I'm working. So since I want snort to be able to update from my management subnet, what will I have to put on my firewall?
     
  6. martinfst

    martinfst Member Moderator

    Depends on your policies. Apparently your management LAN is not allowed to access Internet. Probably for good reasons. Either open up port 80 to connect to the internet on your management LAN or define some route. Hard to say without knowing how your user/management LAN and firewalls are designed.
     
  7. falko

    falko Super Moderator Howtoforge Staff

    No, ISPConfig's firewall blocks only incoming connections, but not outgoing connections.
    But if you had another firewall running when you started ISPConfig's firewall, that might be a problem as both firewalls interfere with each other.

    What's the output of
    Code:
    iptables -L
    ?
    Which distribution do you use?
     
  8. emurray1122

    emurray1122 New Member

    Thanks

    OK. Got it going. I read a post you had about changing IP addresses. It was really strange. I made the change and was still able to download files for about an hour. Then all of a sudden it all went away. I had the wrong gateway for the subnet I moved into so was unable to get the files.

    Now I'm trying to get the ADOdb file down. for some reason that one was a problem during my last install.

    Learning curve straight up!!!
     
  9. martinfst

    martinfst Member Moderator

    That could be your arp cache on the client system needed expiring/clearing.
     

Share This Page