NethSecurity 8.8.0: IPS doesn't load rules when persistent storage is enabled

NethSecurity
1

Hi all, On NethSecurity 8.8.0, the IPS doesn’t work correctly when persistent storage is enabled.

With storage enabled: Snort runs but loads only 208 rules (file_id rules), /var/ns-snort/rules/ is empty, and no alerts are ever generated.

With storage disabled: snort.rules appears in /var/ns-snort/rules/ and the IPS works correctly.

Is this a known issue? Is there a supported way to keep the storage enabled and still have the IPS rules loaded?

Thanks!

2

If persistent storage is enabled all the rules are joined together at every (re)start of the snort service in /mnt/data/ns-snort/rules/snort.rules. On the command line this becomes visible with:

# service snort restart
Backup created at /mnt/data/ns-snort/old.rules
Processing rule file /mnt/data/ns-snort/snort-rules/rules/snort3-protocol-icmp.rules

<TRUNCATED>

Processing rule file /mnt/data/ns-snort/snort-rules/rules/snort3-browser-firefox.rules
Appended 9186 rules to /mnt/data/ns-snort/rules/snort.rules
Removing testing rules...

Note the 9186 rules, However in the logs there is no prove this rules-file is actually loaded, in /mnt/data/log/messages the rule count is indeed quite low (219 in my case)

.... snort[23465]: rule counts
.... snort[23465]:        total rules loaded: 219
.... snort[23465]:                text rules: 219
.... snort[23465]:             option chains: 219
.... snort[23465]:             chain headers: 1

So, I think @ndrosis has a point here.

3

We have indeed saved the snort rulesets in the storage to allow faster boots and less downloads upon reboots.

This smells like a bug, I’ll investigate further.

4

Like a skunk…:wink:

Testing this atm:

Which shows the rules are loaded after a reboot in /mnt/data/log/messages:

...... snort[7002]: --------------------------------------------------
...... snort[7002]: rule counts
...... snort[7002]:        total rules loaded: 9362
...... snort[7002]:           duplicate rules: 43
...... snort[7002]:                text rules: 9362
...... snort[7002]:             option chains: 9362
...... snort[7002]:             chain headers: 312
...... snort[7002]:                  flowbits: 83
...... snort[7002]:      flowbits not checked: 3
...... snort[7002]:          flowbits not set: 76
...... snort[7002]: --------------------------------------------------

EDIT : there was a bug in this reply:

--- Like a skunk...;
+++  Like a skunk...;)

I just want to clarify that the remark was meant to be funny, to show that your hunch was right.

5

Thanks for the help, the suggested solution works.

After applying it, the rules are now loaded correctly. This is the output:

# ls -l /var/snort.d/snort_conf.lua /var/ns-snort/rules/ 

sed -n '15,25p' /var/snort.d/snort_conf.lua
ips = {
-- View all options with "snort --help-module ips"
mode            = 'inline',
variables       = default_variables,
--enable_builtin_rules=true,
rules = [[
include /var/ns-snort/rules/snort.rules
]],
}

daq = {

snort -c /var/snort.d/snort_conf.lua --tweaks ns_local -T 2>&1 | grep -i "total rules loaded"
total rules loaded: 9289

snort.rules is present in /var/ns-snort/rules/ and snort_conf.lua includes it, so the IPS is now loading the rules.

6

Hi,

I noticed a possible issue with BanIP in NethSecurity.

When Storage is enabled, BanIP does not seem to read the log file correctly, and therefore the expected bans/log processing do not work.

I found that I have to manually set the log file path from the CLI:

uci set banip.global.ban_logreadfile='/mnt/data/log/messages'
uci commit banip
/etc/init.d/banip restart

After applying the above configuration and restarting BanIP, it works as expected.

It seems that when Storage is enabled, BanIP does not automatically detect/use the correct /mnt/data/log/messages path.

Could you please confirm whether this is expected behavior or a bug?

Environment:

  • NethSecurity: 8.8.0
  • BanIP: 1.8.10
  • Storage: Enabled

Thanks!

Μετέφερα αυτό το θέμα σε νέο θέμα για καλύτερη προβολή και για να διατηρήσω τη συζήτηση ξεχωριστή.

Το BanIP δεν διαβάζει σωστά τα αρχεία καταγραφής όταν είναι ενεργοποιημένη η αποθήκευση

7

Hi, I’d suggest moving this into another topic, but it’s the correct behaviour.

See, BanIP only needs current logs, which are available under /var/log/messages, however this path is volatile and gets deleted upon reboot.
The /mnt/data/log/messages is just the same file, but stored on non-volatile storage.

If you have any other issue, feel free to report them in another topic, or if a mod can split this conversation, it’ll be much appreciated.

8

I moved this issue to a new topic for better visibility and to keep the discussion separate.

BanIP does not read logs correctly when Storage is enabled