Hi all, On NethSecurity 8.8.0, the IPS doesn’t work correctly when persistent storage is enabled.
With storage enabled: Snort runs but loads only 208 rules (file_id rules), /var/ns-snort/rules/ is empty, and no alerts are ever generated.
With storage disabled: snort.rules appears in /var/ns-snort/rules/ and the IPS works correctly.
Is this a known issue? Is there a supported way to keep the storage enabled and still have the IPS rules loaded?
Thanks!
If persistent storage is enabled all the rules are joined together at every (re)start of the snort service in /mnt/data/ns-snort/rules/snort.rules. On the command line this becomes visible with:
# service snort restart
Backup created at /mnt/data/ns-snort/old.rules
Processing rule file /mnt/data/ns-snort/snort-rules/rules/snort3-protocol-icmp.rules
<TRUNCATED>
Processing rule file /mnt/data/ns-snort/snort-rules/rules/snort3-browser-firefox.rules
Appended 9186 rules to /mnt/data/ns-snort/rules/snort.rules
Removing testing rules...
Note the 9186 rules, However in the logs there is no prove this rules-file is actually loaded, in /mnt/data/log/messages the rule count is indeed quite low (219 in my case)
.... snort[23465]: rule counts
.... snort[23465]: total rules loaded: 219
.... snort[23465]: text rules: 219
.... snort[23465]: option chains: 219
.... snort[23465]: chain headers: 1
So, I think @ndrosis has a point here.
We have indeed saved the snort rulesets in the storage to allow faster boots and less downloads upon reboots.
This smells like a bug, I’ll investigate further.
Like a skunk…
Testing this atm:
Which shows the rules are loaded after a reboot in /mnt/data/log/messages:
...... snort[7002]: --------------------------------------------------
...... snort[7002]: rule counts
...... snort[7002]: total rules loaded: 9362
...... snort[7002]: duplicate rules: 43
...... snort[7002]: text rules: 9362
...... snort[7002]: option chains: 9362
...... snort[7002]: chain headers: 312
...... snort[7002]: flowbits: 83
...... snort[7002]: flowbits not checked: 3
...... snort[7002]: flowbits not set: 76
...... snort[7002]: --------------------------------------------------
EDIT : there was a bug in this reply:
--- Like a skunk...;
+++ Like a skunk...;)
I just want to clarify that the remark was meant to be funny, to show that your hunch was right.
Thanks for the help, the suggested solution works.
After applying it, the rules are now loaded correctly. This is the output:
# ls -l /var/snort.d/snort_conf.lua /var/ns-snort/rules/
sed -n '15,25p' /var/snort.d/snort_conf.lua
ips = {
-- View all options with "snort --help-module ips"
mode = 'inline',
variables = default_variables,
--enable_builtin_rules=true,
rules = [[
include /var/ns-snort/rules/snort.rules
]],
}
daq = {
snort -c /var/snort.d/snort_conf.lua --tweaks ns_local -T 2>&1 | grep -i "total rules loaded"
total rules loaded: 9289
snort.rules is present in /var/ns-snort/rules/ and snort_conf.lua includes it, so the IPS is now loading the rules.
Hi,
I noticed a possible issue with BanIP in NethSecurity.
When Storage is enabled, BanIP does not seem to read the log file correctly, and therefore the expected bans/log processing do not work.
I found that I have to manually set the log file path from the CLI:
uci set banip.global.ban_logreadfile='/mnt/data/log/messages'
uci commit banip
/etc/init.d/banip restart
After applying the above configuration and restarting BanIP, it works as expected.
It seems that when Storage is enabled, BanIP does not automatically detect/use the correct /mnt/data/log/messages path.
Could you please confirm whether this is expected behavior or a bug?
Environment:
Thanks!
Μετέφερα αυτό το θέμα σε νέο θέμα για καλύτερη προβολή και για να διατηρήσω τη συζήτηση ξεχωριστή.
Το BanIP δεν διαβάζει σωστά τα αρχεία καταγραφής όταν είναι ενεργοποιημένη η αποθήκευση
Hi, I’d suggest moving this into another topic, but it’s the correct behaviour.
See, BanIP only needs current logs, which are available under /var/log/messages, however this path is volatile and gets deleted upon reboot.
The /mnt/data/log/messages is just the same file, but stored on non-volatile storage.
If you have any other issue, feel free to report them in another topic, or if a mod can split this conversation, it’ll be much appreciated.
I moved this issue to a new topic for better visibility and to keep the discussion separate.
Hi folks,
Bumping this up because still think 
this is a issue which should be addressed.
if (I'm wrong):
I would appreciate feedback on the faulty thinking
else:
Is it oke to open an issue on github?
Thanx in advance.
Whops, mb for not getting back here, feel free to open an issue if you’re able to reproduce it! You can even open PRs if you want, I’ll gladly review them.
I’m not so surewhat the right solution is.. a kind of man the the mountain or mountain to the man:
Copy the snort rules from persistent storage (/mnt/data/ns-snort) to snort’s config dir (/var/ns-snort) every reboot/reload if persistent storage exist’s
or
change snort’s config dir to /mnt/data/ns-snort and copy all the contents of /var/ns-snort at creation of the persistent storage.
My initial solution was the first mentioned..
@ndrosis do you have suggestions for a solution?
(I wil open an issue on github the coming day’s if @ndrosis does not beat me to it…)
Hi @mark_nl ,
The first solution you suggested worked on one of my NethSecurity firewalls.
On my second firewall, the issue still persists despite the latest updates. I haven’t applied the workaround there yet.
Thanks for looking into this!
Filed it now, just reproduced: IPS doesn't load any rules when storage is configured · Issue #1950 · NethServer/nethsecurity · GitHub
Fix coming up
Fix here: simpler then the one implemented, @mark_nl, @ndrosis are you available for a quick test?
Thanks!
Yes, going to test tomorrow!
Filed it now, just reproduced: IPS doesn't load any rules when storage is configured · Issue #1950 · NethServer/nethsecurity · GitHub Fix coming up Fix here: simpler then the one implemented, @mark_nl, @ndrosis are you available for a quick test? Thanks!
I tried your fix, and it worked!