Re: [Snort-users] unknown dynamic preprocessor "ftp_telnet"

On Sat, Jan 27, 2007 at 01:51:51PM -0500, Matthew Watchinski wrote:
>It looks like "make install" didn't create the necessary sym links in
>/usr/local/lib/snort_dynamicpreprocessor
>
>Do the following and see if it fixes it.
>
>cd /usr/local/lib/snort_dynamicpreprocessor
>
>ln -s libsf_ftptelnet_preproc.so.0.0 libsf_ftptelnet_preproc.so
>ln -s libsf_dcerpc_preproc.so.0.0 libsf_dcerpc_preproc.so
>ln -s libsf_smtp_preproc.so.0.0 libsf_smtp_preproc.so
>ln -s libsf_dns_preproc.so.0.0 libsf_dns_preproc.so
>ln -s libsf_ssh_preproc.so.0.0 libsf_ssh_preproc.so

Or use openbsd port which fixes that.
Diff against -current ports tree:
http://secure.lv/~nikns/stuff/ports/snort-2.6.1.2.diff



>
>OlRoy OlRoy wrote:
>> OS: OpenBSD 4.0
>> Snort version: Snort-2.6.1.2
>> Config: default snort.conf
>>
>> When I tried installing Snort with
>> ./configure --enable-dynamicplugin --prefix=/usr/local/stow/snort-2.6.1.2
>> it seemed to work fine. However, I got the following error when trying to run Snort in IDS mode.
>>
>> Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so... done
>> Loading all dynamic preprocessor libs from /usr/local/lib/snort_dynamicpreprocessor/...
>> Warning: No dynamic libraries found in directory /usr/local/lib/snort_dynamicpreprocessor/!
>> Finished Loading all dynamic preprocessor libs from /usr/local/lib/snort_dynamicpreprocessor/
>> /etc/snort/snort.conf(573) unknown dynamic preprocessor "ftp_telnet"
>> /etc/snort/snort.conf(577) unknown dynamic preprocessor "ftp_telnet_protocol"
>> /etc/snort/snort.conf(591) unknown dynamic preprocessor "ftp_telnet_protocol"
>> /etc/snort/snort.conf(596) unknown dynamic preprocessor "ftp_telnet_protocol"
>> /etc/snort/snort.conf(622) unknown dynamic preprocessor "smtp"
>> /etc/snort/snort.conf(777) unknown dynamic preprocessor "dcerpc"
>> /etc/snort/snort.conf(795) unknown dynamic preprocessor "dns"
>> ERROR: Misconfigured dynamic preprocessor(s)
>> Fatal Error, Quitting..
>>
>>
>> # ls /usr/local/lib/snort_dynamicpreprocessor/
>> libsf_dcerpc_preproc.a libsf_ftptelnet_preproc.so.0.0
>> libsf_dcerpc_preproc.la libsf_smtp_preproc.a
>> libsf_dcerpc_preproc.so.0.0 libsf_smtp_preproc.la
>> libsf_dns_preproc.a libsf_smtp_preproc.so.0.0
>> libsf_dns_preproc.la libsf_ssh_preproc.a
>> libsf_dns_preproc.so.0.0 libsf_ssh_preproc.la
>> libsf_ftptelnet_preproc.a libsf_ssh_preproc.so.0.0
>> libsf_ftptelnet_preproc.la
>>
>> Does anyone know how I can get this working?
>>
>> ---------------------------------
>> Bored stiff? Loosen up...
>> Download and play hundreds of games for free on Yahoo! Games.
>>
>>
>> ------------------------------------------------------------------------
>>
>> -------------------------------------------------------------------------
>> Take Surveys. Earn Cash. Influence the Future of IT
>> Join SourceForge.net's Techsay panel and you'll get the chance to share your
>> opinions on IT & business topics through brief surveys - and earn cash
>> http://www.techsay.com/default.php?p...rge&CID=DEVDEV
>>
>>
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users@lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/...fo/snort-users
>> Snort-users list archive:
>> http://www.geocrawler.com/redir-sf.p...st=snort-users
>
>
>-------------------------------------------------------------------------
>Take Surveys. Earn Cash. Influence the Future of IT
>Join SourceForge.net's Techsay panel and you'll get the chance to share your
>opinions on IT & business topics through brief surveys - and earn cash
>http://www.techsay.com/default.php?p...rge&CID=DEVDEV
>_______________________________________________
>Snort-users mailing list
>Snort-users@lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/...fo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.p...st=snort-users

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?p...rge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users