Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

[Snort-users] web-??.rules are empty

94 views
Skip to first unread message

C. L. Martinez

unread,
May 16, 2013, 9:01:00 AM5/16/13
to
Hi all,

Downloading rules 5 minutes ago, some rules files appears empty:

-rw-r--r-- 1 1210 1210 999 Apr 15 19:33 web-activex.rules
-rw-r--r-- 1 1210 1210 1390 Apr 15 19:33 web-attacks.rules
-rw-r--r-- 1 1210 1210 1520 Apr 15 19:33 web-cgi.rules
-rw-r--r-- 1 1210 1210 1113 Apr 15 19:33 web-client.rules
-rw-r--r-- 1 1210 1210 1008 Apr 15 19:33 web-coldfusion.rules
-rw-r--r-- 1 1210 1210 1006 Apr 15 19:33 web-frontpage.rules
-rw-r--r-- 1 1210 1210 998 Apr 15 19:33 web-iis.rules
-rw-r--r-- 1 1210 1210 3838 Apr 15 19:33 web-misc.rules
-rw-r--r-- 1 1210 1210 1002 Apr 15 19:33 web-php.rules

more web-iis.rules
# Copyright 2001-2012 Sourcefire Inc. All Rights Reserved.
#
# This file may contain proprietary rules that were created, tested and
# certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
# rules that were created by Sourcefire and other third parties and
# distributed under the GNU General Public License (the "GPL Rules"). The
# VRT Certified Rules contained in this file are the property of
# Sourcefire, Inc. Copyright 2012 Sourcefire, Inc. All Rights Reserved.
# The GPL Rules created by Sourcefire, Inc. are the property of
# Sourcefire, Inc. Copyright 2002-2012 Sourcefire, Inc. All Rights
# Reserved. All other GPL Rules are owned and copyrighted by their
# respective owners (please see www.snort.org/contributors for a list of
# owners and their respective copyrights). In order to determine what
# rules are VRT Certified Rules or GPL Rules, please refer to the VRT
# Certified Rules License Agreement.
#
#---------------
# WEB-IIS RULES
#---------------

....

------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d
_______________________________________________
Snort-users mailing list
Snort...@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Y M

unread,
May 16, 2013, 9:09:31 AM5/16/13
to
My understanding is that rules in the web-iis.rules have been recategorized as server-iis.rules. Check out:
 
http://blog.snort.org/2012/10/rule-category-reorganization-phase-3.html
 
Also it is my understanding that the web-iis.rules file is still there to ensure backward compatibility with older versions of Snort that are/were deployed.
 
Thanks.
 
> Date: Thu, 16 May 2013 13:01:00 +0000
> From: carlo...@gmail.com
> To: snort...@lists.sourceforge.net
> Subject: [Snort-users] web-??.rules are empty

C. L. Martinez

unread,
May 16, 2013, 9:17:01 AM5/16/13
to
Oops, you are rigth ... My mistake ... Sorry for the noise ...

Joel Esler

unread,
May 16, 2013, 9:26:45 AM5/16/13
to
Correct.  


They are all moved to new categories now.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

Joel Esler

unread,
May 16, 2013, 9:27:17 AM5/16/13
to
We'll be removing the old files eventually.  No date slated for it yet.

Joel


On May 16, 2013, at 9:09 AM, Y M <sn...@outlook.com> wrote:

My understanding is that rules in the web-iis.rules have been recategorized as server-iis.rules. Check out:
 
http://blog.snort.org/2012/10/rule-category-reorganization-phase-3.html
 
Also it is my understanding that the web-iis.rules file is still there to ensure backward compatibility with older versions of Snort that are/were deployed.
 
Thanks.
 
> Date: Thu, 16 May 2013 13:01:00 +0000
> From: carlo...@gmail.com
> To: snort...@lists.sourceforge.net
> Subject: [Snort-users] web-??.rules are empty
> 

waldo kitty

unread,
May 16, 2013, 2:38:48 PM5/16/13
to
On 5/16/2013 09:27, Joel Esler wrote:
> We'll be removing the old files eventually. No date slated for it yet.

how will deployed snorts know about the removal of these files? especially in
the cases where those persons managing them do not participate in these lists or
even know of them?

--
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.

Joel Esler

unread,
May 16, 2013, 2:45:27 PM5/16/13
to
On May 16, 2013, at 2:38 PM, waldo kitty <wkit...@windstream.net> wrote:
On 5/16/2013 09:27, Joel Esler wrote:
We'll be removing the old files eventually. No date slated for it yet.

how will deployed snorts know about the removal of these files? especially in 
the cases where those persons managing them do not participate in these lists or 
even know of them?

If they are using pulledpork in it's recommended and default configuration?  Nothing.  

If you are using something else, nothing.  As we can't delete the files from your system.  They'll just be removed from the tarball.

New users won't notice as the files will be removed from the snort.conf and the tarball.

TL;DR: Nothing.
0 new messages