[Snort-users] Snort IP blacklist issue

[ha dinhphu]

Good morning,

I followed the post on this webpage to install Snort on my linux box.

http://sublimerobots.com/2014/12/installing-snort-part-1/

However, on step 5, installing PulledPork for snort.

http://sublimerobots.com/2014/12/installing-snort-part-5/

I got the following error while I tried to run this command: "sudo /usr/local/bin/pulledpork.pl -c /etc/snort/pulledpork.conf -l"

--------------------------
Checking latest MD5 for snortrules-snapshot-2975.tar.gz....
Rules tarball download of snortrules-snapshot-2975.tar.gz....
    They Match
    Done!
Checking latest MD5 for community-rules.tar.gz....
Rules tarball download of community-rules.tar.gz....
    They Match
    Done!
IP Blacklist download of http://labs.snort.org/feeds/ip-filter.blf....
Reading IP List...
Couldn't read /tmp/621.416477111296-black_list.rules - No such file or directory
 at /usr/local/bin/pulledpork.pl line 487.
    main::read_iplist('HASH(0x1dd8148)', '/tmp/621.416477111296-black_list.rules') called at /usr/local/bin/pulledpork.pl line 378
    main::rulefetch('open', 'IPBLACKLIST0', '/tmp/', 'http://labs.snort.org/feeds/ip-filter.blf') called at /usr/local/bin/pulledpork.pl line 1856
------------------------------


I searched the internet for solution but did not find any. Any help would be greatly appreciated!


[Joel Esler (jesler)]

You might want to update your copy of pulledpork to the latest version in git.  We’re moving the blacklist off of labs.snort.org

--
Joel Esler
Manager, Threat Intelligence Team & Open Source
Talos Group
http://www.talosintel.com

------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort...@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

[ha dinhphu]

Hello Joel

I did as you said. Downloaded a new copy from github and replace my current set up of pulledpork on my box. I followed the instruction from the site("http://sublimerobots.com/2014/12/installing-snort-part-5/")

However, the result is like this:

Checking latest MD5 for snortrules-snapshot-2975.tar.gz....

    They Match
    Done!
Checking latest MD5 for community-rules.tar.gz....

    They Match
    Done!
IP Blacklist download of http://talosintel.com/files/additional_resources/ips_blacklist/ip-filter.blf....
Reading IP List...
Couldn't read /tmp/296.170136981772-black_list.rules - No such file or directory
 at /usr/local/bin/pulledpork.pl line 540.
    main::read_iplist('HASH(0x15bd080)', '/tmp/296.170136981772-black_list.rules') called at /usr/local/bin/pulledpork.pl line 431
    main::rulefetch('open', 'IPBLACKLIST0', '/tmp/', 'http://talosintel.com/files/additional_resources/ips_blacklis...') called at /usr/local/bin/pulledpork.pl line 1946

[waldo kitty]

On 08/14/2015 12:21 PM, ha dinhphu wrote:
> IP Blacklist download of
> http://talosintel.com/files/additional_resources/ips_blacklist/ip-filter.blf....
> Reading IP List...
> Couldn't read /tmp/296.170136981772-black_list.rules - No such file or directory

what linux are you using? does it have a working /tmp directory that is writable
by all users?

both of your reports have been failures to read a file that should have been
downloaded into /tmp... these failures seem to point to /tmp not existing or it
is not writable by the user your pulledpork is running as...

--
NOTE: No off-list assistance is given without prior approval.
*Please keep mailing list traffic on the list* unless
private contact is specifically requested and granted.

[ha dinhphu]

Hi kitty,

Yes my /tmp directory is available with rwx permission by all user. I ran the command as root, so i don't think that's the problem.
https://code.google.com/p/pulledpork/issues/detail?id=166 -- another user has the same problem.
http://sourceforge.net/p/snort/mailman/message/32913112/  --snort-user