# still present in jessie found 725301 2.0.6-3 # and preventing daemon startup in the default configuration, thus marking as grave severity 725301 grave thanks
On Thu, Oct 03, 2013 at 09:58:17PM +0200, Frederik Himpe wrote: > The init script for suricata is looking for /proc/net/netfilter/nf_queue, > and recommends loading the nfnetlink_queue module. However, on my 3.10 > kernel, loading this module > creates the file /proc/net/netfilter/nf_netfilter_queue, not nf_queue. > > This same problem and fix is also documented on this page: > http://doc.ubuntu-fr.org/suricata > > Maybe the init script could also load this module itself the file is missing? A transcript to showcase the bug follows. Patching the initscript is required for it to work in the default configuration of IPS (nfqueue) mode. The critical parts are marked with "XXX": root@suricatatest:/etc# apt-get install suricata [...] The following extra packages will be installed: libjansson4 libluajit-5.1-2 libluajit-5.1-common libnet1 libnetfilter-queue1 libnspr4 libnss3 libprelude2 Recommended packages: oinkmaster snort-rules-default The following NEW packages will be installed: libjansson4 libluajit-5.1-2 libluajit-5.1-common libnet1 libnetfilter-queue1 libnspr4 libnss3 libprelude2 suricata [...] root@suricatatest:/etc# service suricata status * suricata.service - LSB: Next Generation IDS/IPS Loaded: loaded (/etc/init.d/suricata) Active: active (exited) since Thu 2015-03-12 20:31:13 CET; 54s ago Process: 17810 ExecStart=/etc/init.d/suricata start (code=exited, status=0/SUCCESS) Mar 12 20:31:13 suricatatest suricata[17810]: suricata disabled, please adjust the configuration to your needs ... failed! Mar 12 20:31:13 suricatatest suricata[17810]: and then set RUN to 'yes' in /etc/default/suricata to enable it. ... failed! root@suricatatest:/etc# sed -i -e 's/^RUN=no/RUN=yes/' /etc/default/suricata root@suricatatest:/etc# modprobe nfnetlink_queue # XXX: make sure the module gets loaded root@suricatatest:/etc# lsmod | grep queue nfnetlink_queue 17604 0 nfnetlink 12989 1 nfnetlink_queue root@suricatatest:/etc# service suricata restart Job for suricata.service failed. See 'systemctl status suricata.service' and 'journalctl -xn' for details. root@suricatatest:/etc# systemctl status suricata.service * suricata.service - LSB: Next Generation IDS/IPS Loaded: loaded (/etc/init.d/suricata) Active: failed (Result: exit-code) since Thu 2015-03-12 20:32:16 CET; 6s ago Process: 17971 ExecStop=/etc/init.d/suricata stop (code=exited, status=5) Process: 17978 ExecStart=/etc/init.d/suricata start (code=exited, status=5) Mar 12 20:32:16 suricatatest suricata[17978]: NFQUEUE support not found ! ... failed! Mar 12 20:32:16 suricatatest suricata[17978]: Please ensure the nfnetlink_queue module is loaded or built in kernel ... failed! Mar 12 20:32:16 suricatatest systemd[1]: suricata.service: control process exited, code=exited status=5 Mar 12 20:32:16 suricatatest systemd[1]: Failed to start LSB: Next Generation IDS/IPS. Mar 12 20:32:16 suricatatest systemd[1]: Unit suricata.service entered failed state. root@suricatatest:/etc# sed -i -e 's#/proc/net/netfilter/nf_queue#/proc/net/netfilter/nfnetlink_queue#' /etc/init.d/suricata # XXX: fix module detection root@suricatatest:/etc# service suricata restart Warning: Unit file of suricata.service changed on disk, 'systemctl daemon-reload' recommended. root@suricatatest:/etc# systemctl status suricata.service * suricata.service - LSB: Next Generation IDS/IPS Loaded: loaded (/etc/init.d/suricata) Active: active (running) since Thu 2015-03-12 20:38:15 CET; 2s ago Process: 17971 ExecStop=/etc/init.d/suricata stop (code=exited, status=5) Process: 18019 ExecStart=/etc/init.d/suricata start (code=exited, status=0/SUCCESS) CGroup: /system.slice/suricata.service `-18025 /usr/bin/suricata -c /etc/suricata/suricata-debian.yaml --pidfile /var/run/suricata.pid -q 0 -D Mar 12 20:38:15 suricatatest suricata[18019]: Starting suricata in IPS (nfqueue) mode... done. Warning: Unit file changed on disk, 'systemctl daemon-reload' recommended. Unfortunately it looks like a fix for this cannot got via unstable due to today's upload of 2.0.7-1 ... Cheers, Flo
signature.asc
Description: Digital signature
