Bug 388221 - /usr/sbin/snort is missing
Summary: /usr/sbin/snort is missing
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: snort
Version: 8
Hardware: i386
OS: Linux
low
low
Target Milestone: ---
Assignee: Dennis Gilmore
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-11-17 10:21 UTC by Lyle Lasheimok
Modified: 2007-11-30 22:12 UTC (History)
2 users (show)

Fixed In Version: 2.7.0.1-5.fc8
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-11-29 01:40:06 UTC
Type: ---


Attachments (Terms of Use)

Description Lyle Lasheimok 2007-11-17 10:21:04 UTC
Description of problem:

After installing snort on F8, it tries to start automatically, but can't find
the non existing file /usr/sbin/snort.
There's a broken link /usr/bin/snort, which refers to /etc/alternatives/snort,
which refers to /usr/bin/snort-plain, which doesn't exist.

Version-Release number of selected component (if applicable):

snort-2.7.0.1-3.fc8

How reproducible:

Hm. I didn't try to reproduce it by installing a fresh system again. I just
assume it will install the same files.

Steps to Reproduce:
1. Install F8
2. Install snort
3. /etc/init.d/snortd start
  
Actual results:

Starting snort: /bin/bash: /usr/sbin/snort: No such file or directory
                                                           [FAILED]

Expected results:

Starting snort                                             [  OK  ]

Additional info:

At first I installed just snort, not any of the additional packages. I don't
know whether they are needed, but they are not dependencies.
Then I tried to also install snort-plain+flexresp, but it didn't help.

Comment 1 Fedora Update System 2007-11-20 17:55:31 UTC
snort-2.7.0.1-5.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update snort'

Comment 2 Lyle Lasheimok 2007-11-21 14:24:45 UTC
Sorry, I couldn't install the update:

# rpm -aq | grep snort
snort-2.7.0.1-3.fc8
# yum --enablerepo=updates-testing update snort
updates-testing           100% |=========================| 2.3 kB    00:00
Setting up Update Process
Could not find update match for snort
No Packages marked for Update

Comment 3 Dennis Gilmore 2007-11-21 16:10:54 UTC
please try again in a few hours.  the mirror your using could be not quite 
caught up yet.

Comment 4 Lyle Lasheimok 2007-11-25 12:44:22 UTC
The update didn't help. :( Snort still won't start.

I tried to reinstall it to make sure I didn't break anything myself, but I
couldn't uninstall it, it complained about snort-plain not being configured as
an alternative for snort.

I hoped installing something as snort-plain would help, so I installed
snort-plain+flexresp, now I get the following error message when I try to
uninstall snort:

$ sudo rpm -e snort snort-plain+flexresp
/usr/sbin/snort-plain+flexresp has not been configured as an alternative for snort
error: %postun(snort-plain+flexresp-2.7.0.1-5.fc8.i386) scriptlet failed, exit
status 2
Stopping snort: [FAILED]
/usr/sbin/snort-plain has not been configured as an alternative for snort
error: %preun(snort-2.7.0.1-5.fc8.i386) scriptlet failed, exit status 2

Any idea?

Comment 5 Dennis Gilmore 2007-11-25 15:59:37 UTC
try running 
sudo rpm -e --noscripts snort snort-plain+flexresp

then reinstall snort

Comment 6 Lyle Lasheimok 2007-11-25 16:31:09 UTC
Hi, thank you for helping!

That worked. :)

Kind of.

It still fails to start and leaves an error message in /var/log/messages:
FATAL ERROR: Unable to open rules file: /etc/local.rules or
/etc/snort//etc/local.rules

But that's probably because I didn't set it up yet.

Comment 7 Dennis Gilmore 2007-11-25 16:56:38 UTC
because of the licensing of the snort rules we cant ship them 

I need to spend some time a ship the community supplied rules that are GPL  
and have the config Just work.  



Comment 8 jon 2007-11-26 22:52:09 UTC
Even after updating from testing I'm still getting the same error.  Obviously I
know I just need to change the path to the binary to /usr/sbin/snort-mysql so
it's not a show stopper, just wanted to let you know.

[root@host yum.repos.d]# yum --enablerepo=updates-testing update snort
[yadda yadda]
Total download size: 1.9 M
Is this ok [y/N]: y
Downloading Packages:
(1/2): snort-mysql-2.7.0. 100% |=========================| 275 kB    00:00
(2/2): snort-2.7.0.1-5.fc 100% |=========================| 1.6 MB    00:02
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
  Updating  : snort                        ######################### [1/4]
  Updating  : snort-mysql                  ######################### [2/4]
  Cleanup   : snort                        ######################### [3/4]
Stopping snort: [FAILED]
  Cleanup   : snort-mysql                  ######################### [4/4]

Updated: snort.i386 0:2.7.0.1-5.fc8
Dependency Updated: snort-mysql.i386 0:2.7.0.1-5.fc8
Complete!
[root@host yum.repos.d]# service snortd start
Starting snort: /bin/bash: /usr/sbin/snort: No such file or directory
                                                           [FAILED]




Comment 9 Dennis Gilmore 2007-11-26 23:13:16 UTC
alternatives really does not like that the path was wrong.  

i would sugest you run 
rpm -e --noscripts snort snort-mysql   then install them over  then use 
alternatives to set the version of snort you want to use


the ugly manual symlinking is no more 

Comment 10 jon 2007-11-28 20:09:27 UTC
I'm sorry dennis, I'm not following you.  What do you mean by alternatives?

Comment 11 Dennis Gilmore 2007-11-28 20:18:15 UTC
run 
man alternatives

it is a system that allows you to manage 

alternatives  creates,  removes,  maintains and displays information about the 
symbolic links comprising the alternatives system. The alternatives system is 
a reimplementation of
       the Debian alternatives system. It was rewritten primarily to remove 
the dependence on perl; it is intended to be a drop in replacement for 
Debian’s  update-dependencies  script.
       This man page is a slightly modified version of the man page from the 
Debian project.


Comment 12 Fedora Update System 2007-11-29 01:40:05 UTC
snort-2.7.0.1-5.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 jon 2007-11-29 21:08:33 UTC
Does this mean it will be available in the yum "fedora" or "fedora updates"
mirrors once they update?


Note You need to log in before you can comment on or make changes to this bug.