Use the spec file from the src rpm.
# rpm -ql snort | egrep 'ssh|dcerpc'
/usr/lib/snort-2.6.1.1_dynamicpreprocessor/libsf_dcerpc_preproc.so
/usr/lib/snort-2.6.1.1_dynamicpreprocessor/libsf_dcerpc_preproc.so.0
/usr/lib/snort-2.6.1.1_dynamicpreprocessor/libsf_ssh_preproc.so
/usr/lib/snort-2.6.1.1_dynamicpreprocessor/libsf_ssh_preproc.so.0
/usr/share/doc/snort-2.6.1.1/doc/README.dcerpc
/usr/share/doc/snort-2.6.1.1/doc/README.ssh
Output from snort startup (installed frm RHEL4 rpm)
...
Rules Engine: SF_SNORT_DETECTION_ENGINE Version 1.6 <Build 11>
Preprocessor Object: SF_DNS Version 1.0 <Build 1>
Preprocessor Object: SF_DCERPC Version 1.0 <Build 1>
Preprocessor Object: SF_FTPTELNET Version 1.0 <Build 8>
Preprocessor Object: SF_SMTP Version 1.0 <Build 6>
Preprocessor Object: SF_SSH Version 1.0 <Build 1>
...
On 11/22/06, Jason Haar <Jason.Haar@trimble.co.nz> wrote:
Snort Releases wrote:
Hi everybody,
Snort v2.6.1.1 has been released. The software and source code is
available at:
http://www.snort.org/dl/
Snort v2.6.1.1 corrects an resource usage issue exhibited in Snort
v2.6.1 in certain network environments.
FYI the snort.spec file in 2.6.1.1 refers to ssh and dcerpc
preprocessors that aren't built as part of the install.
i.e. you can't build an RPM with that :-) Removing their
"%attr(0755,root,root)" lines fixes the problem.
(off to test it now)
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
