problema ao iniciar o guardian
eu instalei o snort foi de boa o guadian tbm mas na hora de rodar ele apareceu a seguinte mensagem:
[root@linux etc]# guardian.pl -c /etc/guardian.conf
OS shows Linux
Warning! HostIpAddr is undefined! Attempting to guess..
Couldn't figure out the ip address
[root@linux etc]#
abaixo esta o guardian.conf
[root@linux etc]# cat guardian.conf
# The machines IP address that is visable to the internet
# If this is left undefined, then guardian will attempt to get the information
# from ifconfig, as long as it has an interface to use. This would be useful
# for people on ppp links, or dhcp machines, or if you are lazy :)
# HostIpAddr
# Here we define the interface which we will use to guess the IP address, and
# block incoming offending packets. This is the only option that is required
# for guardian to run. If the rest are undefined, guardian will use the default.
Interface eth0
# The last octet of the ip address, which gives us the gateway address.
HostGatewayByte 1
# Guardian's log file
LogFile /var/log/guardian.log
# Snort's alert file. This can be the snort.alert file, or a syslog file
# There might be some snort alerts that get logged to syslog which guardian
# might not see..
AlertFile /var/log/snort/alert
# The list of ip addresses to ignore
IgnoreFile /etc/guardian.ignore
# The time in seconds to keep a host blocked. If undefined, it defaults to
# 99999999, which basicly disables the feature.
TimeLimit 86400
[root@linux etc]#
desde já valew ae
[]´z
Daniel
problema ao iniciar o guardian
se a variavels "HostIpAddr" estiver comentada no guardian.conf, então o guardian irá atribuir o endereço ip a ela pelo comando ifconfig na interface de rede selecionada na variavel "Interface" ....
Como está a saida de ifconfig eth0?
Caso seu IP seja fixo, descomente a linha HostIpAddr e atribua o IP de eth0 a ela...
problema ao iniciar o guardian
sim meu ip eh fixo, tentei desta forma mas nao foi...
[root@linux etc]# cat guardian.conf
# The machines IP address that is visable to the internet
# If this is left undefined, then guardian will attempt to get the information
# from ifconfig, as long as it has an interface to use. This would be useful
# for people on ppp links, or dhcp machines, or if you are lazy :)
HostIpAddr
# Here we define the interface which we will use to guess the IP address, and
# block incoming offending packets. This is the only option that is required
# for guardian to run. If the rest are undefined, guardian will use the default.
Interface eth0 192.168.1.254
# The last octet of the ip address, which gives us the gateway address.
HostGatewayByte 1
# Guardian's log file
LogFile /var/log/guardian.log
# Snort's alert file. This can be the snort.alert file, or a syslog file
# There might be some snort alerts that get logged to syslog which guardian
# might not see..
AlertFile /var/log/snort/alert
# The list of ip addresses to ignore
IgnoreFile /etc/guardian.ignore
# The time in seconds to keep a host blocked. If undefined, it defaults to
# 99999999, which basicly disables the feature.
TimeLimit 86400
[root@linux etc]#
problema ao iniciar o guardian
heheh
A opcao requer que voce informe seu IP amigo:
HostIPAddr 200.200.200.200
problema ao iniciar o guardian
affee rsrs
valew psy
[root@linux bin]# guardian.pl -c /etc/guardian.conf
OS shows Linux
My ip address and interface are: 192.168.1.254 eth0
Loaded 2 addresses from /etc/guardian.ignore
Becoming a daemon..
[root@linux bin]#