Snare Agent for LINUX - Invalid Change Token

  • Andrew Ratcliffe

    I have just installed Snare agent for Linux 1.7 and I can't make any changes
    through the micro web servers. I have scoured the site for clues but I can
    only see a post that talks about disabling this through windows registry.

    Invalid Change Token: request denied
    It looks like a really useful tool but I can't get anywhere with it if I can't
    change the config.
    Any help much appreciated


  • David Mohr

    David Mohr - 2012-05-29

    Hi Andy,

    The most likely explanation is that you have cookies disabled. This particular
    version of the agent uses cookies to enforce a change token. If you are unable
    to enable cookies, you can still use the previous version of the agent which
    doesn't have this feature, or alternatively you can wait for the next version
    of the agent where I will be making the cookies optional.

    Regards, David.

  • Andrew Ratcliffe

    Thanks for the quick response. I couldn't figure out what was going on with
    the cookie, I could see I had one in the browser but I couldn't tell why it
    wasn't what the program expected.
    I did this instead:

    if ($url =~ /^\/set/i) {
                                    #process cookies
                                    #if ($request =~ /(Cookie: *chtok=$COOKIE)\r/) {
                                    #} else {
                                    #       $rc=HandleError($client,"Invalid Change Token: request denied");
                            } else {
                                    $rc=HandleError($client,"Invalid request");
                            if($rc == -1) {

    Which bypassed the problem and removed the token check.

    It's a great program, I can see it being really useful.
    Kind regards,

  • David Mohr

    David Mohr - 2012-05-30

    Nice work Andy, that'll work just fine. I hope you enjoy the agent, feel free
    to drop back in if you have any more questions.

  • Andrew Ratcliffe

    Thanks very much for your help. If you are interested you can find my blog
    post here where I used the Snare Linux Agent. And it works
    really well.

    Just in case anyone else is looking at this thread the file edited above is
    /usr/sbin/ after installation
    The post below gave useful instructions for the install on Ubuntu

    Kind regards,


Log in to post a comment.