Re: [Snort-inline-users] Snort-inline with ClamAv

[Victor J. <vi...@nk...>]

Hi Tareq,

Tareq AlKhatib wrote:
> Hi Victor
>
> Thanks for the link but I ve already seen it. I guess my question is
> what should I do with this configuration. I can't seem to find a
> configuration file to use the sample in.
>   
You have to put it in your main Snort configuration file. The Snort 
archive contains an example configuration file in the etc directory 
called snort.conf. Put the clamav line under the stream4 preprocessor 
and above the http_inspect preprocessor. Check the Snort Manual for the 
options in the snort.conf file: 
http://snort.org/docs/snort_htmanuals/htmanual_260/

Regards,
Victor

> Thanks
>
> Tareq
>
> -----Original Message-----
> From: Victor Julien [mailto:vi...@nk...] 
> Sent: Saturday, October 07, 2006 12:10 PM
> To: Tareq AlKhatib
> Cc: sno...@li...
> Subject: Re: [Snort-inline-users] Snort-inline with ClamAv
>
> Tareq AlKhatib wrote:
>   
>> Hi all,
>>
>> I am having problems setting up Snort-inline with ClamAv. I downloaded
>> the tar ball from http://www.bleedingsnort.com/ and configured it to
>>     
> use
>   
>> inline and ClamAv (./configure --enable-inline --enable-clamav) and
>>     
> make
>   
>> (made?) and make install. So far everything seems to work without
>> errors.
>>
>> The problem is I can't seem to find any of the usual configuration
>> files, not even snort.conf. I know I must change a configuration file
>> somewhere but I can't seem to find it. (Do I need to create it?)
>>
>> Can someone point me in the correct direction?
>>   
>>     
>
> I'm not sure I completely understand what you are looking for. I think 
> you ask for an example config for Snort + ClamAV. Please check this page
>
> for that: 
> http://www.bleedingsnort.com/staticpages/index.php?page=snort-clamav
>
> If you need the other configuration files, in the Snort source tarball 
> is a directory called etc/ it contains some example files. Rules can be 
> downloaded from snort.org and bleedingsnort.com...
>
> Hope this helps!
>
> Regards,
> Victor
>
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys -- and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>