From 1f27866e955b1ea27a77de07e5dae9edc7896679 Mon Sep 17 00:00:00 2001 From: Ermal Date: Fri, 13 Jul 2012 05:15:07 +0000 Subject: No need for all these output log configuration --- config/snort/snort_interfaces_edit.php | 31 ------------------------------- config/snort/snort_interfaces_global.php | 21 --------------------- 2 files changed, 52 deletions(-) diff --git a/config/snort/snort_interfaces_edit.php b/config/snort/snort_interfaces_edit.php index 06a1d6f4..dc9c4601 100644 --- a/config/snort/snort_interfaces_edit.php +++ b/config/snort/snort_interfaces_edit.php @@ -100,11 +100,7 @@ if ($_POST["Submit"]) { if ($_POST['homelistname']) $natent['homelistname'] = $_POST['homelistname']; else unset($natent['homelistname']); if ($_POST['externallistname']) $natent['externallistname'] = $_POST['externallistname']; else unset($natent['externallistname']); if ($_POST['suppresslistname']) $natent['suppresslistname'] = $_POST['suppresslistname']; else unset($natent['suppresslistname']); - if ($_POST['snortalertlogtype']) $natent['snortalertlogtype'] = $_POST['snortalertlogtype']; else $pconfig['snortalertlogtype']; if ($_POST['alertsystemlog'] == "on") { $natent['alertsystemlog'] = 'on'; }else{ $natent['alertsystemlog'] = 'off'; } - if ($_POST['enable']) { $natent['enable'] = 'on'; } else unset($natent['enable']); - if ($_POST['tcpdumplog'] == "on") { $natent['tcpdumplog'] = 'on'; } else{ $natent['tcpdumplog'] = 'off'; } - if ($_POST['snortunifiedlog'] == "on") { $natent['snortunifiedlog'] = 'on'; }else{ $natent['snortunifiedlog'] = 'off'; } if ($_POST['configpassthru']) $natent['configpassthru'] = base64_encode($_POST['configpassthru']); else unset($natent['configpassthru']); if ($_POST['cksumcheck']) $natent['cksumcheck'] = 'on'; else $natent['cksumcheck'] = 'off'; @@ -160,8 +156,6 @@ function enable_change(enable_change) { document.iform.externallistname.disabled = endis; document.iform.homelistname.disabled = endis; document.iform.suppresslistname.disabled = endis; - document.iform.tcpdumplog.disabled = endis; - document.iform.snortunifiedlog.disabled = endis; document.iform.configpassthru.disabled = endis; } //--> @@ -403,10 +397,6 @@ function enable_change(enable_change) {
Most of this is already done on the firewall/filter level - - Choose the types of - logs snort should create. - Send alerts to main System logs @@ -416,27 +406,6 @@ function enable_change(enable_change) { onClick="enable_change(false)">
Snort will send Alerts to the firewall's system logs. - - Log to a Tcpdump file - - onClick="enable_change(false)">
- Snort will log packets to a tcpdump-formatted file. The file then - can be analyzed by an application such as Wireshark which - understands pcap file formats. WARNING:
- File may become large. - - - Log Alerts to a snort - unified2 file - - onClick="enable_change(false)">
- Snort will log Alerts to a file in the UNIFIED2 format. This is a - requirement for barnyard2. - Arguments here will be automatically inserted into the snort configuration. diff --git a/config/snort/snort_interfaces_global.php b/config/snort/snort_interfaces_global.php index 7b2bc6c7..005e1fdd 100644 --- a/config/snort/snort_interfaces_global.php +++ b/config/snort/snort_interfaces_global.php @@ -49,7 +49,6 @@ $pconfig['rm_blocked'] = $config['installedpackages']['snortglobal']['rm_blocked $pconfig['snortloglimit'] = $config['installedpackages']['snortglobal']['snortloglimit']; $pconfig['snortloglimitsize'] = $config['installedpackages']['snortglobal']['snortloglimitsize']; $pconfig['autorulesupdate7'] = $config['installedpackages']['snortglobal']['autorulesupdate7']; -$pconfig['snortalertlogtype'] = $config['installedpackages']['snortglobal']['snortalertlogtype']; $pconfig['forcekeepsettings'] = $config['installedpackages']['snortglobal']['forcekeepsettings']; /* if no errors move foward */ @@ -72,7 +71,6 @@ if (!$input_errors) { $config['installedpackages']['snortglobal']['snortloglimitsize'] = $snortloglimitDSKsize; } $config['installedpackages']['snortglobal']['autorulesupdate7'] = $_POST['autorulesupdate7']; - $config['installedpackages']['snortglobal']['snortalertlogtype'] = $_POST['snortalertlogtype']; $config['installedpackages']['snortglobal']['forcekeepsettings'] = $_POST['forcekeepsettings'] ? 'on' : 'off'; $retval = 0; @@ -327,25 +325,6 @@ if ($input_errors) hosts to be blocked for.
Hint: in most cases, 1 hour is a good choice. - - Alerts file description - type - -
- Please choose the type of Alert logging you will - like see in your alert file.
- Hint: Best pratice is to chose full logging.
 WARNING: On - change, alert file will be cleared. - Keep snort settings after deinstall -- cgit v1.2.3