PacketFence - BTS - PacketFence
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0001651PacketFencecorepublic2013-06-12 15:082013-07-12 16:23
Reporterdwuelfrath 
Assigned Todwuelfrath 
PriorityhighSeveritymajorReproducibilityalways
StatusassignedResolutionsuspended 
PlatformAllOSAllOS VersionAll
Product Version4.0.1 
Target VersionFixed in Version 
fixed in git revision
fixed in mtn revision
Summary0001651: Snort cannot start if pfdetect is not started
DescriptionWhen we start PacketFence, we create a FIFO (/usr/local/pf/var/alert) in which Snort is writing detected alerts.

Snort is trying to open that FIFO in WRITE mode but a FIFO can only be opened in WRITE if a process already opened that FIFO in READ.

Currently, PacketFence starts Snort before pfdetect (starting sequence) which cause Snort to hung since the FIFO cannot be opened in WRITE due to the lack of a process opening that FIFO in READ (pfdetect).

Startup sequence need to be adapted so that pfdetect is started before Snort.
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2013-06-12 15:08dwuelfrathNew Issue
2013-06-12 15:09dwuelfrathAssigned To => dwuelfrath
2013-06-12 15:09dwuelfrathStatusnew => confirmed
2013-06-14 14:09dwuelfrathNote Added: 0003325
2013-06-14 14:09dwuelfrathStatusconfirmed => assigned
2013-06-14 14:09dwuelfrathResolutionopen => suspended
2013-07-12 16:23lpeletNote Added: 0003341

Notes
(0003325)
dwuelfrath   
2013-06-14 14:09   
Mitigate in c2d817f0ecb53fb7a95a97fcd798ae1140b07f33
(0003341)
lpelet   
2013-07-12 16:23   
Same error when Suricata try to log into the fifo alert.
Patch suricata.yaml in section where the alert file is declared to specify filetype = regular

view https://github.com/inverse-inc/packetfence/commit/ff90a8c83ba2fa4c2d3bd6204643936443466025 [^]