Failed to start LSB: Example initscript.

[dimaspencer84]

Hi I'm trying to use Snorter to install snort on a fresh installation of Kali 2017. I followed all the instructions and everything was fine during the installation. Though after the reboot, I can't start Snort service, I get the following error message. What could be the problem ?

snort.service - LSB: Example initscript
   Loaded: loaded (/etc/init.d/snort; generated; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sun 2017-05-14 13:56:36 BST; 15min a
     Docs: man:systemd-sysv-generator(8)
  Process: 404 ExecStart=/etc/init.d/snort start (code=exited, status=203/EXEC)

May 14 13:56:36 dima systemd[1]: Starting LSB: Example initscript...
May 14 13:56:36 dima systemd[404]: snort.service: Failed at step EXEC spawning /etc/init.d/snort: Exec format error
May 14 13:56:36 dima systemd[1]: snort.service: Control process exited, code exited status=203
May 14 13:56:36 dima systemd[1]: Failed to start LSB: Example initscript.
May 14 13:56:36 dima systemd[1]: snort.service: Unit entered failed state.
May 14 13:56:36 dima systemd[1]: snort.service: Failed with result 'exit-code'.

[joanbono]

I will take a look. Stay in touch.

Could you confirm that Snort is installed writing:

snort -v

And pasting here the output?

Thanks!

[dimaspencer84]

I get this, then the packet capture starts...

Running in packet dump mode

        --== Initializing Snort ==--
Initializing Output Plugins!
pcap DAQ configured to passive.
Acquiring network traffic from "eth0".
Decoding Ethernet

        --== Initialization Complete ==--

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.9.0 GRE (Build 56) 
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
           Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using libpcap version 1.8.1
           Using PCRE version: 8.39 2016-06-14
           Using ZLIB version: 1.2.8

Commencing packet processing (pid=1266)
WARNING: No preprocessors configured for policy 0.
05/15-09:31:07.025269 192.168.2.25 -> 224.0.0.22
IGMP TTL:1 TOS:0xC0 ID:0 IpLen:24 DgmLen:40 DF
IP Options (1) => RTRALT 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
05/15-09:31:07.627716 192.168.2.80 -> 224.0.0.22
IGMP TTL:1 TOS:0xC0 ID:0 IpLen:24 DgmLen:40 DF
IP Options (1) => RTRALT 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

[joanbono]

Well, the installation works, so it's the service creation the part which is not working as expected.

OK, will work on it. Good catch.

[joanbono]

Hi @dimaspencer84 , seems like a problem creating a service when using systemd, could you take a look on this or try to create another service?

Thanks

[dimaspencer84]

Hi @joanbono , it worked after the creation of another service.

Thank you very much ! :-)

[joanbono]

Hi @dimaspencer84 Could you explain here how do you create the service?

Maybe I can add to the script if possible or even to the Instructions.

Thanks

[dimaspencer84]

Hi @joanbono ! I've juste created a new service (snort.service) in the /lib/systemd/system/ folder with these informations:

[Unit]
Description=Snort NIDS Daemon
After=syslog.target network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/snort -q -u snort -g snort -c /etc/snort/snort.conf -i eth0

[Install]
WantedBy=multi-user.target

I activated the new service, started it then it worked !

[joanbono]

Thanks @dimaspencer84 👍

I guess you activate the new service doing:

systemctl enable snort.service
systemctl start snort.service

Am I right? Could you paste the output of systemctl status snort or systemctl status snort.service?

[dimaspencer84]

Yes I activated the new service by doing :

systemctl enable snort.service
systemctl start snort.service

Here is the output of systemctl status snort.service

snort.service - Snort NIDS Daemon
   Loaded: loaded (/lib/systemd/system/snort.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2017-05-18 13:15:11 BST; 7min ago
 Main PID: 586 (snort)
   CGroup: /system.slice/snort.service
           └─586 /usr/local/bin/snort -q -u snort -g snort -c /etc/snort/snort.conf -i eth0

May 18 13:15:11 dima systemd[1]: Started Snort NIDS Daemon.

[joanbono]

Awesome! Will add this to the main script!!

Thanks a lot @dimaspencer84 😄

Snorter v1.0.0 is coming 🐷

[joanbono]

Just added the Instructions to add a Kali Service on the README.md file.

Added also your name, thanks a lot 👍