[Snort-users] chroot vs.setuid

Scott Renna srenna at ...9588...
Tue Jul 8 10:07:23 EDT 2003

Hello Snort Users,

I was wondering from all of you out there if anyone knows if it is
"better"(more secure) to run Snort as root and use the -t swtich for
setting up the jail?  Or if it is better to setuid on the binary file
snort and then drop privileges upon execution?

I am running the chrooted environment on my home system just to see how
it performs.  I'm not sure which way is more secure.  In the setup with
setuid set, I have changed the group on the bpf devices to be the snort
user's group.  This worries me only because a user in snort's group
would have rw privileges to the bpf devices.  

In the case of the chrooted option, I've found that snort can run just
fine and access the bpf devices in /dev, even though there is no /dev
under the new home directory for snort to run in.  

Does anyone have any recommendations on which way would be more safe to
operate in ?  I've not used chroot too much, but to my knowledge, root
is the only one that can do it.  Please let me know if anyone has any


Scott Renna
Head Systems Administrator
Dynamic Animation Systems


More information about the Snort-users mailing list