[Snort-users] Running Snort from User Account

Joel Esler jesler at ...1935...
Mon Mar 4 08:33:15 EST 2013


On Mar 4, 2013, at 7:20 AM, Tamara Fisher <tammi888 at ...11827...> wrote:

> Hi, 
> 
> I am trying to setup my implementation of snort for use by several team members mostly for rule testing. 
> 
> I get the following error I get when I attempt to run with user credentials:
> 
> ERROR: Can't start DAQ (-1) - socket: Operation not permitted!
> Fatal Error, Quitting..
> 
> When I google the errors I get, most of the responses I see to people with my issues say 'run as root' 
> 
> Of course everything works fine as root but I woulld like to be able to have my users use snort with their own accounts. Is this not possible? 

How many copies of Snort are you wanting to run?  Wouldn't it be more advantageous to have one copy running as root, sniffing the interface, and have your users reviewing the logs?

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130304/4c68c1af/attachment.html>


More information about the Snort-users mailing list