[Snort-users] pulledpork 0.7.1 -wc certificate verification problem

amn0p at ...14399... amn0p at ...14399...
Fri Jan 16 19:27:32 EST 2015


Hi everyone,

I have the pulledpork 0.7.1 perl script to download snort rules. But because of certificate verification it keeps failing. I even tried the -w option. Please see verbose output below. Any guidance? Thanks for your time.

 sudo /usr/bin/pulledpork.pl -vvwc /usr/local/snort/etc/pulledpork.conf

    http://code.google.com/p/pulledpork/ <http://code.google.com/p/pulledpork/>
      _____ ____
     `----,\    )
      `--==\\  /    PulledPork v0.7.1 - Swine Flu with a side of Ebola!
       `--==\\/
     .-~~~~-.Y|\\_  Copyright (C) 2009-2014 JJ Cummings
  @_/        /  66\_  cummingsj at ...11827... <mailto:cummingsj at ...11827...>
    |    \   \   _(")
     \   /-| ||'--'  Rules give me wings!
      \_\  \_\\
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Config File Variable Debug /usr/local/snort/etc/pulledpork.conf
        snort_path = /usr/local/bin/snort
        enablesid = /usr/local/snort/etc/enablesid.conf
        black_list = /usr/local/snort/rules/black_list.rules
        IPRVersion = /usr/local/snort/rules/iplists
        rule_path = /usr/local/snort/rules/snort.rules
        ignore = deleted.rules,experimental.rules,local.rules
        state_order = disable,drop,enable
        snort_control = /usr/local/bin/snort_control
        rule_url = ARRAY(0x2133638)
        snort_version = 2.9.6.2
        sid_msg_version = 1
        sid_changelog = /var/log/sid_changes.log
        sid_msg = /usr/local/snort/etc/sid-msg.map
        config_path = /usr/local/snort/etc/snortint1.conf
        temp_path = /tmp
        distro = Ubuntu-12-04
        version = 0.7.1
        sorule_path = /usr/local/snort/lib/snort_dynamicrules/
        disablesid = /usr/local/snort/etc/disablesid.conf
        local_rules = /usr/local/snort/rules/local.rules
MISC (CLI and Autovar) Variable Debug:
        arch Def is: x86-64
        Config Path is: /usr/local/snort/etc/pulledpork.conf
        Distro Def is: Ubuntu-12-04
        Disabled policy specified
        local.rules path is: /usr/local/snort/rules/local.rules
        Rules file is: /usr/local/snort/rules/snort.rules
        Path to disablesid file: /usr/local/snort/etc/disablesid.conf
        Path to enablesid file: /usr/local/snort/etc/enablesid.conf
        sid changes will be logged to: /var/log/sid_changes.log
        sid-msg.map Output Path is: /usr/local/snort/etc/sid-msg.map
        Snort Version is: 2.9.6.2
        Snort Config File: /usr/local/snort/etc/snortint1.conf
        Snort Path is: /usr/local/bin/snort
        SO Output Path is: /usr/local/snort/lib/snort_dynamicrules/
        Will process SO rules
        Extra Verbose Flag is Set
        Verbose Flag is Set
        SSL Hostname Verification disabled
        Base URL is: https://www.snort.org/sub-rules/|snortrules-snapshot.tar.gz|<trimmed> <https://www.snort.org/sub-rules/|snortrules-snapshot.tar.gz|%3Ctrimmed%3E> http://labs.snort.org/feeds/ip-filter.blf|IPBLACKLIST| <http://labs.snort.org/feeds/ip-filter.blf|IPBLACKLIST|%3Ctrimmed%3E><trimmed> <http://labs.snort.org/feeds/ip-filter.blf|IPBLACKLIST|%3Ctrimmed%3E>
Checking latest MD5 for snortrules-snapshot-2962.tar.gz....
        Fetching md5sum for: snortrules-snapshot-2962.tar.gz.md5
** GET https://www.snort.org/reg-rules/snortrules-snapshot-2962.tar.gz.md5/<trimmed> <https://www.snort.org/reg-rules/snortrules-snapshot-2962.tar.gz.md5/%3Ctrimmed%3E> ==> 500 Can't connect to www.snort.org <http://www.snort.org/>:443 (certificate verify failed) (1s)
        Error 500 when fetching https://www.snort.org/sub-rules/snortrules-snapshot-2962.tar.gz.md5 <https://www.snort.org/sub-rules/snortrules-snapshot-2962.tar.gz.md5> at /usr/bin/pulledpork.pl line 482
        main::md5file('<trimmed>', 'snortrules-snapshot-2962.tar.gz', '/tmp/', 'https://www.snort.org/sub-rules/' <https://www.snort.org/sub-rules/'>) called at /usr/bin/pulledpork.pl line 1875
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150116/1eaedf3b/attachment.html>


More information about the Snort-users mailing list