1. 2.1.3 is unsupported. Current is 2.2c, but we're really focused on the cvs version 2.2.98, prior to 3.0 release.
2. grsecurity often needs to be tuned to give the process the privledges it needs. The default is nothing, so you have to explicitly permit everything. Have at it... (It could be that a child is dying with a SIGSEGV and you're just seeing it passed to the parent, which needs a permission adjustment, but is largely irrelevant - see #1). -----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > [EMAIL PROTECTED] > Sent: Wednesday, January 14, 2004 4:19 PM > To: [EMAIL PROTECTED] > Subject: [Ntop] Ntop and grsecurity > > > Hello, > > Ntop is a recent discovery for me. Very nice program. I installed it (by > rpm) on my Mandrake 9.1 (HIGHER SECURITY setting, with grsecurity kernel). > This machine is a router with 4 eth cards. Program seems to run > fine except > after a day or two of running, ntop dies and i find this in the dmesg: > > (209.53.236.250 is my windows workstation IP, not the ntop machine) > ------------------------------- > grsec: From 209.53.236.250: signal 11 sent to (ntop:2721) UID(120) > EUID(120), parent (ntop:27276) UID(120) EUID(120) > grsec: From 209.53.236.250: signal 11 sent to (ntop:16447) UID(120) > EUID(120), parent (ntop:27276) UID(120) EUID(120) by (ntop:27276) UID(120) > EUID(120), parent (ntop:2749) UID(120) EUID(120) > grsec: From 209.53.236.250: signal 11 sent to (ntop:3604) UID(120) > EUID(120), parent (ntop:27276) UID(120) EUID(120) by (ntop:27276) UID(120) > EUID(120), parent (ntop:2749) UID(120) EUID(120) > grsec: From 209.53.236.250: signal 11 sent to (ntop:24722) UID(120) > EUID(120), parent (ntop:27276) UID(120) EUID(120) by (ntop:27276) UID(120) > EUID(120), parent (ntop:2749) UID(120) EUID(120) > grsec: From 209.53.236.250: signal 11 sent to (ntop:16930) UID(120) > EUID(120), parent (ntop:27276) UID(120) EUID(120) by (ntop:27276) UID(120) > EUID(120), parent (ntop:2749) UID(120) EUID(120) > grsec: From 209.53.236.250: signal 11 sent to (ntop:8851) UID(120) > EUID(120), parent (ntop:27276) UID(120) EUID(120) by (ntop:27276) UID(120) > EUID(120), parent (ntop:2749) UID(120) EUID(120) > grsec: more signal warnings, logging disabled for 10 seconds > device eth1 left promiscuous mode > device eth2 left promiscuous mode > device eth3 left promiscuous mode > ---------------------------------- > Sometimes ntop will run for a few days, other times just a few hrs. > Also, I want to be able to store the data ( as in using the -S 1 switch ) > but if I do this, ntop dies within minutes with same/similar messages in > dmesg. > > I believe if I boot the Mandrake machine up using the non-grsec/security > kernel I would have no problems, but I do not want to do this. A few hours > on google didnt seem to produce any useful hints. Anybody have > any ideas on > how to get ntop and grsec to play togather? > > RPM was ntop-2.1.3-1mdk.i586.rpm > > Thx, > Brian Millar > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
