[Bro] does bro need root privilege?

[Daniel Thayer]

Which version of Bro are you using?


On 5/23/17 2:08 PM, Kenneth Goldman wrote:
> Daniel Thayer <dnthayer at illinois.edu> wrote on 05/22/2017 04:47:08 PM:
>
>> From: Daniel Thayer <dnthayer at illinois.edu>
>> To: Kenneth Goldman <kgoldman at us.ibm.com>, <bro at bro.org>
>> Date: 05/22/2017 04:47 PM
>> Subject: Re: [Bro] does bro need root privilege?
>>
>> The BroControl documentation explains how to run as a normal user:
>> https://www.bro.org/sphinx/components/broctl/README.html#using-
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.bro.org_sphinx_components_broctl_README.html-23using-2D&d=DwMFAg&c=8hUWFZcy2Z-Za5rBPlktOQ&r=Bi5qPBnY0NmYPqnRTPj_AfXQKpfQTZUpCzpfFBcawv0&m=u8FYIQiIxTvxjAZvoHkaBXmX11PXfQEHVcqtqMhOs0c&s=j2Dkn5xTwTG46FY_2-Vts26cma-fQB3uqsIRJb48G20&e=>
>> brocontrol-as-an-unprivileged-user
>
> The spool and logs directories are in my home directory, and I edited
> /etc/bro/broctl.cfg to point to them.  They are rwx.
>
> SpoolDir = /home/kgold/bro/spool
> LogDir = /home/kgold/bro/logs
>
> I'm still getting this error:
>
>> > [BroControl] > install
>> > Error: running "bro -v" failed with output:
>> > can't open 'debug.log' for debugging output
>
> Perhaps I'm editing the wrong configuration file and it's still
> trying to open debug.log in a different directory?
>
>
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>