Core 165: IDS page in GUI not responding

Security Intrusion Prevention
1

Hello
I have upgraded to Core 165 on my test machine. It’s a very simple RED/GREEN system with OpenVPN for site-to-site.
Update went well. System rebooted and re-established OpenVPN connection automatically.

Then I tried to activate IDS. Web-Proxy and URL filters are not activated. I used the WebGUI to go to IDS and there I tried to add abuse.ch ruleset. But when I click the “add” button, nothing happens. I end up with a completely white browser screen. When I reload the page, I still get the white page. I have to click the BACK-Button of the browser to get back the the WebUI. When I’m back to the IDS page I have no possibility to activate IDS.

Tried with MS Edge and Firefox. Also tried other rulesets. No luck.

So I thought that maybe I have to activate webproxy and url filters. I did that (with standard settings) and still I cannot activate IDS. Maybe other can try this out? Or is there some other dependency that I must think of to activate IDS?

2

Did u see systemlog → intrusion prevention system for any information/errors? For me all freezes of IPS are solved via 165CU

3

Thanks. There is absolutely nothing there. But now, after a new re-start, I can add abuse.ch to the rulesets and the WebGUI is working!

1 Like
4

My system is configured the same.
There are no problems.
But if suricata ( IPS ) fails to start, there should be entries in /var/log/messages. Either with tag ‘suricata’ or in case of memory problems with tag ‘kernel’.

2 Likes