[Oisf-users] 'run-as' not working with 3.2.2 on *one* machine??

[Peter Manev]

> 


> On 9 Jul 2017, at 22:53, Russell Fulton <r.fulton at auckland.ac.nz> wrote:
> 
> HI
> 
> I recently installed 3.2.2 and have just realised that suri is running as root not as the user I gave in the config file *one* of my sensors.    The other difference with this version is that it was built locally with hyperscan rather than from Peter’s .deb packages.  

Hi Russel,
Just so I understand/confirm - this is not an install from the PPA, right or?

> 
> dumping the config shows:
> 
> run-as = (null)
> run-as.user = sensors
> run-as.group = sensors
> 
> Which is the same as the ones that ‘work’.  

What is different ? All the configs/OS the same!


> 
> Very puzzled!
> 
> Russell
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users