Topic: Remove Snort/Acid signature

[Steve]

I'm using phpWebsite and when users access
http://mydomain.com/mod.php?mod=calendar&op=month_view

The 'WEB-CGI calendar access' is triggered and since I'm using snort_guardian the person's IP is blocked for 24 hours.  Does anyone know how to remove this from the Snort database?  

Thanks

[Brian]

Do you want to remove the guardian addon?

rpm -e trevor-mitel-guardian

[Tom Veitch]

Yes just edit the snort.conf file you will find the rules at the end of the file the snort.conf file is in the /etc/snort/snort.conf

Tom
Steve wrote:
>
> I'm using phpWebsite and when users access
> http://mydomain.com/mod.php?mod=calendar&op=month_view
>
> The 'WEB-CGI calendar access' is triggered and since I'm
> using snort_guardian the person's IP is blocked for 24
> hours.  Does anyone know how to remove this from the Snort
> database?
>
> Thanks

[Marl]

Uh, if you notice, /etc/snort/snort.conf tells you "DO NOT MODIFY THIS FILE"

you have to modify the template.

Mark

[Steve]

Editing the snort.conf file worked just fine.  I'm not sure if it was designed to work with the template system.