snort install unattended doesn't like non-ethX interface names

[Thomas d'Otreppe]

1) Ubuntu version: 16.04.1 (server)
2) Package version: 2.9.7.0-5 (amd64)
3) What I expected to happen: Successful installation. More details below.
4) What I got: Failed installation. More details below.

To summarize, if the interface name isn't ethX, snort will fail installing due to the fact that eth0 will be in /etc/snort/snort.debian.conf (and it isn't a valid interface as you can see at the bottom of the logs). The default interface should be changed in the installation script and default to an existing interface (eg ip link show | grep -E '^[0-9]*: ' | grep -v LOOPBACK | awk -F: '{print $2}' | head -n 1 | sed "s/ //g") instead of eth0. From there, it can figure out the IP range.
Also, make the script not start snort automatically and leave that to the user. A failure to start snort shouldn't prevent the package from a successful installation
As a workaround to fix the installation, fix the value in snort.debian.conf then do an apt-get -f install.
Notes:
- Even pre-answering using debconf-set-selection fails.
- That bug is present since 2008 based on searches (giving lots of results) in snort bugs.

root@ubuntu:~# DEBIAN_FRONTEND=noninteractive apt-get install snort -y
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  libauthen-sasl-perl libdaq2 libfile-listing-perl libfont-afm-perl libhtml-form-perl libhtml-format-perl libhtml-tree-perl
  libhttp-cookies-perl libhttp-daemon-perl libhttp-negotiate-perl libio-socket-ssl-perl liblwp-protocol-https-perl libmailtools-perl
  libnet-http-perl libnet-smtp-ssl-perl libnet-ssleay-perl libwww-perl libwww-robotrules-perl oinkmaster snort-common snort-common-libraries
  snort-rules-default
Suggested packages:
  libdigest-hmac-perl libgssapi-perl libcrypt-ssleay-perl libauthen-ntlm-perl snort-doc
The following NEW packages will be installed:
  libauthen-sasl-perl libdaq2 libfile-listing-perl libfont-afm-perl libhtml-form-perl libhtml-format-perl libhtml-tree-perl
  libhttp-cookies-perl libhttp-daemon-perl libhttp-negotiate-perl libio-socket-ssl-perl liblwp-protocol-https-perl libmailtools-perl
  libnet-http-perl libnet-smtp-ssl-perl libnet-ssleay-perl libwww-perl libwww-robotrules-perl oinkmaster snort snort-common
  snort-common-libraries snort-rules-default
0 upgraded, 23 newly installed, 0 to remove and 0 not upgraded.
Need to get 2,504 kB of archives.
After this operation, 11.1 MB of additional disk space will be used.
Get:1 http://us.archive.ubuntu.com/ubuntu xenial/universe amd64 snort-common-libraries amd64 2.9.7.0-5 [443 kB]
Get:2 http://us.archive.ubuntu.com/ubuntu xenial/universe amd64 snort-rules-default all 2.9.7.0-5 [141 kB]
Get:3 http://us.archive.ubuntu.com/ubuntu xenial/universe amd64 snort-common all 2.9.7.0-5 [42.4 kB]
Get:4 http://us.archive.ubuntu.com/ubuntu xenial/universe amd64 libdaq2 amd64 2.0.4-3 [65.2 kB]
Get:5 http://us.archive.ubuntu.com/ubuntu xenial/universe amd64 snort amd64 2.9.7.0-5 [646 kB]
Get:6 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libfile-listing-perl all 6.04-1 [9,774 B]
Get:7 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libfont-afm-perl all 1.20-1 [14.3 kB]
Get:8 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libhtml-form-perl all 6.03-1 [23.5 kB]
Get:9 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libhtml-tree-perl all 5.03-2 [197 kB]
Get:10 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libhtml-format-perl all 2.11-2 [41.3 kB]
Get:11 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libhttp-cookies-perl all 6.01-1 [17.2 kB]
Get:12 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libhttp-daemon-perl all 6.01-1 [17.0 kB]
Get:13 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libhttp-negotiate-perl all 6.00-2 [13.4 kB]
Get:14 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libnet-ssleay-perl amd64 1.72-1build1 [259 kB]
Get:15 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libio-socket-ssl-perl all 2.024-1 [159 kB]
Get:16 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libnet-http-perl all 6.09-1 [24.0 kB]
Get:17 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libwww-robotrules-perl all 6.01-1 [14.1 kB]
Get:18 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libwww-perl all 6.15-1 [146 kB]
Get:19 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 liblwp-protocol-https-perl all 6.06-2 [8,682 B]
Get:20 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libnet-smtp-ssl-perl all 1.03-1 [6,288 B]
Get:21 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libmailtools-perl all 2.13-1 [82.6 kB]
Get:22 http://us.archive.ubuntu.com/ubuntu xenial/universe amd64 oinkmaster all 2.0-4 [84.0 kB]
Get:23 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 libauthen-sasl-perl all 2.1600-1 [48.7 kB]
Fetched 2,504 kB in 3s (764 kB/s)
Preconfiguring packages ...
Selecting previously unselected package snort-common-libraries.
(Reading database ... 90125 files and directories currently installed.)
Preparing to unpack .../snort-common-libraries_2.9.7.0-5_amd64.deb ...
Unpacking snort-common-libraries (2.9.7.0-5) ...
Selecting previously unselected package snort-rules-default.
Preparing to unpack .../snort-rules-default_2.9.7.0-5_all.deb ...
Unpacking snort-rules-default (2.9.7.0-5) ...
Selecting previously unselected package snort-common.
Preparing to unpack .../snort-common_2.9.7.0-5_all.deb ...
Unpacking snort-common (2.9.7.0-5) ...
Selecting previously unselected package libdaq2.
Preparing to unpack .../libdaq2_2.0.4-3_amd64.deb ...
Unpacking libdaq2 (2.0.4-3) ...
Selecting previously unselected package snort.
Preparing to unpack .../snort_2.9.7.0-5_amd64.deb ...
Unpacking snort (2.9.7.0-5) ...
Selecting previously unselected package libfile-listing-perl.
Preparing to unpack .../libfile-listing-perl_6.04-1_all.deb ...
Unpacking libfile-listing-perl (6.04-1) ...
Selecting previously unselected package libfont-afm-perl.
Preparing to unpack .../libfont-afm-perl_1.20-1_all.deb ...
Unpacking libfont-afm-perl (1.20-1) ...
Selecting previously unselected package libhtml-form-perl.
Preparing to unpack .../libhtml-form-perl_6.03-1_all.deb ...
Unpacking libhtml-form-perl (6.03-1) ...
Selecting previously unselected package libhtml-tree-perl.
Preparing to unpack .../libhtml-tree-perl_5.03-2_all.deb ...
Unpacking libhtml-tree-perl (5.03-2) ...
Selecting previously unselected package libhtml-format-perl.
Preparing to unpack .../libhtml-format-perl_2.11-2_all.deb ...
Unpacking libhtml-format-perl (2.11-2) ...
Selecting previously unselected package libhttp-cookies-perl.
Preparing to unpack .../libhttp-cookies-perl_6.01-1_all.deb ...
Unpacking libhttp-cookies-perl (6.01-1) ...
Selecting previously unselected package libhttp-daemon-perl.
Preparing to unpack .../libhttp-daemon-perl_6.01-1_all.deb ...
Unpacking libhttp-daemon-perl (6.01-1) ...
Selecting previously unselected package libhttp-negotiate-perl.
Preparing to unpack .../libhttp-negotiate-perl_6.00-2_all.deb ...
Unpacking libhttp-negotiate-perl (6.00-2) ...
Selecting previously unselected package libnet-ssleay-perl.
Preparing to unpack .../libnet-ssleay-perl_1.72-1build1_amd64.deb ...
Unpacking libnet-ssleay-perl (1.72-1build1) ...
Selecting previously unselected package libio-socket-ssl-perl.
Preparing to unpack .../libio-socket-ssl-perl_2.024-1_all.deb ...
Unpacking libio-socket-ssl-perl (2.024-1) ...
Selecting previously unselected package libnet-http-perl.
Preparing to unpack .../libnet-http-perl_6.09-1_all.deb ...
Unpacking libnet-http-perl (6.09-1) ...
Selecting previously unselected package libwww-robotrules-perl.
Preparing to unpack .../libwww-robotrules-perl_6.01-1_all.deb ...
Unpacking libwww-robotrules-perl (6.01-1) ...
Selecting previously unselected package libwww-perl.
Preparing to unpack .../libwww-perl_6.15-1_all.deb ...
Unpacking libwww-perl (6.15-1) ...
Selecting previously unselected package liblwp-protocol-https-perl.
Preparing to unpack .../liblwp-protocol-https-perl_6.06-2_all.deb ...
Unpacking liblwp-protocol-https-perl (6.06-2) ...
Selecting previously unselected package libnet-smtp-ssl-perl.
Preparing to unpack .../libnet-smtp-ssl-perl_1.03-1_all.deb ...
Unpacking libnet-smtp-ssl-perl (1.03-1) ...
Selecting previously unselected package libmailtools-perl.
Preparing to unpack .../libmailtools-perl_2.13-1_all.deb ...
Unpacking libmailtools-perl (2.13-1) ...
Selecting previously unselected package oinkmaster.
Preparing to unpack .../oinkmaster_2.0-4_all.deb ...
Unpacking oinkmaster (2.0-4) ...
Selecting previously unselected package libauthen-sasl-perl.
Preparing to unpack .../libauthen-sasl-perl_2.1600-1_all.deb ...
Unpacking libauthen-sasl-perl (2.1600-1) ...
Processing triggers for man-db (2.7.5-1) ...
Processing triggers for systemd (229-4ubuntu7) ...
Processing triggers for ureadahead (0.100.0-19) ...
Setting up snort-common-libraries (2.9.7.0-5) ...
Setting up snort-rules-default (2.9.7.0-5) ...
Setting up snort-common (2.9.7.0-5) ...
Setting up libdaq2 (2.0.4-3) ...
Setting up snort (2.9.7.0-5) ...
Job for snort.service failed because the control process exited with error code. See "systemctl status snort.service" and "journalctl -xe" for details.
invoke-rc.d: initscript snort, action "start" failed.
dpkg: error processing package snort (--configure):
 subprocess installed post-installation script returned error exit status 1
Setting up libfile-listing-perl (6.04-1) ...
Setting up libfont-afm-perl (1.20-1) ...
Setting up libhtml-form-perl (6.03-1) ...
Setting up libhtml-tree-perl (5.03-2) ...
Setting up libhtml-format-perl (2.11-2) ...
Setting up libhttp-cookies-perl (6.01-1) ...
Setting up libhttp-daemon-perl (6.01-1) ...
Setting up libhttp-negotiate-perl (6.00-2) ...
Setting up libnet-ssleay-perl (1.72-1build1) ...
Setting up libio-socket-ssl-perl (2.024-1) ...
Setting up libnet-http-perl (6.09-1) ...
Setting up libwww-robotrules-perl (6.01-1) ...
Setting up libnet-smtp-ssl-perl (1.03-1) ...
Setting up libmailtools-perl (2.13-1) ...
Setting up libauthen-sasl-perl (2.1600-1) ...
Setting up libwww-perl (6.15-1) ...
Setting up liblwp-protocol-https-perl (6.06-2) ...
Setting up oinkmaster (2.0-4) ...
Processing triggers for libc-bin (2.23-0ubuntu3) ...
Processing triggers for systemd (229-4ubuntu7) ...
Processing triggers for ureadahead (0.100.0-19) ...
Errors were encountered while processing:
 snort
E: Sub-process /usr/bin/dpkg returned an error code (1)
root@ubuntu:~# ifconfig
ens33 Link encap:Ethernet HWaddr 00:0c:29:af:85:8f
          inet addr:192.168.133.156 Bcast:192.168.133.255 Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:feaf:858f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
          RX packets:2117 errors:0 dropped:0 overruns:0 frame:0
          TX packets:668 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2637814 (2.6 MB) TX bytes:93663 (93.6 KB)

lo Link encap:Local Loopback
          inet addr:127.0.0.1 Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING MTU:65536 Metric:1
          RX packets:160 errors:0 dropped:0 overruns:0 frame:0
          TX packets:160 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:11840 (11.8 KB) TX bytes:11840 (11.8 KB)

[Michael N. Jones (michael-n-jones)]

I can duplicate this error.

I am running 16.04 LTS on Oracle Virtual Box Version 5.1.18r114002 (Qt 5.6.2)
Its configured as a 64 bit OS, 4096 MB Ram 30 GB HDD.

Michael N. Jones.

[Launchpad Janitor (janitor)]

This bug was fixed in the package snort - 2.9.15.1-2

---------------
snort (2.9.15.1-2) unstable; urgency=medium

  * debian/control:
     - Add libssl-dev as Build-Dep (Closes:#956812)
     - Update Standards version
     - Fix Git-VCS url
     - Make snort-doc Multi-Arch: foreign
  * debian/patches/documentation_debian: Document the use of /etc/default/snort

 -- Javier Fernández-Sanguino Peña <email address hidden> Sat, 18 Apr 2020 11:56:13 +0200