OINKMASTER(1)

💖 OINKMASTER 💖

okay bestie, welcome to the oinkmaster page from the General Commands Manual — yes the whole thing, we're reading it together, no skimming 🫶

---

✨ NAME ✨

oinkmaster — update Snort signatures. that's the whole vibe. it keeps your Snort rules fresh 🌸

---

🦋 SYNOPSIS 🦋

oinkmaster -o outdir [options]

---

💅 DESCRIPTION 💅

Oinkmaster is a simple little tool that helps you keep your Snort rules current with basically zero user interaction. main character energy fr fr ✨

here's the tea: it downloads a tarball with the new rules in it, and then it can enable, disable, or even make arbitrary modifications to specified rules before it updates your local rules files. it will also tell you the exact changes from your previous rules — like a diff but make it fashion 💖

---

🎀 OPTIONS 🎀

the only required argument is -o outdir, where outdir is the directory to put the new rules files in. this should be where you keep your rules locally. the downloaded files get compared to the ones in here before possibly overwriting them 👑

optional arguments, let's go:

• -b dir — if the rules have been modified, a tarball of your old rules gets put in dir before they get overwritten with the new files. no backup happens if no file has changed, or if Oinkmaster is running in careful mode. lowkey a safety net, slay.
• -c — run in careful mode. this means Oinkmaster will only check for updates and print them, but not update anything. window shopping only, bestie 🛍️
• -C cfg — use this configuration file instead of the default. if you don't specify one, oinkmaster.conf will be looked for in /etc/ and then /usr/local/etc/. you can specify multiple -C cfg to load multiple configuration files. they get loaded in order of appearance on the command line. if an option is redefined, it overrides the previous value — except for the "url" option, because you're allowed to specify multiple URLs 🦋
• -e — enable rules that are disabled by default in the downloaded rules archive by removing all the leading "#" from them. if there are any disabled rules in the archive, they stay that way unless you use this option. remember they're disabled for a reason (they may not even work), so use this one with care 😭
• -h — show valid command line arguments with short descriptions
• -i — enable interactive mode. you'll be asked to approve the changes (if any) before updating anything 🙈
• -m — minimize/simplify the diff when printing results for modified rules, by removing common leading and trailing parts of the old and new rule so the actual change is easier to see. a few characters to the left and to the right of the change also get printed so you get some context. the rev keyword is ignored when the comparison and removal of common parts is performed, because it would often make the whole idea fail. (if you feel it's important to be able to verify that the rev number has increased when a rule has been updated, do not use the minimized diff mode.)

normally when a rule has changed, the entire old and new versions are printed, but the actual change between them can be hard to see if the rules are long, complex and many.

the normal output could look like this:

Old: alert tcp any any -> any 22 (msg: "foo"; flags: A+; rev:1;)
New: alert tcp any any -> any 123 (msg: "foo"; flags: A+; rev:2;)

when using -m it would instead look something like:

Old: ...any any -> any 22 (msg: "foo";...
New: ...any any -> any 123 (msg: "foo";...

• -q — run in quiet mode. nothing is printed unless there are changes in the rules, or if there are errors or warnings 🤫
• -Q — run in super-quiet mode. this is the same as -q but even more quiet when printing the results (the "None." stuff is not printed). it will also suppress some other warning messages, like those for duplicate SIDs and non-matching modifysid expressions 💀
• -r — check for rules files that exist in the output directory but not in the downloaded rules archive, i.e. files that may have been removed from the distribution archive 👀
• -s — leave out details when printing results (aka bmc mode). this means the entire added / removed / modified rules will not be printed — just their SID and msg string, plus the filename. non-rule changes are printed as usual. this output mode could be useful, for example, if you send the output by email to people who don't really care about the details of the rules, just the fact that they've been updated. example output when running with -s:

[+++]          Added rules:          [+++]

    1607 - WEB-CGI HyperSeek hsx.cgi access (web-cgi.rules)
    1775 - MYSQL root login attempt (mysql.rules)

[///]     Modified active rules:     [///]

     302 - EXPLOIT Redhat 7.0 lprd overflow (exploit.rules)
     304 - EXPLOIT SCO calserver overflow (exploit.rules)
     305 - EXPLOIT delegate proxy overflow (exploit.rules)
     306 - EXPLOIT VQServer admin (exploit.rules)

• -S file — used in conjuction with -U to specify which file(s) in the downloaded archive(s) to search for new variables. when not specified, snort.conf is checked. you may specify multiple -S file to search for new variables in multiple files 🔍
• -T — check the configuration file(s) for fatal errors and then exit. possible warning messages are printed as well ✅
• -u url — download the rules archive from url instead of the location specified in the configuration file. it must start with file://, ftp://, http://, https:// or scp:// and end with ".tar.gz" or ".tgz". the file must be a gzipped tarball containing a directory named "rules", holding all the rules files. it must not contain any symlinks. you can also point to a local directory with dir://<directory>. for the official Snort rules, the URL to use depends on the version of Snort you run and it might also require registration. visit the rules download section at the Snort web site to find the right URL and more information. remember to update the URL when upgrading to a new major version of Snort ⭐

you may specify multiple -u url to grab multiple rules archives from different locations. all rules files in the archives will be put in the same output directory, so if the same filename exists in multiple archives, Oinkmaster will print an error message and exit. that's why it's usually recommended to instead run Oinkmaster once for each URL and use separate output directories. if -u url is specified, it overrides any URLs specified in the configuration file(s). note that if multiple URLs are specified and one of them is broken, Oinkmaster will exit immediately without further processing. this can be good or bad, depending on the situation 😭

• -U file — variables (i.e. "var foo bar" lines) that exist in the downloaded snort.conf but not in file will be added to file right after any other variables it may contain. modified existing variables are not merged, only new ones. file is normally your production copy of snort.conf (which should not be a file that is updated by Oinkmaster the normal way). this feature is to prevent Snort from breaking in case there are new variables added in the downloaded rules, since Snort can not start if the rules use variables that aren't defined anywhere. by default when using -U, the file snort.conf in the downloaded archive is searched for new variables, but you can override this with the -S file argument. if you download from multiple URLs, Oinkmaster will look for a snort.conf in each downloaded rules archive 💖
• -v — run in verbose/debug mode. should probably only be used in case you need to debug your settings, like verifying complex modifysid statements. it will also tell you if you try to use "disablesid" on non-existent SIDs. warnings about using enablesid/localsid/modifysid on non-existent SIDs are always printed unless running in quiet mode, as those are usually more important (using "disablesid" on a non-existent rule is a NOOP anyway) 🔥
• -V — show version and exit.

---

🌈 EXAMPLES 🌈

download rules archive from the default location specified in oinkmaster.conf and put the new rules in /etc/rules/:

oinkmaster -o /etc/rules

grab the rules archive from the local filesystem and don't print anything unless it contains updated rules:

oinkmaster -u file:///tmp/rules.tar.gz -o /etc/rules -q

download rules archive from the default location, make a backup of the old rules if there were updates, and send the output by e-mail. (note however that if you plan on distributing files with Oinkmaster that could be considered sensitive, such as Snort configuration files containing database passwords, you should of course not send the output by e-mail without first encrypting the content.):

oinkmaster -o /etc/snort/rules -b /etc/snort/backup 2>&1 | \
mail -s "subject" user@example.com

grab three different rules archives and merge variables that exist in the downloaded snort.conf and foo.conf but not in the local /etc/snort/snort.conf:

oinkmaster -u file:///tmp/foo.rules.tar.gz \
-u http://somewhere/rules.tar.gz -u https://blah/rules.tar.gz \
-o /etc/rules -S snort.conf -S foo.conf -U /etc/snort/snort.conf

load settings from two different files, use scp to download the rules archive from a remote host where you've put the rules archive, merge variables from the downloaded snort.conf, and send results by e-mail only if anything changed or if there were any error messages. it assumes that the "mktemp" command is available on the system:

TMP=`mktemp /tmp/oinkmaster.XXXXXX` && \
(oinkmaster -C /etc/oinkmaster-global.conf \
-C /etc/oinkmaster-sensor.conf -o /etc/rules \
-U /etc/snort.conf \
-u scp://user@example.com:/home/user/rules.tar.gz \
> $TMP 2>&1; if [ -s $TMP ]; then mail -s "subject" \
you@example.com < $TMP; fi; rm $TMP)

---

🍓 FILES 🍓

• /etc/oinkmaster.conf
• /usr/local/etc/oinkmaster.conf

---

💀 BUGS 💀

if you find a bug, report it by e-mail to the author. always include as much information as possible. like, the whole lore, bestie 🙏

---

🧚 HISTORY 🧚

the initial version was released in early 2001 under the name arachnids_upd. it worked only with the ArachNIDS Snort rules, but as times changed, it was rewritten to work with the official Snort rules and the new name became Oinkmaster. a glow-up, honestly 💅✨

---

👑 AUTHOR 👑

Andreas Ostling <andreas_ostling@bredband.net>

---

💜 SEE ALSO 💜

the online documentation at http://oinkmaster.sf.net/ contains more information 📚

---

and that's the whole page, bestie 💖 it's from the General Commands Manual, the page is dated January 14, 2004 — that's the footer, so like, we're done here. go update your Snort signatures. periodt 🎀🦋💅