IDS/IPS Plugins - Snort Rules PT Research Rules not loaded config reinstall

[Noctur]

In my upgrade from 17.1.12_1 to 18.1.1 I used a backup config file to reinstall my settings. In those settings I had the Snort/VRT rules tagged and had my ID and rules version file input.

On inspection, I noted the packages for Snort VRT and PT Research rulesets were not checked in the packages. Checking the IDS rules, they were not present.

After installing the packages my Snort user ID and rules file version were present. I was able to download and install those rules.

It looks like restoring a prior config is not capturing the all of the installed packages.

[franco]

There is an open ticket for remembering plugins, but besides mentioning it we can't do more. Auto-installing plugins is risky and crosses a barrier to always invoke user-interaction before doing something. And that is assuming a connection is up and running....

https://github.com/opnsense/core/issues/1663


Cheers,
Franco