From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gCWHJ5Dklz331X for ; Sat, 09 May 2026 16:13:00 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gCWHF1H1Mz2xJy for ; Sat, 09 May 2026 16:12:57 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4gCWHD3SHfzfP for ; Sat, 09 May 2026 16:12:56 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1778343176; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yu/DmTBk3S6jijk6xvOwrpZDjQjciVMYJLM6sDfS3ys=; b=vkRVHSWMDkqXFcmLw4kyD+Akehd7Pu7GVX28vWIVBPTQOAah/7uuMsKKZCsj0/UeXXgd69 ATE8GniupkeHb7Dw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1778343176; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yu/DmTBk3S6jijk6xvOwrpZDjQjciVMYJLM6sDfS3ys=; b=UQ58d1sXVeWJTqUx3FePCvLCU2UeI/ApSMZz9xUU1amwzQbN/VIiaGmdiqvhonh9nSPIFw zyhBC0h3bCUAub+SzJFu/VV3dJmZtaaW13e9pW8dE/dWSW6dzNFmMVKAMxaFYslJgakyEH rV8i95zxZpE+ydDo4vtTFqEt3MLJWBzJP7Gmb1UxQfQJPfNigQHxN63LM/HQMQdpc6WcdY WXixwHOhMzWsI6VDUXFM91cKlTqFEm7e834EuFeOTESCXJG3Ph4xKUsCe2VXbgUCnhMo29 kb6NrYdHsNCq962rM03iquUwQrSu/Scq1cXKbbQdpG1vzYgSQbMfSGa59cg8WA== Message-ID: Date: Sat, 9 May 2026 18:12:49 +0200 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Language: en-US To: "IPFire: Development-List" From: Matthias Fischer Subject: IDS / Snort/VRT GPLv2 Community-Rules : Error parsing signature... - but I can't deactivate specific rule(s) Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hi list, IDS is running with several rulesets, no seen problems, but one set always throws this error: ***SNIP*** [1433] -- error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Zeus Spam 2013 dated zip/exe HTTP Response - potential malware download"; flow:to_client,established; content:"-2013.zip|0D 0A|"; fast_pattern:only; content:"-2013.zip|0D 0A|"; http_header; content:"-"; within:1; distance:-14; http_header; file_data; content:"-2013.exe"; content:"-"; within:1; distance:-14; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/2eff3ee6ac7f5bf85e4ebcbe51974d0708cef666581ef1385c628233614b22c0/analysis/; classtype:trojan-activity; sid:26470; rev:2;)" from file /var/lib/suricata/community-community.rules at line 2581 ***SNAP*** Everything is working fine - except for this error message. So I tried to deactivate this rule - but I can't. Every time I uncheck this rule, it gets checked again. No chance. There are others — apparently not every rule — who also refuse to get unchecked. Can anyone confirm? Best Matthias