[Snort-users] Snort logging to encrypted MySQL (ssl) server?

David DeCoster decoster at ...10463...
Tue Nov 4 08:34:04 EST 2003


Hello all--

I have a question that is driving me nuts.  I have a remote snort sensor
(running ver. 2.0.2 on Debian testing) that I need to have log to a
MySQL database in my office (also on Debian testing and MySQL is version
4.0.3).

The sensor needs to send the MySQL traffic over a hostile network (aka.
one I do not control), so I do not want the mysql traffic sent in the
clear.

I have MySQL 4.0.3 installed on the sensor (client, libraries, and
headers) and the database computer.  I enabled SSL (X.509 certificates)
on the MySQL server and I am able to get an encrypted connection back to
the database server using the command-line 'mysql' command.

When I tried to make this work with snort, it failed and I was not able
to login to the MySQL database (and snort rolls over and dies).

Does anyone have any ideas on how to make snort log to MySQL with SSL? 
I've tried recompiling snort with the MySQL libraries and includes from
4.0.3, but nothing seems to work.

Thanks in advance,

-dave

-- 
David DeCoster <decoster at ...10464...>





More information about the Snort-users mailing list