[Snort-users] Snort and MySQL

Patrick S. Harper patrick at ...4250...
Sun Aug 29 13:57:13 EDT 2004


Not if you have your conf file set up right.  The output database line has
that info.  



Patrick S. Harper | CISSP RHCT MCSE
www.internetsecurityguru.com

www.ntsug.org - Snort Users Group

"If there is no light at the end of the tunnel, get down there and light the
damn thing yourself!"
 
-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Miikka
Hattberg
Sent: Sunday, August 29, 2004 1:49 PM
To: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Snort and MySQL


I might be totally off, but shouldn't you specify the MySQL username in the
command whe you start snort.
like ' snort -u snort -c /etc/snort/snort.conf '

m.

Robert Spangler wrote:

>Hello,
>
>I seem to be having a problem setting up snort to use MySQL database.
>
>When I run 'snort -c /etc/snort/snort.conf'  I get the following:
>
>===================================================
>Running in IDS mode
>Log directory = /var/log/snort
>
>Initializing Network Interface eth0
>
>        --== Initializing Snort ==--
>Initializing Output Plugins!
>Decoding Ethernet on interface eth0
>Initializing Preprocessors!
>Initializing Plug-ins!
>Parsing Rules file /etc/snort/snort.conf
>
>+++++++++++++++++++++++++++++++++++++++++++++++++++
>Initializing rule chains...
>database: compiled support for ( MySQL )
>database: configured to use MySQL
>database:          user = snort
>database: database name = snort
>database:          host = localhost
>database:   sensor name = 192.168.1.100
>ERROR: database: MySQL_error: Access denied for user: 'snort at ...274...' 
>(Using
>password: NO)
>Fatal Error, Quitting..
>===================================================
>
>
>snort.conf has the following entry:
>
>===================================================
>output database: log, MySQL, user=snort, password=******** dbname=snort 
>host=localhost ===================================================
>
>
>MySQL was setup using this line for snort:
>
>===================================================
>grant INSERT,SELECT on root.* to snort at ...274...; SET PASSWORD FOR 
>snort at ...274...=PASSOWRD('********');
>grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort at ...274...; 
>grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort; 
>===================================================
>
>This was a step by step guide I had followed to set this up.  I'm 
>hoping someone might be able to see what I'm missing.  Thnx
>
>  
>



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise
J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list