[Snort-users] Error Barnyard2.conf

AllowOverride allowoverride at ...11827...
Wed Oct 3 14:10:20 EDT 2012


already did drop/added user snort, first thing i did.

mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)

| Host      | User             | Password
| Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv |
Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv |
Grant_priv | References_priv | Index_priv | Alter_priv | Show_db_priv |
Super_priv | Create_tmp_table_priv | Lock_tables_priv | Execute_priv |
Repl_slave_priv | Repl_client_priv | Create_view_priv | Show_view_priv |
Create_routine_priv | Alter_routine_priv | Create_user_priv | Event_priv
| Trigger_priv | Create_tablespace_priv | ssl_type | ssl_cipher |
x509_issuer | x509_subject | max_questions | max_updates |
max_connections | max_user_connections | plugin | authentication_string
|

| localhost | snort | *hidden | N  | N | N | N  | N  | N | N | N
| N            | N         | N          | N               | N          |
N          | N            | N          | N                     | N
| N            | N               | N                | N                |
N              | N                   | N                  | N
| N          | N            | N                      |          |
|             |              |             0 |           0 |
0 |                    0 |        | NULL                  |

i have a script that is dropping and adding the user during each build.
mysql server is loaded with apt-get install but... it never reinstalls,
as reinstall cmd is never given, apt-get just passes over it, saying
it's already installed.

snort running on console mode captures packets and processes them
to /varlog/snort/snort.log

seems like it should work, but does not. 

i noticed one thing, select * from user; show 3 N's, which means it does
not match select * from db; 

here are the grants again, see if i am missing something:

mysql -u root -p
Enter password:

mysql> show grants;
+----------------------------------------------------------------------------------------------------------------------------------------+
| Grants for root at ...274...
|
+----------------------------------------------------------------------------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY
PASSWORD '*hidden' WITH GRANT OPTION |
| GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION
2 rows in set (0.00 sec)

and.....


 mysql -u snort -p
Enter password:

mysql> show grants;
+--------------------------------------------------------------------------------------------------------------+
| Grants for snort at ...274...
|
+--------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'snort'@'localhost' IDENTIFIED BY PASSWORD
'*FC79933FB414C20C63684278862B1C9B55EF2671' |
| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE ON `snort`.* TO
'snort'@'localhost'                             |
+--------------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)


thoughts suggestions?

thanks

On Wed, 2012-10-03 at 12:20 -0400, beenph wrote:
> You might want to try
> mysqladmin flush-privileges and or mysqladmin reload
> 
> Also check your mysql.user table and check the host portion of your user snort.
> 
> You also might want to just recreate your user and reassign the grant.
> 
> And make sure to flush--privileges/reload before testing :)
> 
> -elz
> 
> ------------------------------------------------------------------------------
> Don't let slow site performance ruin your business. Deploy New Relic APM
> Deploy New Relic app performance management and know exactly
> what is happening inside your Ruby, Python, PHP, Java, and .NET app
> Try New Relic at no cost today and get our sweet Data Nerd shirt too!
> http://p.sf.net/sfu/newrelic-dev2dev
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!





More information about the Snort-users mailing list