[Snort-users] mysql error prevails...

Jeremy Hoel jthoel at ...11827...
Thu Oct 4 23:49:44 EDT 2012


ok.. lets walk through this..  just in case we missed something, as a review.

you have mysql on the same box as the one that has barnyard2.

You log into mysql with root and password, use the snort db and issue
'grant all on snort.* to snort at ...274... identified by 'MYPASSWORD'; '
 flush privileges

then, in your barnyard2.conf file you have:
output database: log, mysql user=snort password=MYPASSWORD'
dbname=snort host=localhost

Also.. i had a case where i had a special character in a password and
it didn't work right.. so try a dumb simple password first just to
make sure that's not it either.

And then of course, mysql is running.

if all that is right and correct then maybe it's selinux?  check some
debug logs for mysql?  those really are the basic steps to take and it
really does work.. a lot of people use this software on a regular
basis, so it's something particular to your setup.. not with the
software.

On Thu, Oct 4, 2012 at 9:24 PM, AllowOverride <allowoverride at ...11827...> wrote:
> i dont think its my.cnf unless something is wrong here. i dont see it.
>
> [mysqld]
> #
> # * Basic Settings
> #
> user            = mysql
> pid-file        = /var/run/mysqld/mysqld.pid
> socket          = /var/run/mysqld/mysqld.sock
> port            = 3306
> basedir         = /usr
> datadir         = /var/lib/mysql
> tmpdir          = /tmp
> lc-messages-dir = /usr/share/mysql
> skip-external-locking
> #
> # Instead of skip-networking the default is now to listen only on
> # localhost which is more compatible and is not less secure.
> bind-address            = 127.0.0.1
>
>
> also.....
>
> i log into the box via ssh. i then start snort, barnyard2, and recently
> pulledpork.pl works fine, but access denied prevails for barnyard2..
>
> sighs...
>
>
>
> On Thu, 2012-10-04 at 21:16 -0400, Marcos Rodriguez wrote:
>>         grants are fine, ufw is off, hostname is jupiter, snort.conf
>>         is set to
>>         localhost, or anywhere else it is required in howtos, yet... i
>>         still get
>>         this cheesy error,,, anyone come across this before? and saw
>>         it was
>>         something not common?
>>
>>         mysql --version
>>         mysql  Ver 14.14 Distrib 5.5.24, for debian-linux-gnu (i686)
>>         using
>>         readline 6.2
>>
>>         mysqladmin --version
>>         mysqladmin  Ver 8.42 Distrib 5.5.24, for debian-linux-gnu on
>>         i686
>>
>>         sighs.....
>>
>>
>>
>> Hiya AO,
>>
>>
>> I may be off base, and may be repeating an earlier answer from an
>> earlier thread, but have you checked your my.cnf in /etc/mysql?   If
>> the hostname is set = to localhost, then remote mysql logins will not
>> be accepted, even though the port is listening.
>>
>>
>> marcos
>
>
> ------------------------------------------------------------------------------
> Don't let slow site performance ruin your business. Deploy New Relic APM
> Deploy New Relic app performance management and know exactly
> what is happening inside your Ruby, Python, PHP, Java, and .NET app
> Try New Relic at no cost today and get our sweet Data Nerd shirt too!
> http://p.sf.net/sfu/newrelic-dev2dev
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!




More information about the Snort-users mailing list