RE: Snort-MySQL problem

["Shawn Truax" <Shawn.Truax () mbs gov on ca>]

> From your previous emails I got the impression that your database is working but snort is not loading your conf file.

Make sure your conf file is located in this directory /etc/snort/ and is called "snort.conf"

Your previous snort.conf posting showed you using the output plug in for database and the line seems ok.  Mine looks 
like this if you want to compare:

output database: alert, mysql, user=snort password=XXXXXXX dbname=snort host=xxx.xxx.xxx.xxx port=3306 
sensor_name="name" detail=full

Shawn

> > > "Syed Zuhdi Syed Salim" <syzuhdi () penawargroup com> 10/07/03 10:05pm >>>
This is my /etc/init.d/snortd
How to make it log into database ?

#!/bin/sh
#
# Init file for Snort - An Open Source network intrusion detection system.
#
# Written by Dag Wieers <dag () wieers com>.
#
# chkconfig: 2345 40 60
# description:  snort is a lightweight network intrusion detection system \
#               that currently detects more than 1100 host and network \
#        vulnerabilities, portscans, backdoors, and more.
#
# processname: snort
# config: /etc/sysconfig/snort
# config: /etc/snort/snort.conf
# pidfile: /var/lock/subsys/snort.pid

source /etc/rc.d/init.d/functions
source /etc/sysconfig/network

### Check that networking is up.
[ "${NETWORKING}" == "no" ] && exit 0

[ -x /usr/sbin/snort ] || exit 1
[ -r /etc/snort/snort.conf ] || exit 1
[ -r /etc/sysconfig/snort ] || exit 1

### Default variables
SYSCONFIG="/etc/sysconfig/snort"
OPTIONS="-s -d"
INTERFACE="eth0"
USER="snort"

### Read configuration
[ -r "$SYSCONFIG" ] && source "$SYSCONFIG"

RETVAL=0
prog="snort"
desc="Intrusion Detection System"

start() {
    echo -n $"Starting $desc ($prog): "
    cd /var/log/snort
    daemon $prog -u $USER -g $USER -D \
    -i $INTERFACE -l /var/log/snort -c /etc/snort/snort.conf $OPTIONS
    RETVAL=$?
    echo
    [ $RETVAL -eq 0 ] && touch /var/lock/subsys/$prog
    return $RETVAL
}

stop() {
    echo -n $"Shutting down $desc ($prog): "
    killproc $prog
    RETVAL=$?
    echo
    [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$prog
    return $RETVAL
}

restart() {
    stop
    start
}

case "$1" in
  start)
    start
    ;;
  stop)
    stop
    ;;
  restart)
    restart
    ;;
  reload)
    echo -n $"Reloading $prog: "
    killproc $prog -HUP
    RETVAL=$?
    echo
    ;;
  condrestart)
    [ -e /var/lock/subsys/$prog ] && restart
    RETVAL=$?
    ;;
  status)
    status $prog
    RETVAL=$?
    ;;
  dump)
    echo -n $"Dumping $prog database to syslog: "
    killproc $prog -USR1
    RETVAL=$?
    echo
    ;;

  *)
    echo $"Usage: $0 {start|stop|restart|reload|condrestart|status|dump}"
    RETVAL=1
esac

exit $RETVAL










Quoting Shawn Truax <Shawn.Truax () mbs gov on ca>:

> Yes the snort.conf is read only once when Snort is initially loaded.  If your
> snort is set to run when the server is first turned on or after a  reboot and
> it doesn't load your custom snort.conf file.  Check in the /etc/init.d/
> folder for a file with the name of snort in it.  This is the area where all
> the start scripts are located.  Make a backup of the file (if there is one)
> and then edit the original and see if there is a line in it that specifies
> the snort.conf to load.  You may have to do some poking around in this file
> or post it here for some help.  If you don't have a file in the folder for
> snort then I am not sure how snort is loading automatically.
>
> If I have read wrong and want your snort to run auto on reboot then you need
> to create a file with your snort start up line in it and link it to your run
> levels.  This is another area I am a little weak on and would be best for you
> to read some or get some help from someone a little more knowledgeable in
> this area.
>
> Best advice is to backup any file you are going to play with.
>
> Shawn
>
> > > > <CMartin () infosol com> 10/02/03 10:12am >>>
> It is my understanding that the snort.conf file is only read when the
> program loads.  The snort.conf file basically tells the program how to
> configure itself when it is loaded into memory.  Such as whether to log to
> the database or to a certain file type, as well as what processors to use.
> This file is read once and not referred to again while snort is running.
>
>
> Chris
>
> P.s. If anyone knows if I'm wrong in making this assumption about snort.conf
> please let me know :)  I don't fear mistakes, but embrace them :P
>
> -----Original Message-----
> From: Syed Zuhdi Syed Salim [mailto:syzuhdi () penawargroup com] 
> Sent: Wednesday, October 01, 2003 6:37 PM
> To: CMartin () infosol com
> Subject: RE: [Snort-users] Snort-MySQL problem
>
> It's work !!!
> Another question from me:
> My Snort is automatic running,but why it doesn't read snort.conf file?
>
>
> Quoting CMartin () infosol com:
>
> > It would appear that you are running snort in Test mode.  I noticed you
> used
> > the -T option in the command line.  This tells snort to test the config
> file
> > and then exit.  So just remove the -T and you will be all set.
> >
> >
> > Chris
> >
> > -----Original Message-----
> > From: Syed Zuhdi Syed Salim [mailto:syzuhdi () penawargroup com] 
> > Sent: Tuesday, September 30, 2003 7:31 PM
> > To: snort-users () lists sourceforge net
> > Subject: [Snort-users] Snort-MySQL problem
> >
> > Hi,
> >
> > Snort doesn't log into MySQL database. How to solve this problem???
> > This the output when I running command : 
> >
> > [root@medinetserver bin]# snort -c /etc/snort/snort.conf -i eth0 -T
> > Running in IDS mode
> > Log directory = /var/log/snort
> >  
> > Initializing Network Interface eth0
> >  
> >         --== Initializing Snort ==--
> > Initializing Output Plugins!
> > Decoding Ethernet on interface eth0
> > Initializing Preprocessors!
> > Initializing Plug-ins!
> > Parsing Rules file /etc/snort/snort.conf
> >  
> > +++++++++++++++++++++++++++++++++++++++++++++++++++
> > Initializing rule chains...
> > No arguments to frag2 directive, setting defaults to:
> >     Fragment timeout: 60 seconds
> >     Fragment memory cap: 4194304 bytes
> >     Fragment min_ttl:   0
> >     Fragment ttl_limit: 5
> >     Fragment Problems: 0
> >     Self preservation threshold: 500
> >     Self preservation period: 90
> >     Suspend threshold: 1000
> >     Suspend period: 30
> > Stream4 config:
> >     Stateful inspection: ACTIVE
> >     Session statistics: INACTIVE
> >     Session timeout: 30 seconds
> >     Session memory cap: 8388608 bytes
> >     State alerts: INACTIVE
> >     Evasion alerts: INACTIVE
> >     Scan alerts: ACTIVE
> >     Log Flushed Streams: INACTIVE
> >     MinTTL: 1
> >     TTL Limit: 5
> >     Async Link: 0
> >     State Protection: 0
> >     Self preservation threshold: 50
> >     Self preservation period: 90
> >     Suspend threshold: 200
> >     Suspend period: 30
> > Stream4_reassemble config:
> >     Server reassembly: INACTIVE
> >     Client reassembly: ACTIVE
> >     Reassembler alerts: ACTIVE
> >     Ports: 21 23 25 53 80 110 111 143 513 1433
> >     Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
> > http_decode arguments:
> >     Unicode decoding
> >     IIS alternate Unicode decoding
> >     IIS double encoding vuln
> >     Flip backslash to slash
> >     Include additional whitespace separators
> >     Ports to decode http on: 80
> > rpc_decode arguments:
> >     Ports to decode RPC on: 111 32771
> >     alert_fragments: INACTIVE
> >     alert_large_fragments: ACTIVE
> >     alert_incomplete: ACTIVE
> >     alert_multiple_requests: ACTIVE
> > telnet_decode arguments:
> >     Ports to decode telnet on: 21 23 25 119
> > database: compiled support for ( mysql )
> > database: configured to use mysql
> > database:          user = snort
> > database: password is set
> > database: database name = snort
> > database:          host = localhost
> > database:   sensor name = 192.168.0.3
> > database:     sensor id = 1
> > database: schema version = 106
> > database: using the "log" facility
> > 1454 Snort rules read...
> > 1454 Option Chains linked into 146 Chain Headers
> > 0 Dynamic rules
> > +++++++++++++++++++++++++++++++++++++++++++++++++++
> >  
> > Rule application order: ->activation->dynamic->alert->pass->log
> >  
> >         --== Initialization Complete ==--
> >  
> > -*> Snort! <*-
> > Version 2.0.1 (Build 88)
> > By Martin Roesch (roesch () sourcefire com, www.snort.org)
> >  
> > Snort sucessfully loaded all rules and checked all rule chains!
> > database: Closing connection to database "snort"
> > Snort exiting
> > [root@medinetserver bin]#
> >
> >
> >
> > -------------------------------------------------------
> > This sf.net email is sponsored by:ThinkGeek
> > Welcome to geek heaven.
> > http://thinkgeek.com/sf
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> dnAYMPDP
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



dnAYMPDP