Re: Snort logging to encrypted MySQL (ssl) server?

[omi <omi () mcluhan org>]

On Tue, 4 Nov 2003, David DeCoster wrote:

Mysql-server (at least on debian) conmes configured by default to ignore
network trafic

in my.cnf you will have

--------
[mysqld]
skip-networking
-------


comment out skip-networking


hope this helps (although I haven't tried it with ssl)

best regards

Oleg Mitsura


> Hello all--
>
> I have a question that is driving me nuts.  I have a remote snort sensor
> (running ver. 2.0.2 on Debian testing) that I need to have log to a
> MySQL database in my office (also on Debian testing and MySQL is version
> 4.0.3).
>
> The sensor needs to send the MySQL traffic over a hostile network (aka.
> one I do not control), so I do not want the mysql traffic sent in the
> clear.
>
> I have MySQL 4.0.3 installed on the sensor (client, libraries, and
> headers) and the database computer.  I enabled SSL (X.509 certificates)
> on the MySQL server and I am able to get an encrypted connection back to
> the database server using the command-line 'mysql' command.
>
> When I tried to make this work with snort, it failed and I was not able
> to login to the MySQL database (and snort rolls over and dies).
>
> Does anyone have any ideas on how to make snort log to MySQL with SSL?
> I've tried recompiling snort with the MySQL libraries and includes from
> 4.0.3, but nothing seems to work.
>
> Thanks in advance,
>
> -dave
>
> --
> David DeCoster <decoster () cae wisc edu>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: SF.net Giveback Program.
> Does SourceForge.net help you be more productive?  Does it
> help you create better code?   SHARE THE LOVE, and help us help
> YOU!  Click Here: http://sourceforge.net/donate/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?   SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users