Snort mailing list archives

Re: mysql error prevails...


From: AllowOverride <allowoverride () gmail com>
Date: Fri, 05 Oct 2012 02:58:38 -0700

i agree, it is something simple, and i have ran across pw issues before.
there are no special chars in mine currently, varchar, i reinstalled the
server, completley to rule out db corruption. i followed the step,
however, i did notice my script does change owners on ./configure, the
result is 1210:1210 as user/group. chmod fixes that. its something none
standard but simple for sure. i will address your suggestions more in
length, you gave me a few extra thoughts from them, thanks.

more to follow

On Thu, 2012-10-04 at 21:49 -0600, Jeremy Hoel wrote:
ok.. lets walk through this..  just in case we missed something, as a review.

you have mysql on the same box as the one that has barnyard2.

You log into mysql with root and password, use the snort db and issue
'grant all on snort.* to snort@localhost identified by 'MYPASSWORD'; '
 flush privileges

then, in your barnyard2.conf file you have:
output database: log, mysql user=snort password=MYPASSWORD'
dbname=snort host=localhost

Also.. i had a case where i had a special character in a password and
it didn't work right.. so try a dumb simple password first just to
make sure that's not it either.

And then of course, mysql is running.

if all that is right and correct then maybe it's selinux?  check some
debug logs for mysql?  those really are the basic steps to take and it
really does work.. a lot of people use this software on a regular
basis, so it's something particular to your setup.. not with the
software.

On Thu, Oct 4, 2012 at 9:24 PM, AllowOverride <allowoverride () gmail com> wrote:
i dont think its my.cnf unless something is wrong here. i dont see it.

[mysqld]
#
# * Basic Settings
#
user            = mysql
pid-file        = /var/run/mysqld/mysqld.pid
socket          = /var/run/mysqld/mysqld.sock
port            = 3306
basedir         = /usr
datadir         = /var/lib/mysql
tmpdir          = /tmp
lc-messages-dir = /usr/share/mysql
skip-external-locking
#
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
bind-address            = 127.0.0.1


also.....

i log into the box via ssh. i then start snort, barnyard2, and recently
pulledpork.pl works fine, but access denied prevails for barnyard2..

sighs...



On Thu, 2012-10-04 at 21:16 -0400, Marcos Rodriguez wrote:
        grants are fine, ufw is off, hostname is jupiter, snort.conf
        is set to
        localhost, or anywhere else it is required in howtos, yet... i
        still get
        this cheesy error,,, anyone come across this before? and saw
        it was
        something not common?

        mysql --version
        mysql  Ver 14.14 Distrib 5.5.24, for debian-linux-gnu (i686)
        using
        readline 6.2

        mysqladmin --version
        mysqladmin  Ver 8.42 Distrib 5.5.24, for debian-linux-gnu on
        i686

        sighs.....



Hiya AO,


I may be off base, and may be repeating an earlier answer from an
earlier thread, but have you checked your my.cnf in /etc/mysql?   If
the hostname is set = to localhost, then remote mysql logins will not
be accepted, even though the port is listening.


marcos


------------------------------------------------------------------------------
Don't let slow site performance ruin your business. Deploy New Relic APM
Deploy New Relic app performance management and know exactly
what is happening inside your Ruby, Python, PHP, Java, and .NET app
Try New Relic at no cost today and get our sweet Data Nerd shirt too!
http://p.sf.net/sfu/newrelic-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


------------------------------------------------------------------------------
Don't let slow site performance ruin your business. Deploy New Relic APM
Deploy New Relic app performance management and know exactly
what is happening inside your Ruby, Python, PHP, Java, and .NET app
Try New Relic at no cost today and get our sweet Data Nerd shirt too!
http://p.sf.net/sfu/newrelic-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


Current thread: