Topic: Snort and Acid

[Mark Baker]

When trying to start Snort:

[root@gateway init.d]# /usr/sbin/snort-mysql -d -i eth1 -c /etc/snort/snort.conf
Log directory = /var/log/snort

Initializing Network Interface eth1
Kernel filter, protocol ALL, raw packet socket

        --== Initializing Snort ==--
Decoding Ethernet on interface eth1
Initializing Preprocessors!
Initializing Plug-ins!
Initializating Output Plugins!
Parsing Rules file /etc/snort/snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
    Fragment timeout: 60 seconds
    Fragment memory cap: 4194304 bytes
Stream4 config:
    Stateful inspection: ACTIVE
    Session statistics: INACTIVE
    Session timeout: 30 seconds
    Session memory cap: 8388608 bytes
    State alerts: INACTIVE
    Scan alerts: ACTIVE
    Log Flushed Streams: INACTIVE
No arguments to stream4_reassemble, setting defaults:
     Reassemble client: ACTIVE
     Reassemble server: INACTIVE
     Reassemble ports: 21 23 25 53 80 143 110 111 513
     Reassembly alerts: ACTIVE
     Reassembly method: FAVOR_OLD
Back Orifice detection brute force: DISABLED
Using LOCAL time
database: compiled support for ( mysql )
database: configured to use mysql
database:          user = root
database: password is set
database: database name = snort_log
database:          host = localhost
database:   sensor name = 64.154.61.30
database: mysql_error: Access denied for user: 'root@localhost' (Using password: YES)
Fatal Error, Quitting..


What is the problem?  The database exists and I can see it from mysql.  The password in the config file for snort is correct.  What is my next step?

Thanks in advance
- Mark Baker

[Nathan Fowler]

Mark, try it again, I issued a GRANT statement against your mysql database using the values defined in your snort config.

NF

[Mark Baker]

Thanks Nathan.

Should it be doing this though?

[root@gateway bin]# /etc/rc.d/init.d/snortd status
snort is stopped
[root@gateway bin]# /etc/rc.d/init.d/snortd start
Starting snort:                                            [   OK   ]
[root@gateway bin]# /etc/rc.d/init.d/snortd status
snort is stopped
[root@gateway bin]# ps -edf | grep snort
root      7976     1 12 17:05 ?        00:00:00 /usr/sbin/snort-mysql -d -i eth1
root      7988 26095  0 17:05 pts/3    00:00:00 grep snort
[root@gateway bin]# /etc/rc.d/init.d/snortd status
snort is stopped
[root@gateway bin]#

[Mark Baker]

New Error - Thanks again Nathan for fixing the permissions in mysql.

Warning: stat failed for /opt/administration/acid/adodb/adodb.inc.php (errno=13 - Permission denied) in /opt/administration/acid/acid_db.inc on line 537


Error loading the DB Abstraction library: from "/opt/administration/acid/adodb/adodb.inc.php"

Check the DB abstraction library variable $DBlib_path in acid_conf.php