Re: [sentinix-list] Output database

On Wednesday 07 January 2004 17:37, M. Morgan wrote:
> Michel,
>  Snortcenter allows you to configure the "agent" but not the "output
> plugin". You have to configure the output plugin to tell it where a remote
> database is if it's not on "localhost".

No, you _do_ configure the output plugins from within SnortCenter, you just 
haven't found it yet.  You can configure several output plugins even.  I 
added the MySQL database output plugin config _from_ SnortCenter when I 
included SnortCenter in the distro. :)

>
>  I get this from the Snortcenter documentation at:
> http://users.pandora.be/larc/documentation/chap1.html
>
> You can view the output path by opening snortcenter and going to:
> -sensor console
>  -view sensors
>   -sensor config
>    -view output plugins

Yes you can view it, you can also change it.  Unfortunatly, it's not in the 
same menu, and I don't remember where it was... _but_  it _is_ in there!  =)

>
> Am I correct in thinking that the line of text displayed there contains the
> path to the database? (localhost by default)
> "output database: alert, mysql, user=snort password=sentinix dbname=snort
> host=localhost port=3306 sensor_name=[AUTO]"
>
> The only option is to activate/deactivate the plugin.....

Adding/revoming output plugins is done from another menu. You can choose from 
several, different file formats, syslog, databases.

>
> Keep in mind that Im trying to get several remote sensors to log into a
> central mysql database server, I assume there is functionality for
> this....I would think that it has been done before...
>
>  If there is functionality in the SnortCenter GUI to do this that I'm
> missing please take the time to point it out. I really like doing things by
> the easiest method.
>
> Thanks,
> Michael
>
> -----Original Message-----
> From: Michel Blomgren <[email protected]>
> Sent: Jan 7, 2004 10:32 AM
> To: The SENTINIX Mailing List <[email protected]>
> Subject: Re: [sentinix-list] Output database
>
> Please read the SnortCenter documentation at:
> http://users.pandora.be/larc/documentation/
>
> You need to configure your SnortCenter Sensor Agent from the SnortCenter
> web-interface.  If you want to use SnortCenter, _DO NOT_ edit any
> snort.conf file by hand, _learn_ to use SnortCenter instead, it really is
> _extremely_ much simpler than editing snort.conf by hand!!!  That's why
> SnortCenter is in the distro!!!  You can also distribute the config to all
> other sensors you have out there, and each config can be sensor-specific -
> individually crufted!   It _is_ an admin's goldmine, but only if you
> actually use it!!!
>
> For SnortCenter Sensor Agent passwords and other Sensor-specific config,
> see it's config. Since I currently don't have sentinix compiled anywhere, I
> _think_ it's under /usr/local/snort/snortcenter/sensor/... not 100% sure
> though.
>
> 	Michel
>
> On Wednesday 07 January 2004 16:22, M. Morgan wrote:
> > Hmm that looks like it could be it. I've also been looking at the
> > /etc/snort/snort.conf file,
> >
> > <snip>
> > ####################################################################
> > # Step #3: Configure output plugins
> > #
> > # Uncomment and configure the output plugins you decide to use.
> > # General configuration for output plugins is of the form:
> > #
> > # output <name_of_plugin>: <configuration_options>
> > #
> > # alert_syslog: log alerts to syslog
> > # ----------------------------------
> > # Use one or more syslog facilities as arguments
> > #
> > # output alert_syslog: LOG_AUTH LOG_ALERT
> >
> > # log_tcpdump: log packets in binary tcpdump format
> > # -------------------------------------------------
> > # The only argument is the output file name.
> > #
> > # output log_tcpdump: tcpdump.log
> >
> > # database: log to a variety of databases
> > # ---------------------------------------
> > # See the README.database file for more information about configuring
> > # and using this plugin.
> > #
> > # output database: log, mysql, user=root password=test dbname=db
> > host=localhost # output database: alert, postgresql, user=snort
> > dbname=snort
> > # output database: log, unixodbc, user=snort dbname=snort
> > # output database: log, mssql, dbname=snort user=snort password=test
> > <snip>
> >
> > It looks like this line:
> > output database: log, mysql, user=root password=test dbname=db
> > host=localhost
> >
> > should read:
> >
> > output database: log, mysql, user=snort password=sentinix dbname=snort_db
> > host=192.168.x.x
> >
> > or something along those lines.
> >
> > I'm referencing this document config settings:
> > http://www.andrew.cmu.edu/~rdanyliw/snort/snortdb/snortdb_config.html
> >
> > Ill post back as this progresses.
> >
> > Thanks,
> > Michael
> >
> >
> > -----Original Message-----
> > From: "Terkanian, Greg" <[email protected]>
> > Sent: Jan 7, 2004 9:32 AM
> > To: "M. Morgan" <[email protected]>,
> > 	The SENTINIX Mailing List <[email protected]>
> > Subject: RE: [sentinix-list] Output database
> >
> > I think the file you're looking for is
> > /usr/local/snort/snortcenter/config.php
> >
> >
> > -----Original Message-----
> > From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> > [mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
> > Sent: Wednesday, January 07, 2004 7:56 AM
> > To: [email protected]
> > Subject: [sentinix-list] Output database
> >
> >
> > Hello all,
> >  I'm trying to configure a remote sensor to log into a database on a
> > seperate server.
> >
> >  Obviously I need to edit the output database config file but I cant seem
> > to find it.
> >
> > Anyone have a quick and dirty how-to or the path to the file?
> >
> > here is the default line from snortcenter:
> >
> > output database: alert, mysql, user=snort password=sentinix dbname=snort
> > host=localhost port=3306 sensor_name=[AUTO]
> >
> > I cant edit it in snort center though and need to reconfigure it to point
> > to a different server.
> >
> > Many thanks!
> >
> > Michael
> > _______________________________________________
> > SENTINIX mailing list
> > [email protected]
> > http://elevenprospect.com/mailman/listinfo/sentinix
> >
> > _______________________________________________
> > SENTINIX mailing list
> > [email protected]
> > http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix