Re: [sentinix-list] Output database

You need to add or modify the current "snort" MySQL user. The "snort" user is 
actually "[email protected]" (i.e. only connections from localhost).  See some 
MySQL tutorial for how this works and how to change it.

	Michel

On Thursday 08 January 2004 16:19, M. Morgan wrote:
> Morning folks,
>  Well, the output plugin is configured correctly and now I'm getting the
> dreaded mysql database permissions error when I try and "push and reload"
> the plugin. ~~~~~~~~~~~~~~~~
> ERROR: database: mysql_error: Host '192.168.1.16' is not allowed to connect
> to this MySQL server Fatal Error, Quitting..
> database: compiled support for ( mysql )
> database: configured to use mysql
> database: user = snort
> database: password is set
> database: database name = snort
> database: host = 192.168.1.199
> database: port = 3306
> database: sensor name = Ren <sensor name>
> ~~~~~~~~~~~~~~~~~
> 192.168.1.199 is the sql server
> 192.168.1.16 is the remote sensor
> ~~~~~~~~~~~~~~~~~
>  I have webmin installed with the mysql plugin so I can manipulate the
> database permissions but frankly I dont know where to start and I've been
> "googling" with little success.  A mysql guru I'm not and if I screw it up
> I'll be reloading the box ;).
>
>  Any pointers?
>
> (this is doing great things for my self confidence I'll tell you!)
>
> Thanks,
> Michael
>
>
>
> -----Original Message-----
> From: "M. Morgan" <[email protected]>
> Sent: Jan 7, 2004 3:25 PM
> To: "Terkanian,Greg" <[email protected]>,
> 	"M. Morgan" <[email protected]>,
> 	The SENTINIX Mailing List <[email protected]>
> Subject: RE: [sentinix-list] Output database
>
> AH HA!
>
>  Thanks for the help guys (Greg and Michel). That was quite the frustrating
> experience (I have too many things going on at once).
>
> thanks,
> Mike
>
>
> -----Original Message-----
> From: "Terkanian, Greg" <[email protected]>
> Sent: Jan 7, 2004 2:10 PM
> To: "M. Morgan" <[email protected]>,
> 	The SENTINIX Mailing List <[email protected]>
> Subject: RE: [sentinix-list] Output database
>
> Mike,
> If you haven't found it yet, in snortcenter it's under resources, output
> plugins.
>
>
> -----Original Message-----
> From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> [mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
> Sent: Wednesday, January 07, 2004 10:37 AM
> To: The SENTINIX Mailing List; The SENTINIX Mailing List
> Subject: Re: [sentinix-list] Output database
>
>
> Michel,
>  Snortcenter allows you to configure the "agent" but not the "output
> plugin". You have to configure the output plugin to tell it where a remote
> database is if it's not on "localhost".
>
>  I get this from the Snortcenter documentation at:
> http://users.pandora.be/larc/documentation/chap1.html
>
> You can view the output path by opening snortcenter and going to:
> -sensor console
>  -view sensors
>   -sensor config
>    -view output plugins
>
> Am I correct in thinking that the line of text displayed there contains the
> path to the database? (localhost by default)
> "output database: alert, mysql, user=snort password=sentinix dbname=snort
> host=localhost port=3306 sensor_name=[AUTO]"
>
> The only option is to activate/deactivate the plugin.....
>
> Keep in mind that Im trying to get several remote sensors to log into a
> central mysql database server, I assume there is functionality for
> this....I would think that it has been done before...
>
>  If there is functionality in the SnortCenter GUI to do this that I'm
> missing please take the time to point it out. I really like doing things by
> the easiest method.
>
> Thanks,
> Michael
>
> -----Original Message-----
> From: Michel Blomgren <[email protected]>
> Sent: Jan 7, 2004 10:32 AM
> To: The SENTINIX Mailing List <[email protected]>
> Subject: Re: [sentinix-list] Output database
>
> Please read the SnortCenter documentation at:
> http://users.pandora.be/larc/documentation/
>
> You need to configure your SnortCenter Sensor Agent from the SnortCenter
> web-interface.  If you want to use SnortCenter, _DO NOT_ edit any
> snort.conf file by hand, _learn_ to use SnortCenter instead, it really is
> _extremely_ much simpler than editing snort.conf by hand!!!  That's why
> SnortCenter is in the distro!!!  You can also distribute the config to all
> other sensors you have out there, and each config can be sensor-specific -
> individually crufted!   It _is_ an admin's goldmine, but only if you
> actually use it!!!
>
> For SnortCenter Sensor Agent passwords and other Sensor-specific config,
> see it's config. Since I currently don't have sentinix compiled anywhere, I
> _think_ it's under /usr/local/snort/snortcenter/sensor/... not 100% sure
> though.
>
> 	Michel
>
> On Wednesday 07 January 2004 16:22, M. Morgan wrote:
> > Hmm that looks like it could be it. I've also been looking at the
> > /etc/snort/snort.conf file,
> >
> > <snip>
> > ####################################################################
> > # Step #3: Configure output plugins
> > #
> > # Uncomment and configure the output plugins you decide to use.
> > # General configuration for output plugins is of the form:
> > #
> > # output <name_of_plugin>: <configuration_options>
> > #
> > # alert_syslog: log alerts to syslog
> > # ----------------------------------
> > # Use one or more syslog facilities as arguments
> > #
> > # output alert_syslog: LOG_AUTH LOG_ALERT
> >
> > # log_tcpdump: log packets in binary tcpdump format
> > # -------------------------------------------------
> > # The only argument is the output file name.
> > #
> > # output log_tcpdump: tcpdump.log
> >
> > # database: log to a variety of databases
> > # ---------------------------------------
> > # See the README.database file for more information about configuring
> > # and using this plugin.
> > #
> > # output database: log, mysql, user=root password=test dbname=db
> > host=localhost # output database: alert, postgresql, user=snort
> > dbname=snort
> > # output database: log, unixodbc, user=snort dbname=snort
> > # output database: log, mssql, dbname=snort user=snort password=test
> > <snip>
> >
> > It looks like this line:
> > output database: log, mysql, user=root password=test dbname=db
> > host=localhost
> >
> > should read:
> >
> > output database: log, mysql, user=snort password=sentinix dbname=snort_db
> > host=192.168.x.x
> >
> > or something along those lines.
> >
> > I'm referencing this document config settings:
> > http://www.andrew.cmu.edu/~rdanyliw/snort/snortdb/snortdb_config.html
> >
> > Ill post back as this progresses.
> >
> > Thanks,
> > Michael
> >
> >
> > -----Original Message-----
> > From: "Terkanian, Greg" <[email protected]>
> > Sent: Jan 7, 2004 9:32 AM
> > To: "M. Morgan" <[email protected]>,
> > 	The SENTINIX Mailing List <[email protected]>
> > Subject: RE: [sentinix-list] Output database
> >
> > I think the file you're looking for is
> > /usr/local/snort/snortcenter/config.php
> >
> >
> > -----Original Message-----
> > From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> > [mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
> > Sent: Wednesday, January 07, 2004 7:56 AM
> > To: [email protected]
> > Subject: [sentinix-list] Output database
> >
> >
> > Hello all,
> >  I'm trying to configure a remote sensor to log into a database on a
> > seperate server.
> >
> >  Obviously I need to edit the output database config file but I cant seem
> > to find it.
> >
> > Anyone have a quick and dirty how-to or the path to the file?
> >
> > here is the default line from snortcenter:
> >
> > output database: alert, mysql, user=snort password=sentinix dbname=snort
> > host=localhost port=3306 sensor_name=[AUTO]
> >
> > I cant edit it in snort center though and need to reconfigure it to point
> > to a different server.
> >
> > Many thanks!
> >
> > Michael
> > _______________________________________________
> > SENTINIX mailing list
> > [email protected]
> > http://elevenprospect.com/mailman/listinfo/sentinix
> >
> > _______________________________________________
> > SENTINIX mailing list
> > [email protected]
> > http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix