Snort and Basic Anaylsis and Security Engine 1.4.4 help!

[freeztar]

uh, well, you might want to :

install mysql server

make sure mysql server is started

and make sure whatever it is that is trowing this error, has all the proper credentials to connect to mysql :evil:

 

I installed mysql, but it will not start, giving the error above.

What do you mean by proper credentials? It gives me the same error as root, if that's what you mean.

[alexander]

that error makes no sense when you are starting the server, that is a client connect error...

 

lets try this again, when you start the service via.

 

sudo /etc/init.d/mysql start

 

what is the full output?

 

if that gives you that error, tail /var/log/messages and output it here, please...

[freeztar]

that error makes no sense when you are starting the server, that is a client connect error...

 

lets try this again, when you start the service via.

 

sudo /etc/init.d/mysql start

 

Well, that's probably the problem. mysql is not listed in that directory. I checked synaptic again to make sure and I do have mysql server 5.0 (and dependencies installed). So, I went to terminal and typed sudo apt-get install mysql-server and it downloaded and installed some stuff. So I guess it wasn't installed properly in Synaptic for whatever reason which is the second time this has happened to me. I'm growing ever fond of the command line.

 

So, I installed it fully, got mysql started via your instructions (why must the directory be specified? I kind of assumed that all file system directories were global paths.), and then I get this error when typing mysql

 

ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)

 

I remember editing a config file when I was setting this up originally, but I can't remember the name of the file. I suspect that is the problem?

[alexander]

because mysql is the name of the client, but the service is mysqld, the start/stop/status/reload scripts for services are located (in most distros) in /etc/init.d/ thus to start the service thy needs to issue /etc/init.d/mysqld start ;)

 

now as to you actually making a connection, did you follow the instructions when installing it and set a password? well easy enough to check

mysql -u root -p

 

try just enter for password (should log you into mysql shell)

 

then you can do

 

show databases;

 

then lets change your root password (db root)

 

use mysql;

update user set password=PASSWORD('your_new_pass_for_db_root') where user='root';

 

(should tell you that it updated 3 records)

 

you can verify by issuing

 

select * from user where user='root';

 

should return 3 rows, and the password will be a hash

 

now VERY IMPORTANTLY

 

flush privileges;

 

only after that you can

 

quit

 

and try

 

mysql -u root -p

 

password is the new password you set ;)

 

you dont need to be root to connect to the database... you might need to make database and user for whatever it is that will be using your mysql server...

[freeztar]

Thanks! That worked perfectly. ;)

[alexander]

no problemo, i set up 3 mysql servers, 2 in a master-master replication setup using a private lan to replicate, with custom kernels for each box, in the past month, lol ;) (amongst other things)

 

and i am compiling asterisk1.6 as i'm typing this, after having to tweak and recompile lua... Which reminds me, at what point does it seem like a bright idea to "accidentally" forget to put "-fPIC" into CFLAGS of a product the libraries of which are the reason you would install it...? Like seriously, i LOVE lua, but dammit i dont want to have to edit the Makefile to add -fPIC to CFLAGS...

[Theory5]

Theory, usually i use emacs to manage the configuration, and usually ACID for analysis...

Is there a tutorial or something for installing those? Im having no luck with base.

[Theory5]

ok so I got bored and tried to install SNORT, oinkmaster, and acid base through synaptic again, This is the exact error I got:

E: snort-mysql: subprocess post-installation script returned error exit status 6

and it crashes the installer.

googleing it doesnt really help me at all.

[alexander]

ok, how (exactly, command by command with output) are you installing it?

[Theory5]

ok, how (exactly, command by command with output) are you installing it?

 

That error was generated by installing it from synaptic, through the GUI portion. Just hilighting Mysql-snort and oink master and ACID base

[freeztar]

That error was generated by installing it from synaptic, through the GUI portion. Just hilighting Mysql-snort and oink master and ACID base

 

I get the exact same error when installing snort-mysql through synaptic.

I then tried installing it via command line and got the following output:

 

snort-mysql is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 0B of additional disk space will be used.
Setting up snort-mysql (2.7.0-22ubuntu1) ...
* Stopping Network Intrusion Detection System  snort                            
* No running snort instance found
* Starting Network Intrusion Detection System  snort                            
* /etc/snort/db-pending-config file found
* Snort will not start as its database is not yet configured.
* Please configure the database as described in
* /usr/share/doc/snort-{pgsql,mysql}/README-database.Debian
* and remove /etc/snort/db-pending-config
invoke-rc.d: initscript snort, action "start" failed.
dpkg: error processing snort-mysql (--configure):
subprocess post-installation script returned error exit status 6
Errors were encountered while processing:
snort-mysql
E: Sub-process /usr/bin/dpkg returned an error code (1)

[alexander]

well i think this is the first thing you need to look at:

It cant start snort because the database is not configured yet

 

so you need to look into this, and make sure snort can start

 

* Please configure the database as described in

* /usr/share/doc/snort-{pgsql,mysql}/README-database.Debian

 

btw the installer doesn't necessarily fail to "install" snort, but it fails in configuring it, but that is because snort can use pgsql or mysql for its config, so you need to configure snort to start :doh:

[Theory5]

Well It goes through something that should be the setup process. The first thing it asks is what is the range of my IP or something but its written funny I forget the name it has for the format but its like

Ex: 155.155.155.155/45

Im not familiar with the /* part at first I thought it was the end range of the IP but I had seen some that were like *.*.*.45/32 or something.

Then it asks if I want to setup mysql - snort and it asks a few other things and tells me to go to a local host address to configure ACID.

I will try this in my next class when I have my laptop out for notes.

Is that a generic error? Or does it mean something, I couldnt find anything while googling it.

[alexander]

you cant have 155.155.155.155/45, there are only 32 bits in a subnet mask... /32 is just a different ip subnet notation and /32 is the same as 255.255.255.255 subnet mask, similarly /24 is the same as 255.255.255.0 subnet mask and /18 as 255.255.192.0 subnet mask, mmm subnetting

 

here is a very basic howto:

 

How to Configure Snort | eHow.com

 

and a very in-depth one:

 

Using Snort: Part 1: Installation and configuration

 

but before all that, please study in detail:

IP Tutorial - Subnet Mask and Subnetting

 

its the backbone of networking, and any self-respecting computer person should know networking, at least as far as IPs and subnets go...

[Theory5]

you cant have 155.155.155.155/45, there are only 32 bits in a subnet mask... /32 is just a different ip subnet notation and /32 is the same as 255.255.255.255 subnet mask, similarly /24 is the same as 255.255.255.0 subnet mask and /18 as 255.255.192.0 subnet mask, mmm subnetting

 

here is a very basic howto:

 

How to Configure Snort | eHow.com

 

and a very in-depth one:

 

Using Snort: Part 1: Installation and configuration

 

but before all that, please study in detail:

IP Tutorial - Subnet Mask and Subnetting

 

its the backbone of networking, and any self-respecting computer person should know networking, at least as far as IPs and subnets go...

 

I am aware of IPs, subnet masks and networking. That was just an example with random numbers to show the format of the IP. I didnt know the format's name. I just punched in what came into my head. I was typing quickly because my class was about the start a quiz and i wanted to show you the setup I encountered. thanks for the links

 

 

ok so I followed everthing in /usr/share/doc/snort-mysql/README-database.debin

 

and ran it with /etc/init.d/snort start and it said it ran fine.

then I ran /etc/init.d/snort status to check on the status, and it said the daemon had failed. What do I do to fix this problem?

 

And the setup from synaptic said to configure acid lab (or base) to go to:

http://localhost/acidlab

but that doesnt go anywhere...