Re: FW: Beginner Help...

["Patrick S. Harper - CISSP" <lists () internetsecurityguru com>]

That version has an omited line in it, the latest (as linked to in the top
of that doc) is located at
http://www.internetsecurityguru.com/documents/snort_acid_rh9.pdf

I try to keep it updated to the latest version of everything.  It has the
corect info in it.  I would love to get the newest version on the snort
site, a lot of people are not checking for upgrades to it before they start
the install.

Patrick S. Harper

----- Original Message ----- 
From: "Erek Adams" <erek () snort org>
To: <support () nps-dc org>
Cc: <snort-users () lists sourceforge net>
Sent: Friday, August 01, 2003 7:57 AM
Subject: Re: FW: [Snort-users] Beginner Help...


> On Thu, 31 Jul 2003 support () nps-dc org wrote:
>
> > I've set up 3 boxes in 10 days using that acid/rh9.0 howto (my first 3)-
and
> > each time the same thing happened to me.  Check your MySQL snort dbase,
and
> > the table called 'events'  if (after running Nessus/NMAP at your sensor)
the
> > table's empty, it's that snort isn't writing to the dbase. (this was the
> > case for me)
> >
> > I double checked everything to no avail (i did have a MySQL user named
> > snort who has/had INSERT rights like the howto said...)
> >
> > as a work-around:  in the snort.conf file, if i switch the mySQL user to
> > 'root' instead of 'snort'  and then snort can write to MySQL, and ACID
has
> > some data to display.
>
> You probably don't have the permissions set right for the user.  Make sure
> that the snort user has SELECT, INSERT, UPDATE and DELETE according to the
> chart here [1].
>
> > OT: -how big a security issue is this?
>
> Well....  If you want someone to be able to grep thru your snort.conf file
> and get his password to the DB, then it's not an issue.  :)  Just keep in
> mind that the root user usually has full rights to the DB.  One good
> SELECT and DELETE and all your data goes away...
>
> Cheers!
>
> -----
> Erek Adams
>
>    "When things get weird, the weird turn pro."   H.S. Thompson
>
>
> [1] http://acidlab.sourceforge.net/acid_config.html
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users