<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=unicode" /> <meta http-equiv="Content-Language" content="en-us" /> <title>Setting up MySQL database on Windows XP Pro for Snort logging</title> <style> <!-- p.MsoNormal {margin-top:0mm; margin-right:0mm; margin-bottom:10.0pt; margin-left:0mm; line-height:115%; font-size:12.0pt; font-family:"Times New Roman","serif";} a:link {color:blue; text-decoration:underline;} a:visited {color:purple; text-decoration:underline;} p {margin-right:0mm; margin-left:0mm; font-size:12.0pt; font-family:"Times New Roman","serif";} ol {margin-bottom:0mm;} h1 {margin-top:12.0pt; margin-right:0mm; margin-bottom:3.0pt; margin-left:0mm; page-break-after:avoid; font-size:16.0pt; font-family:Arial;} --> </style> <meta name="keywords" content="IDS, data, database, data recovery, exploits, technology, system, applications, open source, logging, tutorials, downloads" /> <meta name="description" content="Tutorial on install, setup and configure MySQL database on Windows for Snort IDS/IPS packet logging" /> </head> <body lang="EN-US" link="#0000FF" vlink="#800080" topmargin="20" leftmargin="20" rightmargin="20" bottommargin="20"> <div class="WordSection1"> <h1 align="center" style="margin-top: 0; margin-bottom: 0"> <span style="font-weight: 400"><font size="4">&lt; <span style="text-decoration: none"><font color="#000000"> <a title="Testing Snort on Windows XP Pro SP2" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb7.html"> Testing Snort on Windows XP&nbsp; Pro SP2</a></font></span> | <a title="Java and open source - information, tutorials, install, setup, configure" target="_top" href="http://www.javaguicodexample.com/"> Java &amp; Friends</a>&nbsp; | <span style="text-decoration: none"> <font color="#000000"> <a title="Testing the New Snort Configuration" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb9.html"> Testing the New Snort Configuration</a></font></span> &gt;</font></span></h1> <hr noshade="" color="#FF3300" /> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <h1 align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><span style="font-weight: 400"><font face="Arial" size="6">Snort</font></span><b><font size="6" face="Arial"><span style="line-height:115%;font-weight:400"> and MySQL Database</span></font></b></h1> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font face="Arial">What do we have in this session?</font></b></p> <ol> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Snort and MySQL Database</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Creating Snort Databases</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Creating Snort s User Accounts</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Creating Table for Snort in mysnort and archive Databases</font></span></h1> </li> <li> <h1 style="margin-bottom:0mm;margin-bottom:0; margin-top:0"> <span style="font-weight: 400"><font size="3" face="Arial">Snort and MySQL Logging</font></span></h1> </li> </ol> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; /* 728x90, created 5/16/08 javaos */ google_ad_slot = "1917524460"; google_ad_width = 728; google_ad_height = 90; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Snort and MySQL Database</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Install MySQL on Windows XP Pro using the steps shown at: <a href="http://www.javaguicodexample.com/" target="_blank" title="MySQL and Windows XP Pro SP2 install, setup and configure"> MySQL and Windows XP Pro SP2</a>. Launch MySQL Command Line Client (console).</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="692" height="122" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp127.png" alt="Launching mysql command prompt" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Key-in the root password and show any databases available by issuing the following command:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;show databases;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="573" height="331" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp128.png" alt="Running mysql show databases command" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> If you are planning to setup Snort and MySQL database for the production environment, make sure all the security aspects are tightened. The following basic steps show how to clean-up the database for security aspects. At the prompt, type the following and then press the Enter key:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;use mysql;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> This command puts you in the database called </span></font><b> <font face="Courier New"> <span style="font-family:&quot;Arial&quot;;font-weight:bold">mysql</span></font></b><font face="Arial">. Then, get rid of any host entries, like this:</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;delete from user where host = &quot;%&quot;;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Next, delete other user accounts, like this:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;delete from user where user = &quot;&quot;;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Then, make sure the root account is the only user account here, like this:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;select * from user;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> This command displays user information. You should only see root as a user. Delete the test database (if any) by typing the following:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;drop database test;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Ensure that only the mysql database exists by typing the following command:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;show databases;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> The following should appear:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">+----------+</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">| Database |</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">+----------+</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">| mysql&nbsp;&nbsp;&nbsp; |</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">+----------+</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">1 row in set (0.00 sec)</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font face="Arial">Well</font><font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">, you re ready to create your Snort databases.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Creating Snort Databases</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> At the </span></font><font face="Courier New"> <span style="font-family:&quot;Arial&quot;">mysql&gt;</span></font><font face="Arial"> prompt, type the following commands and press the Enter key after each one. In this case we create two databases: </font><font face="Courier New"> <span style="font-family:&quot;Arial&quot;">mysnort</span></font><font face="Arial"> and </font><font face="Courier New"> <span style="font-family:&quot;Arial&quot;">archive</span></font><font face="Arial">.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;create database mysnort;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;create database archive;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> When you execute a </span></font><font face="Courier New"> <span style="font-family: &quot;Arial&quot;">show databases;</span></font><font face="Arial"> command, now you should see something like in the following screenshot.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;show databases;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="493" height="319" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp129.png" alt="Showing database mysql command" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Creating Snort s User Accounts</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> With the Snort databases in place, set up the user accounts that Snort will use when it logs in to add data to its databases. As an example, the following steps are walking through on how to setup the </span></font> <font face="Courier New"><span style="font-family:&quot;Arial&quot;">setangedik</span></font><font face="Arial"> user account. Create a user account with password by issuing the following SQL statement:</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;CREATE USER 'setangedik'@'localhost' IDENTIFIED BY '134@Atu4aR';</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="605" height="127" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp130.png" alt="Creating mysql user with password" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Remember that MySQL users consist of a user name and a hostname.&nbsp; From each host that a connection to the database will be made, there must be a corresponding user/hostname entry.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Next, at the </span></font><font face="Courier New"> <span style="font-family:&quot;Arial&quot;">mysql&gt;</span></font><font face="Arial"> prompt, type the following and press Enter after each line. This command will give the </font><font face="Courier New"> <span style="font-family:&quot;Arial&quot;">setangedik</span></font><font face="Arial"> user privileges and rights on mysnort database:</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;GRANT INSERT,SELECT,UPDATE on mysnort.* to setangedik@localhost IDENTIFIED by &quot;134@Atu4aR&quot;;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="653" height="151" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp131.png" alt="granting mySQL user privileges and rights" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Then issue the following command for </span></font><font face="Courier New"> <span style="font-family:&quot;Arial&quot;">archive</span></font><font face="Arial"> database.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;GRANT INSERT,SELECT,UPDATE on archive.* to setangedik@localhost IDENTIFIED by &quot;134@Atu4aR&quot;;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="797" height="146" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp132.png" alt="Granting mysql user privileges and rights look fine" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Verify the setangedik user s permissions by issuing the following command:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;SHOW GRANTS for setangedik@localhost;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"> <!-- google_ad_client = "pub-8089415323104206"; /* 300x250, created 5/16/08javaos */ google_ad_slot = "8146009330"; google_ad_width = 300; google_ad_height = 250; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <font face="Arial">---------------------------------------------------------</font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="661" height="355" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp133.png" alt="Showing mysql users privileges and rights" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> MySQL displays the </span></font><font face="Courier New"> <span style="font-family: &quot;Arial&quot;">setangedik</span></font><font face="Arial"> user s permissions, which should match those you gave the </font><font face="Courier New"> <span style="font-family:&quot;Arial&quot;">setangedik</span></font><font face="Arial"> user account when you created it. If you made a mistake, go back and repeat the steps on the snort user account s permission. The snort user account must be allowed to do its task, otherwise nothing will work.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Creating Table for Snort in </span></font> <font face="Courier New"> <span style="font-family:&quot;Arial&quot;;font-weight:bold">mysnort</span></font><font face="Arial"> and </font><font face="Courier New"> <span style="font-family:&quot;Arial&quot;; font-weight:bold">archive</span></font><font face="Arial"> Databases</font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Together with snort installation, we have been provided with MySQL scripts to create tables. The SQL scripts are in </span></font><b> <font face="Courier New"> <span style="font-family:&quot;Arial&quot;;font-weight:bold">%Snort%\schemas</span></font></b><font face="Arial"> subfolder.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="541" height="307" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp134.png" alt="The Snort create_mysql SQL template script for creating tables" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Next, let create those tables. Issue the following command at mysql prompt. Change the path accordingly if yours are different.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt; USE mysnort;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt; SOURCE c:\snort\schemas\create_mysql</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> There are many tables created from the create_mysql SQL script as shown in the following screenshot.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="533" height="784" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp135.png" alt="Creating mysnort tables using readily available SQL script" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> If you have installed <a href="http://wb.mysql.com/" target="_blank" title="MySQL Workbench GUI interface"> MySQL Workbench</a>, you can view those tables visually.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="459" height="122" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp136.png" alt="Invoking MySQL Administrator GUI interface (MySQL workbench)" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="780" height="581" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp137.png" alt="Viewing MySQL Tables using MySQL Administrator GUI interface (mySQL workbench)" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> However you can also view those tables by issuing the following command at mysql command prompt.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;use mysnort;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt;show tables;</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="341" height="364" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp138.png" alt="Running show tables mysql command" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Next, create the same tables for </span></font><font face="Courier New"> <span style="font-family:&quot;Arial&quot;">archive</span></font><font face="Arial"> database using the same SQL script. Change the path accordingly if yours are different.</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt; USE archive;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"> <span style="font-size:12.0pt;line-height:115%; ">mysql&gt; SOURCE c:\snort\schemas\create_mysql</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="3" face="Arial"> <span style="font-size: 12.0pt;line-height:115%"> <img border="0" width="413" height="679" src="snortiisphpbaseperladodb_files/snortmysqlphperliisoinkmasterwinxp139.png" alt="Creating tables for archive database that will be used by Snort" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"><b> <font size="3" face="Arial"> <span style="font-size:12.0pt;line-height:115%; font-weight:bold">Snort and MySQL Logging</span></font></b></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> Now we are going to edit snort.conf file so that Snort can connect and store data in MySQL. Open snort.conf and change the following settings:</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"># database</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"># output database: alert, &lt;db_type&gt;, user=&lt;username&gt; password=&lt;password&gt; test dbname=&lt;name&gt; host=&lt;hostname&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"># output database: log, &lt;db_type&gt;, user=&lt;username&gt; password=&lt;password&gt; test dbname=&lt;name&gt; host=&lt;hostname&gt;</font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> To</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"># database</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"># output database: alert, &lt;db_type&gt;, user=&lt;username&gt; password=&lt;password&gt; test dbname=&lt;name&gt; host=&lt;hostname&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"># output database: log, &lt;db_type&gt;, user=&lt;username&gt; password=&lt;password&gt; test dbname=&lt;name&gt; host=&lt;hostname&gt;</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New">output database: alert, mysql, user=setangedik password=134@Atu4aR dbname=mysnort host=localhost</font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Courier New"><span style="line-height:115%; ">output database: log, mysql, user=setangedik password=134@Atu4aR dbname=mysnort host=localhost</span></font></p> </blockquote> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> <font size="3" face="Arial"><span style="font-size:12.0pt;line-height:115%"> We set for logging and alert. Actually, both log and alert should provide same information with log provides the details and alert provides summary. Save and close snort.conf file.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;<div align="center"><script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=728X90&cwpid=527221&cwwidth=728&cwheight=90&cwpnet=1&cwtagid=85440"></script></div> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt"> &nbsp;</p> <p style="margin:0mm;margin-bottom:.0001pt">&nbsp;</p> <hr noshade="" color="#FF3300" /> <p class="MsoNormal" style="margin-top: 0; margin-bottom: 0" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "3545464564"; google_ad_width = 728; google_ad_height = 15; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <h1 align="center" style="margin-top: 0; margin-bottom: 0"> <span style="font-weight: 400"><font size="4">&lt; <span style="text-decoration: none"><font color="#000000"> <a title="Testing Snort on Windows XP Pro SP2" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb7.html"> Testing Snort on Windows XP&nbsp; Pro SP2</a></font></span> | <a title="Java and open source - information, tutorials, install, setup, configure" target="_top" href="http://www.javaguicodexample.com/"> Java &amp; Friends</a>&nbsp; | <span style="text-decoration: none"> <font color="#000000"> <a title="Testing the New Snort Configuration" target="_top" style="color: blue; text-decoration: none" href="http://www.javaguicodexample.com/snortiisphpbaseperladodb9.html"> Testing the New Snort Configuration</a></font></span> &gt;</font></span></h1> </div> </body> </html>