[Précédent (date)] [Suivant (date)] [Précédent (sujet)] [Suivant (sujet)] [Index par date] [Index par sujet]

[Mandrake] http/mysql/snort/acid

Bonjour la liste,

CONTROLE D'INTRUSION
*********************

Je viens d'installer SNORT/ACID mais je n'ai rien dans les logs !!! (via
l'interface graphique d'ACID)

Procédure suivie
*****************

urpmi de 
- snort
- snort-mysql
- mysql
- apache

suivi de service mysql start

Puis, 
#mysql
#mysql>

mysql>create database snot_log;

mysql>create database snot_archive;

mysql>grant all privileges on snort_log.* to snort @localhost;

mysql>grant all privileges on snort_archive.* to snort;

mysql>set password for snort@localhost = password("snort");

mysql>quit

#mysql -u snort -psnort -h 127.0.0.1
snort_log</usr/share/doc/snort2.0.0/create_mysql

#mysql -u snort -psnort -h 127.0.0.1
snort_archive</usr/share/doc/snort2.0.0/create_mysql 


vi /etc/snort/snort.conf
modification de la ligne 

# See the README.database file for more information about configuring
# and using this plugin.
# output database: log, mysql, user=root password=test dbname=db
host=localhost

en

output database: log, mysql, user=snort password=snort dbname=snort_log
host=127.0.0.1


vi /etc/init.d/snortd
modifier 
daemon /usr/sbin/snort -u snort -g snort -d -D \
-i ${interface} -c /etc/snort/snort.conf


puis urpmi acid


vi /var/www/html/amin/acid/acid_conf.php
* This information can be gleaned from the Snort database
* output plugin configuration.
*/
$alert_dbname = "snort_log";
$alert_host = "127.0.0.1";
$alert_port = "";
$alert_user = "snort";
$alert_password = "snort";


/* Archive DB connection parameters */

$archive_dbname = "snort_archive";
$archive_host = "127.0.0.1";
$archive_port = "";
$archive_user = "snort";
$archive_password = "snort";

suivi de service httpd restart


ssh root@autre_serveur
#nmap mon_serveur_snort
OK

http://pompei.newton.fr/admin/acid/
RIEN DANS LES LOGS !!!

Des idèes ????


koro