deathroat
Bonjour,
Voila mon probleme est le suivant:
je lance la commande: /usr/sbin/snort-plain -c /etc/snort/snort.conf
snort me retourne ça:
Rule application order: activation->dynamic->pass->drop->alert->log
Log directory = /var/log/snort
Verifying Preprocessor Configurations!
Warning: flowbits key 'BS.SSL.Server.Hello.Done' is set but not ever checked.
Warning: flowbits key 'BE.trojan' is set but not ever checked.
Warning: flowbits key 'SoberAuth' is set but not ever checked.
Warning: flowbits key 'irc.trojan' is set but not ever checked.
Warning: flowbits key 'BS.SSL.Client.Key' is set but not ever checked.
Warning: flowbits key 'trojan' is set but not ever checked.
Warning: flowbits key 'ssh.brute.attempt' is set but not ever checked.
Warning: flowbits key 'BS.SSL.Server.Hello' is set but not ever checked.
Warning: flowbits key 'BS.SSL.Server.Cert' is set but not ever checked.
53 out of 512 flowbits in use.
***
*** interface device lookup found: eth0
***
Initializing Network Interface eth0
Decoding Ethernet on interface eth0
database: compiled support for ( )
database: configured to use mysql
database: 'mysql' support is not compiled into this build of snort
ERROR: If this build of snort was obtained as a binary distribution (e.g., rpm,
or Windows), then check for alternate builds that contains the necessary
'mysql' support.
If this build of snort was compiled by you, then re-run the
the ./configure script using the '--with-mysql' switch.
For non-standard installations of a database, the '--with-mysql=DIR'
syntax may need to be used to specify the base directory of the DB install.
See the database documentation for cursory details (doc/README.database).
and the URL to the most recent database plugin documentation.
Fatal Error, Quitting..
J'ai deja entré les tables dans mySQL, et configurer le fichier de conf.
D'ou pourrai venir le probleme?
Merci beaucoup d'avance
Phasme
bonjour,
selon ton message d'erreur, il semblerait que le rpm de snort que tu as installé ne soit pas compilé avec le support mysql.
Il faut que tu installes la version du rpm de snort avec le support pour mysql qui est snort-mysql.
deathroat
Bienvu, j'avais installer snort et pas snort-mysql avec yum.
Merci beaucoup 😉
deathroat
Rebonjour j'ai un autre souci,
j'ai figurer snort correctement car j'ai 600 alertes dans BASE, cependant j'ai trop de regle ce qui fait planté la petite config de mon serveur.
j'ai voulu écrire mes propres regles afin de tester:
alert icmp any any -> any any (msg:"test"; sid:1234;)
snort se lance correctement cependant il devrait afficher des alertes sur BASE lorsque je le ping non? or je n'ai rien qui bouge.
Merci d'avance
