Hack Security Pro.pdf - Index of

Configure snort so that it can store its results in the sql database. In the configuration file, add the rule:
output database:log,mysql,user=user_snort password=snort_pwd dbname=snort host=localhost
Then we can create the snort database.
mysql
>create database SNORT;
>use mysql;
>snort insert into user values('localhost', 'user_snort', password('snort_pwd'), 'Y', 'Y', 'Y', 'Y', 'Y', 'Y',
'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', '', '', '', '', 'Y', 'Y', 'Y');
>ALL PRIVILEGES ON SNORT.* TO user_snort@localhost IDENTIFIED BY 'snort_pwd' WITH
GRANT OPTION;
>flush privileges;
>use snort;
>Source create_mysql
All that needs to be done now is to configure ACID so that it displays the snort results. You can
download it at http://www.andrew.cmu.edu/user/rdanyliw/snort/snortacid.html. You will also need
adodb http://php.weblogs.com/adodb, and PHPlot http://www.phplot.com.
Then execute the following commands (make sure that /var/www is well and truly Apache's
DocumentRoot):
cd /var/www/
tar -xvzf acid*
tar -xvzf adodb*
tar -xvzf phplot*
Finally, in the /var/www/acid/acid_conf.php configuration file, fill in the following values:
$DBlib_path="../adodb";
$Chartlin_path="../phplot";
alert_dbname="snort"
alert_host="localhost"
alert_user="user_snort"
alert_password="snort_pwd"
You will then be able to see the results of the logs on http://serv/acid/.
The Hackademy DMP -183/209- SYSDREAM