COMPLETE guide to Snort, MySQL, and BASE

jhybinette · n00b Joined: 30 Mar 2006 Posts: 1

I though if you are going to use the hardened flag, you have to build a hardened system first. like setting the flags using ufed

hardened erandom pic

then reemerge gcc and glibc
then emerge -e world
then rebuild the kernel and enable pax etc etc etc

If you dont do this the hardened flag may back fire on you

Johan

Khan · Tux's lil' helper Joined: 19 Feb 2003 Posts: 96

Trying this only resulted in blocks due to mod_php and php. And using "pear install Log" only produces the following error: PEAR_Remote: authorization required, please log in first

Does anyone have any idea how to get the Pear modules installed so that I can generate graphing? Thanks.

atmat · n00b Joined: 23 Aug 2005 Posts: 7

when I start snort I get this weird error

Apr 11 19:26:22 [snort] FATAL ERROR: unknown preprocessor "http_decode"_

I did not look at the docs yet. No time, anyone knows what's this http_decode" thing? Sorry for asking no time to look around google

I'll be on line again tonight.. if someone posts here the answer ok, otherwise I'll take a deeper look at snort.

thnx and sorry for the quick post.

bye

blackcell · n00b Joined: 17 Aug 2002 Posts: 56 Location: Oregon

use http_inspect instead of http_decode
_________________
"If the automobile had followed the same development cycle as the computer, a Rolls-Royce would today cost $100, get a million miles per gallon, and explode once a year, killing everyone inside."

carpman · Posted: Thu Apr 13, 2006 2:14 pm Post subject:

Hello, ok going to go ahead and try this using following package.use

wschalk · n00b Joined: 30 Jan 2005 Posts: 38

Hi,

I am trying to install BASE on PHP5 but here's the error message I am getting:

# emerge -vp net-analyzer/base

These are the packages that I would merge, in order:

Calculating dependencies \
!!! All ebuilds that could satisfy ">=dev-php4/jpgraph-1.19" have been masked.
!!! One of the following masked packages is required to complete your request:
- dev-php4/jpgraph-1.20.2 (masked by: ~x86 keyword)
- dev-php4/jpgraph-1.19 (masked by: ~x86 keyword)

For more information, see MASKED PACKAGES section in the emerge man page or
refer to the Gentoo Handbook.
!!! (dependency required by "net-analyzer/base-1.2.4" [ebuild])

So my problem is if I unmask jpgraph in dev-php4 he wants to install PHP4 which I don't use. Any ideas how to
stick with PHP5 but install BASE successfully?

Thank you.

Best regards,
Werner

carpman · Posted: Tue Apr 25, 2006 10:27 am Post subject: Re: Base with PHP5?

emily87 · n00b Joined: 25 Apr 2006 Posts: 3

Great how-to

Thnak you

_________________
yourPenpals.net - Make new friends!
yourPenpals.net - Links directory

wschalk · n00b Joined: 30 Jan 2005 Posts: 38

Hi,

thanks for the instructions on base and PHP5. When I try to install it on my system I get the following
error message during the installation of PEAR_Image_Color:

>>> Install PEAR-Image_Color-1.0.2 into /var/tmp/portage/PEAR-Image_Color-1.0.2/image/ category dev-php
/usr/portage/eclass/php-pear-r1.eclass: line 68: pear: command not found

!!! ERROR: dev-php/PEAR-Image_Color-1.0.2 failed.
!!! Function php-pear-r1_src_install, Line 68, Exitcode 127
!!! Unable to install PEAR package
!!! If you need support, post the topmost build error, NOT this status message.

In which package is the "pear" command?

Cheers,
Werner.

iverasp · n00b Joined: 11 Oct 2004 Posts: 58

I cant seem to get remote logging working. The plan is to use my linux router as the snort host, and my main server as the web- and mysqlserver. Been working on it for a while now. First snort complained about missing libmysqlclient* libraries, so I finally had to emerge mysql on the router. Then I had to change the my.cnf on the main server to allow other IPs to connect to the mysqlserver. Then the authentication method was outdated or something on the router, so I had to figure that out. Now I can connect with mysql -h 192.168.1.40 -u snort -p and get access to the remote mysqlserver, but snort still wont work. Heres the line I changed in snort.conf:

output database: log, mysql, user=snort password=secretpass dbname=snort host=192.168.1.40

When running /etc/init.d/snort start it says [ OK ], but the program doesnt run. When doing snort -i eth0 -c /etc/snort/snort.conf I get the following:

(..lots of text..)
X-Link2State Config:
Ports: 25 691
database: compiled support for ( mysql )
database: configured to use mysql
database: user = snort
database: password is set
database: database name = snort
database: host = 192.168.1.40
database: sensor name = 192.168.1.1
Illegal instruction

mysql is running on the default port btw.

Does anyone have a clue of what needs to be fixed?
Thanks

phoric · n00b Joined: 07 Mar 2004 Posts: 54 Location: Seattle, WA

I used this guide but am getting the following error when trying to access http://localhost/base ...

phoric · n00b Joined: 07 Mar 2004 Posts: 54 Location: Seattle, WA

The tutorial must be a little out of date now, as I am using base 1.2.5. I solved my own problem by browsing to:

http://localhost/base/setup/

This loaded a setup wizard of sorts, that will create the necessary tables for you. After that BASE seems to be working now for me. Probably should add this to the tutorial.
_________________
phoric

kare · Posted: Fri Jun 30, 2006 7:26 am Post subject:

My snort database becomes very big. Is there a script to delete old records?

echo6 · Guru Joined: 04 Jan 2003 Posts: 587

This howto is getting dated, there is a Wiki which may be of assistance http://gentoo-wiki.com/HOWTO_Apache2_with_BASE

kernelOfTruth · Posted: Sun Dec 16, 2007 9:24 pm Post subject:

[ToXiC] · n00b Joined: 29 Jul 2003 Posts: 46 Location: Fresno, CA

This post has been quiet for a while but for anyone still out there reading this:

When I started base and then went to configure the backend I got this message:

"Fatal error: Call to undefined function session_start() in /var/www/localhost/htdocs/base/base_conf.php on line 20"

Anyone?

sLumpia · Posted: Wed May 28, 2008 6:00 am Post subject:

^have you try to enable session USE flag for dev-lang/php?
_________________
I love it

guinness.stout · Posted: Mon Dec 29, 2008 4:22 pm Post subject:

Just wanted to add an update for those trying to follow this howto today.

yoosty69 · n00b Joined: 03 Jan 2004 Posts: 35

Another update for those interested in setting this up..
I just installed snort-2.8.3.1 (needs to be unmasked) and base-1.4.1 and it seems to be working fine. A few notes about USE flags for the packages:
*) snort-2.8.3.1 doesn't like having ipv6 enabled
*) snort-2.8.3.1 has a USE flag for dynamic plugins
*) base-1.4.1 uses the ctype functions from php for graphing, so php should have the ctype USE flag enabled

Here's the relevant part of my /etc/make.conf (I doubt kerberos is strictly necessary):

indica · n00b Joined: 21 Nov 2004 Posts: 2 Location: detroit

thx mate,

took a little tweaking with the versions of PEAR apps but it was a great HOWTO!

got everything up and running in about an hour, now to just to get snort tweaked and some more of the rules running!

thx again!

-Todd

Killerchronic · Posted: Tue Apr 20, 2010 3:35 pm Post subject:

Pearl packages are installed via portage now once base was unmasked.
Already had apache, php and mysql setup and running fine so can't comment on the guide for that.

Only thing i really had to change was the path in base_path.php as it wasn't pointing to any base_conf.php.

Other than that were no obvious flaws, surprised me really, most gentoo Guides go out of date in no time

Thanks.