Ubuntu에서 Snort + Mysql + BASE 설치

1. Snort-mysql 패키지 설치하기

Snort-mysql 패키지 설치 (Language : text)

1. apt-get install snort-mysql

2. Mysql 설정 하기

  [ running as an mysql user with admin privileges ]
  $ mysql -u root -p      
  mysql> CREATE DATABASE snort;
  mysql> grant CREATE, INSERT, SELECT, UPDATE on snort.* to snort@localhost;
  mysql> grant CREATE, INSERT, SELECT, UPDATE on snort.* to snort;
  mysql> SET PASSWORD FOR snort@localhost=PASSWORD('snort-db');
  mysql> flush privileges;
  [ you can confirm the changes above running ]
  mysql> show grants for 'snort'@'localhost';

  And then you can run the command above as:

  $ zcat /usr/share/doc/snort-mysql/create_mysql.gz | mysql -u snort -D snort -psnort-db


4. 설정파일 생성

/etc/snort/snort.conf 파일 수정 (Language : text)

1. output database: log, mysql, user=snort password=snort dbname=snort-db host=localhost

5. Snort 실행하기

파일 권한 변경 및 실행 (Language : text)

1. # chown root:snort /etc/snort/snort.conf
2. # chmod 0640 /etc/snort/snort.conf
3.  
4. 실행하기
5. # snort -c /etc/snort/snort.conf -i eth0 &

참고 사이트:
http://ubuntuforums.org/showthread.php?t=145641