Toronto Web Hosting - Snort Intrusion Dection Guide

Chapter 6     Using ACID and SnortSnarf with Snort

  Name of the archive database if you are using one.

  Database server name where archive database is located. In our case both

snort

and

snort_archive

 databases are located on

localhost

  Database user name and password to access

snort_archive

 database.

  Location of PHPLOT files. In our case this is

./phplot 4.4.6

. This is

because all PHPLOT files are located in

phplot 4.4.6

 directory under the

directory where ACID files are located.

This information is present in the start of the

acid_conf.php

 file. The typical

opening lines of this file in my installation are as follows:

$ACID_VERSION = "0.9.6b21";

/* Path to the DB abstraction library

 *  (Note: DO NOT include a trailing backslash after the

 *   directory)

 *   e.g. $foo = "/tmp"      [OK]

 *        $foo = "/tmp/"     [OK]

 *        $foo = "c:\tmp"    [OK]

 *        $foo = "c:\tmp\"   [WRONG]

*/

$DBlib_path = "./adodb";

/* The type of underlying alert database

 *  MySQL       : "mysql"

 *  PostgresSQL : "postgres"

 *  MS SQL Server : "mssql"

*/

$DBtype = "mysql";

/* Alert DB connection parameters

 *     $alert_dbname   : MySQL database name of Snort

                       : alert DB

 *     $alert_host     : host on which the DB is stored

 *     $alert_port     : port on which to access the DB

 *     $alert_user     : login to the database with

                       : this user

 *     $alert_password : password of the DB user

 *  This information can be gleaned from the Snort database

 *  output plugin configuration.

*/

footer