Problems running snort's web frontend

Question

I can't find a good snort web frontend that works properly. I tried base i got so many errors while trying to get it to work:

 Warning: include_once(Mail.php) [function.include-once]: failed to open stream: No such file or directory in /usr/local/apache2/htdocs/base-1.4.4/includes/base_action.inc.php on line 29 Warning: include_once() [function.include]: Failed opening 'Mail.php' for inclusion (include_path='.:/usr/local/lib/php') in /usr/local/apache2/htdocs/base-1.4.4/includes/base_action.inc.php on line 29 Warning: include_once(Mail/mime.php) [function.include-once]: failed to open stream: No such file or directory in /usr/local/apache2/htdocs/base-1.4.4/includes/base_action.inc.php on line 30 Warning: include_once() [function.include]: Failed opening 'Mail/mime.php' for inclusion (include_path='.:/usr/local/lib/php') in /usr/local/apache2/htdocs/base-1.4.4/includes/base_action.inc.php on line 30 Warning: Cannot modify header information - headers already sent by (output started at /usr/local/apache2/htdocs/base-1.4.4/includes/base_action.inc.php:29) in /usr/local/apache2/htdocs/base-1.4.4/base_common.php on line 1077 

i installed that and plus Mail_Mime and i got it to work, now i'm having problem snort do actual logging into database, i uncommented these:

 output database: log, mysql, user=XXXXXX password=XXXXXX dbname=XXXXXX host=XXXXXX ruletype redalert { type alert output alert_syslog: LOG_AUTH LOG_ALERT output database: log, mysql, user=XXXXXX dbname=XXXXXX host=XXXXXX password=XXXXXX } 

and it still won't log anything in:(

Answer 1

You're just missing some PHP Pear libraries. Try running

pear install Mail_Mime 

Which should fix up the include errors (in regards to Mail.php anyway). Make sure you've read the INSTALL file that came with BASE (in particular, the dependencies section)