package snort-mysql 2.7.0-22ubuntu1 failed to install/upgrade: subprocess post-installation script returned error exit status 6

[[e-mail]]

Binary package hint: snort

ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2)

Setting up snort-mysql (2.7.0-22ubuntu1) ...
 * Stopping Network Intrusion Detection System snort * No running snort instance found
 * Starting Network Intrusion Detection System snort * /etc/snort/db-pending-config file found
 * Snort will not start as its database is not yet configured.
 * Please configure the database as described in
 * /usr/share/doc/snort-{pgsql,mysql}/README-database.Debian
 * and remove /etc/snort/db-pending-config
invoke-rc.d: initscript snort, action "start" failed.
dpkg: error processing snort-mysql (--configure):
 subprocess post-installation script returned error exit status 6
Errors were encountered while processing:
 snort-mysql
E: Sub-process /usr/bin/dpkg returned an error code (1)

ProblemType: Package
Architecture: i386
DistroRelease: Ubuntu 9.04
ErrorMessage: subprocess post-installation script returned error exit status 6
Package: snort-mysql 2.7.0-22ubuntu1
SourcePackage: snort
Title: package snort-mysql 2.7.0-22ubuntu1 failed to install/upgrade: subprocess post-installation script returned error exit status 6
Uname: Linux 2.6.30 i686

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.

[BenzoBoarder (benzoboarder)]

I believe from workign on this that its simply that MySql, postgress or whatever DB chosen needs to be configured. Seems like the install could ignore that portion and let the user setup config after. Does seem to work consistently when installing from source but there are a few differing install guides.

Would love to hear how anyones fixed this. Need a quick and simple install to deploy many snort sensors on, my favorite, Ubuntu. Always use a hardened Linux for outside but Ubuntu seems like enough for the internal and potential sacrificial lamb for internal users.

Would also like to collaborate with someone on after a threshold of snort alerts kicking someone to a honeypot.

Thanks,
D

[Jean-Baptiste Lallement (jibel)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. This particular bug has already been reported and is a duplicate of bug 390444, so it is being marked as such. Please look at the other bug report to see if there is any missing information that you can provide, or to see if there is a workaround for the bug. Additionally, any further discussion regarding the bug should occur in the other report. Please continue to report any other bugs you may find.