Snort Forums Archive

Archive Home » Support » Snort is working but its not dumping into mysql database- HELP!!

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Snort is working but its not dumping into mysql database- HELP!!

Posted by pastor on March 28, 2005 04:06:26

Hi, i've started snort but acid doesn't show anything. Logs r ok, alert logs ok, and no error msg on "snort -T" command. I'd check the database and there is no data on it. Grants r ok cose I test it using the database user and inserting some data.
This is the report and the .conf file.
Help please!.
---USING---
snort-mysql-2.3.2-0.fdr.1
snort-2.3.2-0.fdr.1
mysql-3.23.58-9.1
mysql-server-3.23.58-9.1
-----------

[root@fw snort]# snort -T
Running in IDS mode with inferred config file: ./snort.conf

Initializing Network Interface eth0

--== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface eth0
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file ./snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
,-----------[Flow Config]----------------------
| Stats Interval: 0
| Hash Method: 2
| Memcap: 10485760
| Rows : 4099
| Overhead Bytes: 16400(%0.16)
`----------------------------------------------
No arguments to frag2 directive, setting defaults to:
Fragment timeout: 60 seconds
Fragment memory cap: 4194304 bytes
Fragment min_ttl: 0
Fragment ttl_limit: 5
Fragment Problems: 0
Self preservation threshold: 500
Self preservation period: 90
Suspend threshold: 1000
Suspend period: 30
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
State alerts: INACTIVE
Evasion alerts: INACTIVE
Scan alerts: INACTIVE
Log Flushed Streams: INACTIVE
MinTTL: 1
TTL Limit: 5
Async Link: 0
State Protection: 0
Self preservation threshold: 50
Self preservation period: 90
Suspend threshold: 200
Suspend period: 30
Enforce TCP State: INACTIVE
Midstream Drop Alerts: INACTIVE

Stream4_reassemble config:
Server reassembly: INACTIVE
Client reassembly: ACTIVE
Reassembler alerts: ACTIVE
Zero out flushed packets: INACTIVE
flush_data_diff_size: 500
Ports: 21 23 25 53 80 110 111 143 513 1433
Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
HttpInspect Config:
GLOBAL CONFIG
Max Pipeline Requests: 0
Inspection Type: STATELESS
Detect Proxy Usage: NO
IIS Unicode Map Filename: ./unicode.map
IIS Unicode Map Codepage: 1252
DEFAULT SERVER CONFIG:
Ports: 80 8080 8180
Flow Depth: 300
Max Chunk Length: 500000
Inspect Pipeline Requests: YES
URI Discovery Strict Mode: NO
Allow Proxy Usage: NO
Disable Alerting: NO
Oversize Dir Length: 500
Only inspect URI: NO
Ascii: YES alert: NO
Double Decoding: YES alert: YES
%U Encoding: YES alert: YES
Bare Byte: YES alert: YES
Base36: OFF
UTF 8: OFF
IIS Unicode: YES alert: YES
Multiple Slash: YES alert: NO
IIS Backslash: YES alert: NO
Directory Traversal: YES alert: NO
Web Root Traversal: YES alert: YES
Apache WhiteSpace: YES alert: NO
IIS Delimiter: YES alert: NO
IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
Non-RFC Compliant Characters: NONE
rpc_decode arguments:
Ports to decode RPC on: 111 32771
alert_fragments: INACTIVE
alert_large_fragments: ACTIVE
alert_incomplete: ACTIVE
alert_multiple_requests: ACTIVE
telnet_decode arguments:
Ports to decode telnet on: 21 23 25 119
Portscan Detection Config:
Detect Protocols: TCP UDP ICMP IP
Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan
Sensitivity Level: Low
Memcap (in bytes): 10000000
Number of Nodes: 36900

database: compiled support for ( mysql )
database: configured to use mysql
database: user = snortusr
database: database name = snort
database: password is set
database: host = localhost
database: sensor name = 192.168.0.1
database: sensor id = 2
database: schema version = 106
database: using the "log" facility
2836 Snort rules read...
2836 Option Chains linked into 265 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked.

+-----------------------[thresholding-config]----------------------------------
| memory-cap : 1048576 bytes
+-----------------------[thresholding-global]----------------------------------
| none
+-----------------------[thresholding-local]-----------------------------------
| gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60
| gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10
| gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2
| gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60
| gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2
| gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60
| gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60
| gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60
| gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60
+-----------------------[suppression]------------------------------------------
| none
+------------------------------------------------------------------------------
Rule application order: ->activation->dynamic->alert->pass->log
Log directory = /var/log/snort

--== Initialization Complete ==--

,,_ -*> Snort! <*-
o" )~ Version 2.3.2 (Build 12)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html
(C) Copyright 1998-2004 Sourcefire Inc., et al.

Snort sucessfully loaded all rules and checked all rule chains!
Final Flow Statistics
,----[ FLOWCACHE STATS ]----------
Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
finds: 0 reversed: 0(%0.000000)
find_sucess: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
database: Closing connection to database " system call was detected"
Snort exiting

------CONF FILE---------
var HOME_NET any
var EXTERNAL_NET any

var DNS_SERVERS $HOME_NET
var SMTP_SERVERS $HOME_NET
var HTTP_SERVERS $HOME_NET
var SQL_SERVERS $HOME_NET
var TELNET_SERVERS $HOME_NET
var SNMP_SERVERS $HOME_NET
var HTTP_PORTS 80

var SHELLCODE_PORTS !80
var ORACLE_PORTS 1521
var AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]
var RULE_PATH /etc/snort/rules

preprocessor flow: stats_interval 0 hash 2
preprocessor frag2
preprocessor stream4: disable_evasion_alerts
preprocessor stream4_reassemble
preprocessor http_inspect: global \
iis_unicode_map unicode.map 1252
preprocessor http_inspect_server: server default \
profile all ports { 80 8080 8180 } oversize_dir_length 500
preprocessor rpc_decode: 111 32771
preprocessor bo
preprocessor telnet_decode
preprocessor sfportscan: proto { all } \
memcap { 10000000 } \
sense_level { low }

output database: log, mysql, user=snortusr dbname=snort password=snortpasswd host=localhost

include classification.config
include reference.config

config flowbits_size: 256

include $RULE_PATH/local.rules
include $RULE_PATH/bad-traffic.rules
include $RULE_PATH/exploit.rules
include $RULE_PATH/scan.rules
include $RULE_PATH/finger.rules
include $RULE_PATH/ftp.rules
include $RULE_PATH/telnet.rules
include $RULE_PATH/rpc.rules
include $RULE_PATH/rservices.rules
include $RULE_PATH/dos.rules
include $RULE_PATH/ddos.rules
include $RULE_PATH/dns.rules
include $RULE_PATH/tftp.rules
include $RULE_PATH/web-cgi.rules
include $RULE_PATH/web-coldfusion.rules
include $RULE_PATH/web-iis.rules
include $RULE_PATH/web-frontpage.rules
include $RULE_PATH/web-misc.rules
include $RULE_PATH/web-client.rules
include $RULE_PATH/web-php.rules
include $RULE_PATH/sql.rules
include $RULE_PATH/x11.rules
include $RULE_PATH/icmp.rules
include $RULE_PATH/netbios.rules
include $RULE_PATH/misc.rules
include $RULE_PATH/attack-responses.rules
include $RULE_PATH/oracle.rules
include $RULE_PATH/mysql.rules
include $RULE_PATH/snmp.rules
include $RULE_PATH/smtp.rules
include $RULE_PATH/imap.rules
include $RULE_PATH/pop2.rules
include $RULE_PATH/pop3.rules
include $RULE_PATH/nntp.rules
include $RULE_PATH/other-ids.rules
include $RULE_PATH/web-attacks.rules
include $RULE_PATH/backdoor.rules
include $RULE_PATH/shellcode.rules
include $RULE_PATH/policy.rules
include $RULE_PATH/porn.rules
include $RULE_PATH/info.rules
include $RULE_PATH/icmp-info.rules
include $RULE_PATH/virus.rules
include $RULE_PATH/chat.rules
include $RULE_PATH/multimedia.rules
include $RULE_PATH/p2p.rules
include $RULE_PATH/experimental.rules

Posted by pastor on March 28, 2005 04:13:14

OOOps again...
Hi, i've started snort but acid doesn't show anything. Logs r ok, alert logs ok, and no error msg on "snort -T" command. I'd check the database and there is no data on it. Grants r ok cose I test it using the database user and inserting some data.

This is the report and the .conf file.

Help please!.

---USING---

snort-mysql-2.3.2-0.fdr.1

snort-2.3.2-0.fdr.1

mysql-3.23.58-9.1

mysql-server-3.23.58-9.1

-----------

[root@fw snort]# snort -T

Running in IDS mode with inferred config file: ./snort.conf

Initializing Network Interface eth0

--== Initializing Snort ==--

Initializing Output Plugins!

Decoding Ethernet on interface eth0

Initializing Preprocessors!

Initializing Plug-ins!

Parsing Rules file ./snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++

Initializing rule chains...

,-----------[Flow Config]----------------------

| Stats Interval: 0

| Hash Method: 2

| Memcap: 10485760

| Rows : 4099

| Overhead Bytes: 16400(%0.16)

`----------------------------------------------

No arguments to frag2 directive, setting defaults to:

Fragment timeout: 60 seconds

Fragment memory cap: 4194304 bytes

Fragment min_ttl: 0

Fragment ttl_limit: 5

Fragment Problems: 0

Self preservation threshold: 500

Self preservation period: 90

Suspend threshold: 1000

Suspend period: 30

Stream4 config:

Stateful inspection: ACTIVE

Session statistics: INACTIVE

Session timeout: 30 seconds

Session memory cap: 8388608 bytes

State alerts: INACTIVE

Evasion alerts: INACTIVE

Scan alerts: INACTIVE

Log Flushed Streams: INACTIVE

MinTTL: 1

TTL Limit: 5

Async Link: 0

State Protection: 0

Self preservation threshold: 50

Self preservation period: 90

Suspend threshold: 200

Suspend period: 30

Enforce TCP State: INACTIVE

Midstream Drop Alerts: INACTIVE

Stream4_reassemble config:

Server reassembly: INACTIVE

Client reassembly: ACTIVE

Reassembler alerts: ACTIVE

Zero out flushed packets: INACTIVE

flush_data_diff_size: 500

Ports: 21 23 25 53 80 110 111 143 513 1433

Emergency Ports: 21 23 25 53 80 110 111 143 513 1433

HttpInspect Config:

GLOBAL CONFIG

Max Pipeline Requests: 0

Inspection Type: STATELESS

Detect Proxy Usage: NO

IIS Unicode Map Filename: ./unicode.map

IIS Unicode Map Codepage: 1252

DEFAULT SERVER CONFIG:

Ports: 80 8080 8180

Flow Depth: 300

Max Chunk Length: 500000

Inspect Pipeline Requests: YES

URI Discovery Strict Mode: NO

Allow Proxy Usage: NO

Disable Alerting: NO

Oversize Dir Length: 500

Only inspect URI: NO

Ascii: YES alert: NO

Double Decoding: YES alert: YES

%U Encoding: YES alert: YES

Bare Byte: YES alert: YES

Base36: OFF

UTF 8: OFF

IIS Unicode: YES alert: YES

Multiple Slash: YES alert: NO

IIS Backslash: YES alert: NO

Directory Traversal: YES alert: NO

Web Root Traversal: YES alert: YES

Apache WhiteSpace: YES alert: NO

IIS Delimiter: YES alert: NO

IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG

Non-RFC Compliant Characters: NONE

rpc_decode arguments:

Ports to decode RPC on: 111 32771

alert_fragments: INACTIVE

alert_large_fragments: ACTIVE

alert_incomplete: ACTIVE

alert_multiple_requests: ACTIVE

telnet_decode arguments:

Ports to decode telnet on: 21 23 25 119

Portscan Detection Config:

Detect Protocols: TCP UDP ICMP IP

Detect Scan Type: portscan portsweep decoy_portscan
distributed_portscan

Sensitivity Level: Low

Memcap (in bytes): 10000000

Number of Nodes: 36900

database: compiled support for ( mysql )

database: configured to use mysql

database: user = snortusr

database: database name = snort

database: password is set

database: host = localhost

database: sensor name = 192.168.0.1

database: sensor id = 2

database: schema version = 106

database: using the "log" facility

2836 Snort rules read...

2836 Option Chains linked into 265 Chain Headers

0 Dynamic rules

+++++++++++++++++++++++++++++++++++++++++++++++++++

Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.

Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked.

+-----------------------[thresholding-config]----------------------------------

| memory-cap : 1048576 bytes

+-----------------------[thresholding-global]----------------------------------

| none

+-----------------------[thresholding-local]-----------------------------------

| gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60

| gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10

| gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2

| gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60

| gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2

| gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60

| gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60

| gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60

| gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60

+-----------------------[suppression]------------------------------------------

| none

+------------------------------------------------------------------------------

Rule application order: ->activation->dynamic->alert->pass->log

Log directory = /var/log/snort

--== Initialization Complete ==--

,,_ -*> Snort! <*-

o" )~ Version 2.3.2 (Build 12)

'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html

(C) Copyright 1998-2004 Sourcefire Inc., et al.

Snort sucessfully loaded all rules and checked all rule chains!

Final Flow Statistics

,----[ FLOWCACHE STATS ]----------

Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1)
Overhead blocks: 1 Could Hold: (0)

IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s

finds: 0 reversed: 0(%0.000000)

find_sucess: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0

database: Closing connection to database " system call was detected"

Snort exiting

------CONF FILE---------

var HOME_NET any

var EXTERNAL_NET any

var DNS_SERVERS $HOME_NET

var SMTP_SERVERS $HOME_NET

var HTTP_SERVERS $HOME_NET

var SQL_SERVERS $HOME_NET

var TELNET_SERVERS $HOME_NET

var SNMP_SERVERS $HOME_NET

var HTTP_PORTS 80

var SHELLCODE_PORTS !80

var ORACLE_PORTS 1521

var AIM_SERVERS
[64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]

var RULE_PATH /etc/snort/rules

preprocessor flow: stats_interval 0 hash 2

preprocessor frag2

preprocessor stream4: disable_evasion_alerts

preprocessor stream4_reassemble

preprocessor http_inspect: global \

iis_unicode_map unicode.map 1252

preprocessor http_inspect_server: server default \

profile all ports { 80 8080 8180 } oversize_dir_length 500

preprocessor rpc_decode: 111 32771

preprocessor bo

preprocessor telnet_decode

preprocessor sfportscan: proto { all } \

memcap { 10000000 } \

sense_level { low }

output database: log, mysql, user=snortusr dbname=snort password=snortpasswd host=localhost

include classification.config

include reference.config

config flowbits_size: 256

include $RULE_PATH/local.rules

include $RULE_PATH/bad-traffic.rules

include $RULE_PATH/exploit.rules

include $RULE_PATH/scan.rules

include $RULE_PATH/finger.rules

include $RULE_PATH/ftp.rules

include $RULE_PATH/telnet.rules

include $RULE_PATH/rpc.rules

include $RULE_PATH/rservices.rules

include $RULE_PATH/dos.rules

include $RULE_PATH/ddos.rules

include $RULE_PATH/dns.rules

include $RULE_PATH/tftp.rules

include $RULE_PATH/web-cgi.rules

include $RULE_PATH/web-coldfusion.rules

include $RULE_PATH/web-iis.rules

include $RULE_PATH/web-frontpage.rules

include $RULE_PATH/web-misc.rules

include $RULE_PATH/web-client.rules

include $RULE_PATH/web-php.rules

include $RULE_PATH/sql.rules

include $RULE_PATH/x11.rules

include $RULE_PATH/icmp.rules

include $RULE_PATH/netbios.rules

include $RULE_PATH/misc.rules

include $RULE_PATH/attack-responses.rules

include $RULE_PATH/oracle.rules

include $RULE_PATH/mysql.rules

include $RULE_PATH/snmp.rules

include $RULE_PATH/smtp.rules

include $RULE_PATH/imap.rules

include $RULE_PATH/pop2.rules

include $RULE_PATH/pop3.rules

include $RULE_PATH/nntp.rules

include $RULE_PATH/other-ids.rules

include $RULE_PATH/web-attacks.rules

include $RULE_PATH/backdoor.rules

include $RULE_PATH/shellcode.rules

include $RULE_PATH/policy.rules

include $RULE_PATH/porn.rules

include $RULE_PATH/info.rules

include $RULE_PATH/icmp-info.rules

include $RULE_PATH/virus.rules

include $RULE_PATH/chat.rules

include $RULE_PATH/multimedia.rules

include $RULE_PATH/p2p.rules

include $RULE_PATH/experimental.rules

Posted by jvhaysx on March 28, 2005 04:46:27

Here are some ideas that may be helpful.

Are you sure snort is not dumping into the database? How do you know?

You could look in the mysql/data directory and see if the database file size is growing. Or maybe log into the MySQL and do the same thing with 'show' commands. (I'm not sure what commands to use. Type 'help show' at the 'sql>' prompt. Playing around with 'show' commands will not hurt anything.)

Make sure that snort and ACID are configured to access the same database, with the same password.

Posted by pastor on March 28, 2005 04:50:39

Im shure that is not dumping cose i'v got access to the database and I can use sql querys to scan de data. The database is empty, and the alert logs still growing up.

Posted by jvhaysx on March 28, 2005 06:51:52

What about MySQL permissions? When I recently installed the MySQL binary I used these instructions from the included INSTALL-BINARY:

"The basic commands you must execute to install and use a MySQL binary
distribution are:

shell> groupadd mysql

shell> useradd -g mysql mysql

shell> cd /usr/local

shell> gunzip < /PATH/TO/MYSQL-VERSION-OS.tar.gz | tar xvf -

shell> ln -s FULL-PATH-TO-MYSQL-VERSION-OS mysql

shell> cd mysql

shell> scripts/mysql_install_db --user=mysql

shell> chown -R root .

shell> chown -R mysql data

shell> chgrp -R mysql .

shell> bin/mysqld_safe --user=mysql &
"

Posted by pastor on March 28, 2005 06:59:22

it can't be MySQL permission cos snort was working fine on version 2.0.0, last friday we try to update but we can't get snort start for a init.d problem. We unistall the snort RPM and install again, it's works fine, but the mysql dump is not working.

Posted by jvhaysx on March 28, 2005 08:58:35

Did you try restarting MySQL?

Posted by pastor on March 28, 2005 09:49:15

yes ;)

Posted by chris on March 29, 2005 09:08:36

Sorry if I've missed some parts of this, but have you tried logging into the Mysql Dbase with the snort user and pass ??, and the ACID console user & pass
If I remember correctly, you have to use the 'OLD_password' command to get ACID to be able to contact Mysql, and fetch the data. Because Mysql 4.1 uses a different password encryption scheme now.
check out this page -
http://dev.mysql.com/doc/mysql/en/old-client.html

Posted by pastor on March 30, 2005 03:03:25

I've got MySQL 3.2.3 and I've got no problems inserting data using the snort usr and passwd.

Posted by chris on March 30, 2005 11:43:13

can the ACID user connect ok to the Dbase ?

Posted by pastor on March 31, 2005 04:09:32

yes, but I don't care about acid, cos I use sql querys to probe if snort is dumping into mysql.

Posted by pastor on April 01, 2005 09:18:17

is there a mysql version to use with snort 2.3.x? I got mysql 3.23.58... it could be the problem?

Posted by luca on April 04, 2005 19:53:54

I have the same problem and I agree with chris.

I think snort user is authenticating by using the the hold hases format then something fails.

It works if you type SET PASSWORD FOR snort_user@localhost=OLD_PASSWORD('snort_password'); in the mysql prompt.

This solved my problem until I restart mysql, then nothing get's logged again.

I really think a patch is needed to support the new mysql hashes.

Posted by luca on April 04, 2005 23:01:17

err....

read tips on: http://www.snort.org/docs/faq.html#6.15

I had the -A option on my startup script (/etc/rc.d/init.d/snortd) which I suppose was overriding the config file.

I'm using now a different startup script and apparently it is logging to the mysql database.

I've also runned the following commands on the mysql database prompt:

SET PASSWORD FOR snort@localhost=OLD_PASSWORD('snort_password');
SET PASSWORD FOR acid@localhost=OLD_ASSWORD('snort_password');

I Hope this will put you on the right path to solve your issue as well.

Posted by pastor on April 06, 2005 14:22:01

Thanks!!!!
that works perfectly... xD

Posted by MidNitRcr on January 10, 2006 16:06:08

I downloaded the binary package for FC3 and ran the install from RPM's. The default startup script they use in that package has this exact problem. Nothing is logged to mysql but snort runs fine. It just looks as if it is ignoring the settings (which apparently it was) I commented this out as follows in the init script...

if [ "$ALERTMODE"X = "X" ]; then
ALERTMODE=""
else
# ALERTMODE="-A $ALERTMODE"
ALERTMODE=""
fi

...and all works fine now. Just posting in case other people get bit by the same problem. It took me quite a while to find this post and since you have to be registered to see this posts google was of no help...

Posted by Joel_Esler on January 10, 2006 17:06:59

Further more, switch to BASE.

http://secureideas.sourceforge.net

Joel