Use ulogd to log iptables records into mysql db with web interface, nulog

1. download and install ulogd and ulogd-mysql TESTING rpms from http://rpm.razorsedge.org/centos-5/RE-test/repodata/index.html
2. mysql -u root -p

mysql> create database ulog;

3. vi /etc/ulogd.conf

..
plugin="/usr/lib/ulogd/ulogd_MYSQL.so" #uncomment it for use
..
[MYSQL]
table="ulog"
pass=""
user="root"
db="ulog"
host="localhost"
..

4. download and install NuLog from http://software.inl.fr/trac/trac.cgi/wiki/EdenWall/NuLog

wget http://software.inl.fr/releases/Nulog/nulog-1.2.14.tar.gz
tar zxvf nulog-1.2.14.tar.gz
cd nulog-1.2.14
make install

5. create tables from the script

# the two commands are totally same
cat /root/nulog-1.2.14/scripts/ulogd.mysqldump | mysql -u root -p ulog
mysql -u root -p ulog < /root/nulog-1.2.14/scripts/ulogd.mysqldump

6. /etc/init.d/ulogd start
7. cp /usr/share/edenwall-web/nulog/include/config.template.php /usr/share/edenwall-web/nulog/include/config.php
7. vi /usr/share/edenwall-web/nulog/include/config.php

..
if (!isset($lang))
$lang="en";
..
# database Host
$db_host="localhost";
# database name
$db_ulog="ulog";
# database user
$db_user="root";
# database password
$db_pwd="";
..



* create a password file for basic http authentication
htpasswd -c /var/www/apache.passwd username
* cp nulog_apache.conf /etc/httpd/conf.d/nulog.conf
* vi /etc/httpd/conf.d/nulog.conf

Alias /nulog/ "/usr/share/edenwall-web/nulog/" # path
..
# Authentification
# Create file /path/to/some/file with htpasswd
AuthType Basic
AuthName "Nulog access"
AuthUserFile /var/www/apache.passwd
Require user username