Setting up a database for KFSensor is straightforward, but there are a couple of things to watch out for, so please read through the following step by step instructions even if you are very familiar with database configuration.
The instructions below cover both SQL Server and MySQL.
For more information on which database to choose and how to install it please read the Choosing the database system section first.
Follow the standard installation procedure for the database server product and edition that you have selected to use. This can be installed on the same machine, or a different machine as KFSensor. See the section below for details on the issues that is choice may cause.
KFSensor only uses 32-bit ODBC drivers to connect to a database. It is important to obtain the correct driver and install it on the same machine that KFSensor is installed on.
If SQL Server is running on the same machine as KFSensor then the ODBC drivers will already be installed and a separate installation will not be nessasary.
For both SQL Server and MySQL there is a choice of 32 and 64 bit driver installations:
It is important to define a DSN with a 32bit driver. The actual database system and KFSensor can be running on 64bit Windows, but the driver itself needs to be the 32bit one.
Create a new database on the Database Server for KFSensor.
Either use the menu option on the management interface, or use the following SQL command
create database kfsensor
There is no need to create any tables as KFSensor will do that once it connects. It is important to create the blank database in order to set up the correct security access.
For SQL Server the use of Native Mode security (SQL username/password) is the simplest and most reliable method, but it does mean that the username/password has to be stored within the KFSensor configuration file, which could make it available if the KFSensor machine was compromised. To mitigate that risk ensure that a new SQL server user account is created which only has access to the KFSensor database and no other. Never use the sa account.
In SQL Server create a new 'Login' set to SQL Server authentication. Give it the login name 'kfsensor' and a unique password. Set up this Login with a user mapping to the new kfsensor database and give it membership of public and db_owner.
Using Windows authentication is the most secure form of security. It is easy to configure, but there are complications. See the section 'Issues with SQL Server Window Authentication' below for more details if choosing this option.
Create a new Login set to Windows authentication. Enter the Windows user name as the login name. It is best to use the search option to ensure that this is entered correctly. There is no need to set a password. Set up this Login with a user mapping to the new kfsensor database and give it membership of public and db_owner.
MySQL has its own native security and this is almost identical to the SQL Server option described above.
Add a new account in 'Users and Privileges'. Give it the login name 'kfsensor' and a unique password. Give it all the available chema privileges to the kfsensor schema.
n.b. The use of a 'System DSN' is vital as the KFSensor Server runs under a different user account to yours and therefore a 'User DSN' is not visible to it.
Once a new database is configured it will have no events in it. It is useful to import you old event log data into the database so there is no loss in your records.
SQL Server can be configured to use Windows authentication, which is more secure as it does not require a password to be stored by KFSensor and it can make use of the same security infrastructure that is already in place to protect the hosts.
The big issue to watch out for with Windows Authentication is that the KFSensor Server runs under a different account from your user account which is used to run the KFSensor monitor. A common support issue is for the KFSensor monitor to be working fine, but with no events being logged to the database. It is important that access rights to the database are given to both the Logins of the users and the system accounts used to run the KFSensor Server
By default KFSensor Server runs under the account 'Local System'. For this account create a windows authentication SQL Login for 'NT AUTHORITY\SYSTEM' and give it access to the kfsensor database.
If the KFSensor Server is running under the 'Network Service' account then create a windows authentication SQL Login for 'NT AUTHORITY\NETWORK SERVICE' and give it access to the kfsensor database.
If KFSensor is to be connected to a database service running on a different machine then careful consideration needs to be given to security access configuration. The default 'Local System' account is different on each machine and so cannot be used to access an SQL Server on a remote host. Assuming that both servers are part of a Windows domain then the solution is to use a Windows domain user account. It is best to create a special domain user account for this purpose and not to reuse an existing user's account. Care must be take to not enforce password expiry otherwise the system will stop functioning when the password expires.
Once a domain account has been created, it should be given permission to access the kfsensor database on the SQL Server.
Each KFSensor service needs to be then configured to run as the new domain user as follows:
It is common to install KFSensor and the database system it uses onto the same machine. There are several advantages to this such as the need for only one machine and the inherent security of not having both systems communicate over the network.
There are however two issues with running both systems on the same machine that can make life difficult, but are easy to resolve.
KFSensor opens the ports used by the two most popular database systems, MySQL's 3306 and SQL Server's 1433.
Only one system can use these ports and it should be KFSensor as there are a popular attack target. It if KFSensor that should be exposed to attack and not the database server.
There are three possible ways around this problem.
By default at boot up time, Windows will start KFSensor and the database at the same time which often results in errors in the log files and a slow down in start up times as KFSensor keeps trying to make a database connection.
The KFSensor server service should start after the database system has started.
To fix this configure the Service Dependencies field in the Server Settings dialog.
See Also: Reports Overview