[Prelude Hybrid IDS] #139: reliability of alert delivery when entropy is low
Prelude Hybrid IDS <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#139: reliability of alert delivery when entropy is low ---------------------------------+------------------------------------------ Reporter: [email protected] | Owner: yoann Type: defect | Status: new Priority: high | Milestone: Component: libprelude | Version: 0.9 Severity: critical | Keywords: ---------------------------------+------------------------------------------ We've found that if the entropy is low on a machine we can get alerts dropped with an error, which looks like: [/tmp/prelude-agent1.socket 0xd34a44418b54c idmef:w]: TLS authentication succeed: client certificate is trusted. [/tmp/prelude-agent1.socket 0xd34a44418b54c idmef:w]: TLS error: Error in the push function.. [/tmp/prelude-agent1.socket 0xd34a44418b54c idmef:w]: End of file. [/tmp/prelude-agent1.socket 0xd34a44418b54c idmef:w]: closing connection. If we increase system load (which increases the entropy on our machine) then alerts get through fine. I would guess that there needs to be some EINTR/EAGAIN handling somewhere which isn't there at the moment. I'm not sure of the solution in light of the fact that presumably entropy is needed in order to send properly, we can't just magic some new entropy. There needs to be a better way of handling this though, rather than random alert failure. Curiously we are using unix sockets in this case, and I beleive encryption is disabled there. This is a serious issue as it is affecting production machines which are now very unreliable as they drop alerts. -- Ticket URL: <https://trac.prelude-ids.org/ticket/139> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel