Re: [Prelude Hybrid IDS] #187: gnutls error registering new sensors

"Prelude Hybrid IDS" <[email protected]> Tue, 02 Jan 2007 20:21:52 -0000
Newsgroups	gmane.comp.security.ids.prelude.devel
Message-ID	<[email protected]>
#187: gnutls error registering new sensors
--------------------------------------------------+-------------------------
 Reporter:  [email protected]          |        Owner:  yoann                
     Type:  defect                                |       Status:  new                  
 Priority:  normal                                |    Milestone:  Prelude-Manager 0.9.8
Component:  prelude-manager                       |      Version:  0.9                  
 Severity:  critical                              |   Resolution:                       
 Keywords:  gnutls error registering new sensors  |  
--------------------------------------------------+-------------------------
Comment (by [email protected]):

 1.
       root@comandante:~# /usr/local/bin/prelude-adduser registration-
 server prelude-manager
    2.

    3.
       - Using default TLS settings from
 /usr/local/etc/prelude/default/tls.conf:
    4.
         - Generated key size: 1024 bits.
    5.
         - Authority certificate lifetime: unlimited.
    6.
         - Generated certificate lifetime: unlimited.
    7.

    8.
       - Using analyzer prelude-manager.
    9.
         - Using /usr/local/etc/prelude/profile/prelude-manager...
   10.
         - Using already allocated ident for prelude-manager:
 1437462296436843.
   11.
         - Using /usr/local/var/spool/prelude/prelude-manager...
   12.

   13.
       - Starting registration server.
   14.
         - generated one-shot password is "1u2fevbt".
   15.

   16.
           This password will be requested by "prelude-adduser" in order to
 connect.
   17.
           Please remove the first and last quote from this password before
 using it.
   18.

   19.
         - Generating 1024 bits Diffie-Hellman key for anonymous
 authentication...
   20.
         - Waiting for peers install request on :::5553...
   21.
         - Waiting for peers install request on 0.0.0.0:5553...
   22.

   23.
         - Connection from ::ffff:212.144.241.130:56818.
   24.
         - GnuTLS handshake failed: GnuTLS internal error..
   25.

   26.
       root@comandante:~# libgnutls-config --version
   27.
       1.4.0
   28.
       root@comandante:~# prelude-adduser del prelude-manager
   29.

   30.
       - Using default TLS settings from
 /usr/local/etc/prelude/default/tls.conf:
   31.
         - Generated key size: 1024 bits.
   32.
         - Authority certificate lifetime: unlimited.
   33.
         - Generated certificate lifetime: unlimited.
   34.

   35.
       - Deleting analyzer prelude-manager
   36.
         - Removing /usr/local/etc/prelude/profile/prelude-manager...
   37.
         - Removing /usr/local/var/spool/prelude/prelude-manager...
   38.
       root@comandante:~# prelude-adduser del prelude-lml
   39.

   40.
       - Using default TLS settings from
 /usr/local/etc/prelude/default/tls.conf:
   41.
         - Generated key size: 1024 bits.
   42.
         - Authority certificate lifetime: unlimited.
   43.
         - Generated certificate lifetime: unlimited.
   44.

   45.
       - Deleting analyzer prelude-lml
   46.
         - Removing /usr/local/etc/prelude/profile/prelude-lml...
   47.
         - Removing /usr/local/var/spool/prelude/prelude-lml...
   48.
       root@comandante:~# prelude-adduser register prelude-lml "idmef:w
 admin:r" localhost
   49.

   50.
       - Using default TLS settings from
 /usr/local/etc/prelude/default/tls.conf:
   51.
         - Generated key size: 1024 bits.
   52.
         - Authority certificate lifetime: unlimited.
   53.
         - Generated certificate lifetime: unlimited.
   54.

   55.
       - Creating analyzer prelude-lml.
   56.

   57.

   58.
       *** WARNING ***
   59.
       prelude-adduser was started without the --uid and --gid command line
 option.
   60.

   61.
       It means that analyzer specific files, that should be available for
 writing,
   62.
       will be created using the current UID (0) and GID (0).
   63.

   64.
       Your sensor won't start unless it is running under this UID or is a
 member of this GID.
   65.

   66.
       [Please press enter if this is what you plan to do]
   67.

   68.
         - Creating /usr/local/etc/prelude/profile/prelude-lml...
   69.
         - Allocated ident for prelude-lml: 3275944523116514.
   70.
           - Generating RSA private key... This might take a very long
 time.
   71.
             [Increasing system activity will speed-up the process.]
   72.

   73.
           - Generating 1024 bits RSA private key... Done.
   74.

   75.
         - Creating /usr/local/var/spool/prelude/prelude-lml...
   76.

   77.
       - Registering analyzer idmef:w admin:r to localhost:5553.
   78.

   79.
         You now need to start "prelude-adduser" on the server host where
   80.
         you need to register to:
   81.

   82.
         use: "prelude-adduser registration-server <analyzer profile>"
   83.
         example: "prelude-adduser registration-server prelude-manager"
   84.

   85.
         This is used in order to register the 'sending' analyzer to the
 'receiving'
   86.
         analyzer. <analyzer profile> should be set to the profile name of
 the
   87.
         'receiving' analyzer, the one where 'sending' analyzer will
 register to.
   88.

   89.
         Please remember that "prelude-adduser" should be used to register
   90.
         every server used by this analyzer.
   91.

   92.
         Enter the one-shot password provided by the "prelude-adduser"
 program:
   93.
         - enter registration one-shot password:
   94.
        Enter the one-shot password provided by the "prelude-adduser"
 program:
   95.
         - enter registration one-shot password:
   96.
         - confirm registration one-shot password:
   97.
         - connecting to registration server (localhost:5553)...
   98.
         - Sending certificate request.
   99.
         - Receiving signed certificate.
  100.
         - Receiving CA certificate.
  101.

  102.
       - prelude-lml registration to localhost successful.
  103.

  104.

  105.
       *****************+
  106.

  107.
       root@comandante:~#
  108.

  109.

  110.

  111.
       root@comandante:~# /usr/local/bin/prelude-adduser registration-
 server prelude-manager
  112.

  113.
       - Using default TLS settings from
 /usr/local/etc/prelude/default/tls.conf:
  114.
         - Generated key size: 1024 bits.
  115.
         - Authority certificate lifetime: unlimited.
  116.
         - Generated certificate lifetime: unlimited.
  117.

  118.
       - Creating analyzer prelude-manager.
  119.

  120.

  121.
       *** WARNING ***
  122.
       prelude-adduser was started without the --uid and --gid command line
 option.
  123.

  124.
       It means that analyzer specific files, that should be available for
 writing,
  125.
       will be created using the current UID (0) and GID (0).
  126.

  127.
       Your sensor won't start unless it is running under this UID or is a
 member of this GID.
  128.

  129.
       [Please press enter if this is what you plan to do]
  130.

  131.
         - Creating /usr/local/etc/prelude/profile/prelude-manager...
  132.
         - Allocated ident for prelude-manager: 3132535565104495.
  133.
           - Generating RSA private key... This might take a very long
 time.
  134.
             [Increasing system activity will speed-up the process.]
  135.

  136.
           - Generating 1024 bits RSA private key... Done.
  137.

  138.
         - Creating /usr/local/var/spool/prelude/prelude-manager...
  139.

  140.
       - Starting registration server.
  141.
         - generated one-shot password is "dc1k9dcg".
  142.

  143.
           This password will be requested by "prelude-adduser" in order to
 connect.
  144.
           Please remove the first and last quote from this password before
 using it.
  145.

  146.
         - Generating 1024 bits Diffie-Hellman key for anonymous
 authentication...
  147.
         - Waiting for peers install request on :::5553...
  148.
         - Waiting for peers install request on 0.0.0.0:5553...
  149.

  150.
         - Connection from ::ffff:127.0.0.1:37451.
  151.
         - Waiting for client certificate request.
  152.
         - Analyzer with ID="3275944523116514" ask for registration with
 permission="idmef:w admin:r".
  153.
           Approve registration [y/n]:
  154.
       Registering analyzer "3275944523116514" with permission "idmef:w
 admin:r".
  155.
         - Generating signed certificate for client.
  156.
         - Sending server certificate to client.
  157.
         - ::ffff:127.0.0.1:37451 successfully registered.
  158.
       root@comandante:~#
  159.

  160.
       ***********************
  161.

  162.
       remote:
  163.
       willy:/home/stefan# prelude-adduser register prelude-lml "idmef:w"
 10.100.100.2 --uid 0 --gid 0
  164.

  165.
       - Using default TLS settings from
 /usr/local/etc/prelude/default/tls.conf:
  166.
         - Generated key size: 1024 bits.
  167.
         - Authority certificate lifetime: unlimited.
  168.
         - Generated certificate lifetime: unlimited.
  169.

  170.
       - Using analyzer prelude-lml.
  171.
         - Using /usr/local/etc/prelude/profile/prelude-lml...
  172.
         - Using already allocated ident for prelude-lml: 1770098924369919.
  173.
         - Using /usr/local/var/spool/prelude/prelude-lml...
  174.

  175.
       - Registering analyzer idmef:w to 10.100.100.2:5553.
  176.

  177.
         You now need to start "prelude-adduser" on the server host where
  178.
         you need to register to:
  179.

  180.
         use: "prelude-adduser registration-server <analyzer profile>"
  181.
         example: "prelude-adduser registration-server prelude-manager"
  182.

  183.
         This is used in order to register the 'sending' analyzer to the
 'receiving'
  184.
         analyzer. <analyzer profile> should be set to the profile name of
 the
  185.
         'receiving' analyzer, the one where 'sending' analyzer will
 register to.
  186.

  187.
         Please remember that "prelude-adduser" should be used to register
  188.
         every server used by this analyzer.
  189.

  190.
         Enter the one-shot password provided by the "prelude-adduser"
 program:
  191.
         - enter registration one-shot password:
  192.

  193.
       starting now:
  194.
       root@comandante:~# /usr/local/bin/prelude-adduser registration-
 server prelude-manager
  195.

  196.
       - Using default TLS settings from
 /usr/local/etc/prelude/default/tls.conf:
  197.
         - Generated key size: 1024 bits.
  198.
         - Authority certificate lifetime: unlimited.
  199.
         - Generated certificate lifetime: unlimited.
  200.

  201.
       - Using analyzer prelude-manager.
  202.
         - Using /usr/local/etc/prelude/profile/prelude-manager...
  203.
         - Using already allocated ident for prelude-manager:
 3132535565104495.
  204.
         - Using /usr/local/var/spool/prelude/prelude-manager...
  205.

  206.
       - Starting registration server.
  207.
         - generated one-shot password is "xxxxxxx".
  208.

  209.
           This password will be requested by "prelude-adduser" in order to
 connect.
  210.
           Please remove the first and last quote from this password before
 using it.
  211.

  212.
         - Generating 1024 bits Diffie-Hellman key for anonymous
 authentication...
  213.
         - Waiting for peers install request on :::5553...
  214.
         - Waiting for peers install request on 0.0.0.0:5553...
  215.

  216.

  217.
       okay copying onetimeshot to willy->remote-lml
  218.

  219.
       this gives:
  220.

  221.
       willy:/home/stefan# prelude-adduser register prelude-lml "idmef:w"
 10.100.100.2 --uid 0 --gid 0
  222.

  223.
       - Using default TLS settings from
 /usr/local/etc/prelude/default/tls.conf:
  224.
         - Generated key size: 1024 bits.
  225.
         - Authority certificate lifetime: unlimited.
  226.
         - Generated certificate lifetime: unlimited.
  227.

  228.
       - Using analyzer prelude-lml.
  229.
         - Using /usr/local/etc/prelude/profile/prelude-lml...
  230.
         - Using already allocated ident for prelude-lml: 1770098924369919.
  231.
         - Using /usr/local/var/spool/prelude/prelude-lml...
  232.

  233.
       - Registering analyzer idmef:w to 10.100.100.2:5553.
  234.

  235.
         You now need to start "prelude-adduser" on the server host where
  236.
         you need to register to:
  237.

  238.
         use: "prelude-adduser registration-server <analyzer profile>"
  239.
         example: "prelude-adduser registration-server prelude-manager"
  240.

  241.
         This is used in order to register the 'sending' analyzer to the
 'receiving'
  242.
         analyzer. <analyzer profile> should be set to the profile name of
 the
  243.
         'receiving' analyzer, the one where 'sending' analyzer will
 register to.
  244.

  245.
         Please remember that "prelude-adduser" should be used to register
  246.
         every server used by this analyzer.
  247.

  248.
         Enter the one-shot password provided by the "prelude-adduser"
 program:
  249.
         - enter registration one-shot password:
  250.
         - confirm registration one-shot password:
  251.
         - connecting to registration server (10.100.100.2:5553)...
  252.
         - GnuTLS handshake failed: GnuTLS internal error..
  253.

  254.
       Usage prelude-adduser <subcommand> [options] [args]
  255.
       Type "prelude-adduser <subcommand>" for help on a specific
 subcommand.
  256.

  257.
       Available subcommands:
  258.
        add
  259.
        chown
  260.
        del
  261.
        rename
  262.
        register
  263.
        registration-server
  264.
        revoke
  265.
       willy:/home/stefan#
  266.

  267.
       +++++++++++++++++++++
  268.

  269.
       and on management I get:
  270.
       root@comandante:~# /usr/local/bin/prelude-adduser registration-
 server prelude-manager
  271.

  272.
       - Using default TLS settings from
 /usr/local/etc/prelude/default/tls.conf:
  273.
         - Generated key size: 1024 bits.
  274.
         - Authority certificate lifetime: unlimited.
  275.
         - Generated certificate lifetime: unlimited.
  276.

  277.
       - Using analyzer prelude-manager.
  278.
         - Using /usr/local/etc/prelude/profile/prelude-manager...
  279.
         - Using already allocated ident for prelude-manager:
 3132535565104495.
  280.
         - Using /usr/local/var/spool/prelude/prelude-manager...
  281.

  282.
       - Starting registration server.
  283.
         - generated one-shot password is "xxxxx".
  284.

  285.
           This password will be requested by "prelude-adduser" in order to
 connect.
  286.
           Please remove the first and last quote from this password before
 using it.
  287.

  288.
         - Generating 1024 bits Diffie-Hellman key for anonymous
 authentication...
  289.
         - Waiting for peers install request on :::5553...
  290.
         - Waiting for peers install request on 0.0.0.0:5553...
  291.

  292.
         - Connection from ::ffff:x.x.x.x:58302.
  293.
         - GnuTLS handshake failed: GnuTLS internal error..

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/187#comment:1>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel