[Prelude Hybrid IDS] #205: Problem with analyzer node location

#205: Problem with analyzer node location
-----------------------+----------------------------------------------------
 Reporter:  anonymous  |       Owner:  yoann
     Type:  defect     |      Status:  new  
 Priority:  normal     |   Milestone:       
Component:  generic    |     Version:  0.9  
 Severity:  normal     |    Keywords:       
-----------------------+----------------------------------------------------
 Hello.

 I have created a program that use libprelude. I have the profile created
 and I have the following files on /etc/prelude/profile/myprogram:

 analyzerid:
 1553731361191022


 client.conf:
 [prelude]
 server-addr = 192.168.100.211


 client.keycrt:
 -----BEGIN CERTIFICATE-----
 MIIB6TCCAVSgAwIBAgIIbjTcRRyFBQAwCwYJKoZIhvcNAQEFMBsxGTAXBgNVBC4T
 EDI4OTQ1NDcxMzQwNDU5NjYwHhcNMDcwMjIxMTMwMjE5WhcNMzgwMTE5MDMxNDA3
 WjAnMQowCAYDVQQDEwE2MRkwFwYDVQQuExAxNTUzNzMxMzYxMTkxMDIyMIGcMAsG
 CSqGSIb3DQEBAQOBjAAwgYgCgYC3pyCgcqVMaRRjZOKmhBnKgSq7rbpdAApEWYVY
 yC/m4t7r6RBeqMMbQfx+uU3l5zARg2lJnDZagu578tRZfg4Eke3+mWS7IyppiIa+
 HpRx8AgpwNcT7YLWfcy/NIFEGnBuIkPPehgAbzorMz7+WTcQoGOofUYACTiJ5Bf1
 F47v+QIDAQABozEwLzAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKpOlt0ggMjs
 kyCrGPPdJmFUe6IPMAsGCSqGSIb3DQEBBQOBgQB4aZpT8I+8wvyUAVU7Vg9XnHOZ
 aWwVN9fTcjrbjMrWZkthsoIrr5QwJ4I2UbkKDWv/4Fnf5e9ijlJJlzqCV6jy4czl
 hQRJP5pXRR8DpQBgivKFj9VrtHcg12v2iURgDYI/xTPZPfpl8cnEFYOn8ndjf09V
 cmkf7JDnj+1HzLt1uA==
 -----END CERTIFICATE-----


 client.trusted:
 -----BEGIN CERTIFICATE-----
 MIIB3TCCAUigAwIBAgIIDt+1RZNICgAwCwYJKoZIhvcNAQEFMBsxGTAXBgNVBC4T
 EDI4OTQ1NDcxMzQwNDU5NjYwHhcNMDcwMTIzMTAxMDIyWhcNMzgwMTE5MDMxNDA3
 WjAbMRkwFwYDVQQuExAyODk0NTQ3MTM0MDQ1OTY2MIGcMAsGCSqGSIb3DQEBAQOB
 jAAwgYgCgYC+kb67+WCjHIWh+w2rARxJ04MMqfw0lFudiU0mrm8w+2w1NQ+ZwvHf
 dAoEKBZ3w2wBiUc4DPxEo0urISB3pSpKuU9drYg6/S9dGJ0u4nk/o/PA0OeEXNMD
 4T9xoUxiN9cQNxjwo36EB7QUxJRpD0XWpWOo+Ih601nHQ4fqPjNVrwIDAQABozEw
 LzAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKpOlt0ggMjskyCrGPPdJmFUe6IP
 MAsGCSqGSIb3DQEBBQOBgQBUbnbynY0B6hvdAzCpmYhGCKOZwm8pNy2l5elwTGLc
 ZjsHKx3XDyROJoixizFyCjW+vFKHdcax3bGy46GmDTYKszFwjiBLXHTup626M+9s
 ksNnDVoUipzxVr5SkLF9DB5WDRCoG3GtkQk3oDB69q+UWFHPrp/7mX+CeN+GNLLd
 oA==
 -----END CERTIFICATE-----


 config:
 include = /etc/prelude/profile/assetscan/client.conf
 include = /etc/prelude/profile/assetscan/global.conf


 global.conf:
 [prelude]
 node-name = pruebas2
 node-location = 192.168.100.254
 heartbeat-interval=600


 key:
 -----BEGIN RSA PRIVATE KEY-----
 MIICWwIBAAKBgQC3pyCgcqVMaRRjZOKmhBnKgSq7rbpdAApEWYVYyC/m4t7r6RBe
 qMMbQfx+uU3l5zARg2lJnDZagu578tRZfg4Eke3+mWS7IyppiIa+HpRx8AgpwNcT
 7YLWfcy/NIFEGnBuIkPPehgAbzorMz7+WTcQoGOofUYACTiJ5Bf1F47v+QIDAQAB
 AoGAYz4eJHYvmy4BhYCj9iXWphbM1+SWm+EEq1DQ/VwYfqVEn6kvXmfGHzm2T2il
 jsIyuJQR1mRi/uBYLYTYeY/j1GsYEyF/809IPGjPsyEtBcW2+EtDVj+JZ3DGrFOp
 PZdaa6WEN+6kKxiFvBajr+2VqRqfJZkNPe/x/6xIBp/N3QECQQDtPouF819E0lxG
 kd2ldYdFdSEMOFw112yjtYqqBkV8bSi5A8m6KuTftAJ3Ic/JVYXlNWStLn55/DBY
 FiczwyYhAkEAxiv5fLZDVUO4VCofenFHiKF9uFS3C840bJk9RUjP33td34Kz7Fow
 Usa99XW8LNLXW/ip1eXELxbDktjy87Pe2QJANgZkJ2DAdR+iO7/DxYX6A+skV3AO
 L4SbDLyukwFSmX8SIu+l5GsYK4kGdrKQary6/PMntfg8fPLc33JMAxGRgQJARk2/
 esDmbk9SC3nOJRAfApfYFBbpwWRsMMLEe9ny9SO9D9g8oHL2hcdACN613WkHQfeb
 uOiEivgWdfhFaLO9MQJANW07UuMRyGORR8F4Co0ilk4z0aF7bV90xYNzkm7UGO93
 vvP7JdPUfw4qYU/uJjDABzMhmHAJzvvHiNJL3pjjqQ==
 -----END RSA PRIVATE KEY-----




 The program sends properly alerts but the node-location is not present.

 I use similar file for prelude-lml analyzer and the node locations is the
 one indicated on its global.conf file.


 Thanks a lot for the help


 Helllen

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/205>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel