Re: [Prelude Hybrid IDS] #205: Problem with analyzer node location

#205: Problem with analyzer node location
-----------------------+----------------------------------------------------
 Reporter:  anonymous  |        Owner:  yoann
     Type:  defect     |       Status:  new  
 Priority:  normal     |    Milestone:       
Component:  generic    |      Version:  0.9  
 Severity:  normal     |   Resolution:       
 Keywords:             |  
-----------------------+----------------------------------------------------
Old description:

> Hello.
>
> I have created a program that use libprelude. I have the profile created
> and I have the following files on /etc/prelude/profile/myprogram:
>
> analyzerid:
> 1553731361191022
>

> client.conf:
> [prelude]
> server-addr = 192.168.100.211
>

> client.keycrt:
> -----BEGIN CERTIFICATE-----
> MIIB6TCCAVSgAwIBAgIIbjTcRRyFBQAwCwYJKoZIhvcNAQEFMBsxGTAXBgNVBC4T
> EDI4OTQ1NDcxMzQwNDU5NjYwHhcNMDcwMjIxMTMwMjE5WhcNMzgwMTE5MDMxNDA3
> WjAnMQowCAYDVQQDEwE2MRkwFwYDVQQuExAxNTUzNzMxMzYxMTkxMDIyMIGcMAsG
> CSqGSIb3DQEBAQOBjAAwgYgCgYC3pyCgcqVMaRRjZOKmhBnKgSq7rbpdAApEWYVY
> yC/m4t7r6RBeqMMbQfx+uU3l5zARg2lJnDZagu578tRZfg4Eke3+mWS7IyppiIa+
> HpRx8AgpwNcT7YLWfcy/NIFEGnBuIkPPehgAbzorMz7+WTcQoGOofUYACTiJ5Bf1
> F47v+QIDAQABozEwLzAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKpOlt0ggMjs
> kyCrGPPdJmFUe6IPMAsGCSqGSIb3DQEBBQOBgQB4aZpT8I+8wvyUAVU7Vg9XnHOZ
> aWwVN9fTcjrbjMrWZkthsoIrr5QwJ4I2UbkKDWv/4Fnf5e9ijlJJlzqCV6jy4czl
> hQRJP5pXRR8DpQBgivKFj9VrtHcg12v2iURgDYI/xTPZPfpl8cnEFYOn8ndjf09V
> cmkf7JDnj+1HzLt1uA==
> -----END CERTIFICATE-----
>

> client.trusted:
> -----BEGIN CERTIFICATE-----
> MIIB3TCCAUigAwIBAgIIDt+1RZNICgAwCwYJKoZIhvcNAQEFMBsxGTAXBgNVBC4T
> EDI4OTQ1NDcxMzQwNDU5NjYwHhcNMDcwMTIzMTAxMDIyWhcNMzgwMTE5MDMxNDA3
> WjAbMRkwFwYDVQQuExAyODk0NTQ3MTM0MDQ1OTY2MIGcMAsGCSqGSIb3DQEBAQOB
> jAAwgYgCgYC+kb67+WCjHIWh+w2rARxJ04MMqfw0lFudiU0mrm8w+2w1NQ+ZwvHf
> dAoEKBZ3w2wBiUc4DPxEo0urISB3pSpKuU9drYg6/S9dGJ0u4nk/o/PA0OeEXNMD
> 4T9xoUxiN9cQNxjwo36EB7QUxJRpD0XWpWOo+Ih601nHQ4fqPjNVrwIDAQABozEw
> LzAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFKpOlt0ggMjskyCrGPPdJmFUe6IP
> MAsGCSqGSIb3DQEBBQOBgQBUbnbynY0B6hvdAzCpmYhGCKOZwm8pNy2l5elwTGLc
> ZjsHKx3XDyROJoixizFyCjW+vFKHdcax3bGy46GmDTYKszFwjiBLXHTup626M+9s
> ksNnDVoUipzxVr5SkLF9DB5WDRCoG3GtkQk3oDB69q+UWFHPrp/7mX+CeN+GNLLd
> oA==
> -----END CERTIFICATE-----
>

> config:
> include = /etc/prelude/profile/assetscan/client.conf
> include = /etc/prelude/profile/assetscan/global.conf
>

> global.conf:
> [prelude]
> node-name = pruebas2
> node-location = 192.168.100.254
> heartbeat-interval=600
>

> key:
> -----BEGIN RSA PRIVATE KEY-----
> MIICWwIBAAKBgQC3pyCgcqVMaRRjZOKmhBnKgSq7rbpdAApEWYVYyC/m4t7r6RBe
> qMMbQfx+uU3l5zARg2lJnDZagu578tRZfg4Eke3+mWS7IyppiIa+HpRx8AgpwNcT
> 7YLWfcy/NIFEGnBuIkPPehgAbzorMz7+WTcQoGOofUYACTiJ5Bf1F47v+QIDAQAB
> AoGAYz4eJHYvmy4BhYCj9iXWphbM1+SWm+EEq1DQ/VwYfqVEn6kvXmfGHzm2T2il
> jsIyuJQR1mRi/uBYLYTYeY/j1GsYEyF/809IPGjPsyEtBcW2+EtDVj+JZ3DGrFOp
> PZdaa6WEN+6kKxiFvBajr+2VqRqfJZkNPe/x/6xIBp/N3QECQQDtPouF819E0lxG
> kd2ldYdFdSEMOFw112yjtYqqBkV8bSi5A8m6KuTftAJ3Ic/JVYXlNWStLn55/DBY
> FiczwyYhAkEAxiv5fLZDVUO4VCofenFHiKF9uFS3C840bJk9RUjP33td34Kz7Fow
> Usa99XW8LNLXW/ip1eXELxbDktjy87Pe2QJANgZkJ2DAdR+iO7/DxYX6A+skV3AO
> L4SbDLyukwFSmX8SIu+l5GsYK4kGdrKQary6/PMntfg8fPLc33JMAxGRgQJARk2/
> esDmbk9SC3nOJRAfApfYFBbpwWRsMMLEe9ny9SO9D9g8oHL2hcdACN613WkHQfeb
> uOiEivgWdfhFaLO9MQJANW07UuMRyGORR8F4Co0ilk4z0aF7bV90xYNzkm7UGO93
> vvP7JdPUfw4qYU/uJjDABzMhmHAJzvvHiNJL3pjjqQ==
> -----END RSA PRIVATE KEY-----
>

>

> The program sends properly alerts but the node-location is not present.
>
> I use similar file for prelude-lml analyzer and the node locations is the
> one indicated on its global.conf file.
>

> Thanks a lot for the help
>

> Helllen

New description:

 Hello.

 I have created a program that use libprelude. I have the profile created
 and I have the following files on /etc/prelude/profile/myprogram:

 analyzerid:
 {{{
 1553731361191022
 }}}

 client.conf:
 {{{
 [prelude]
 server-addr = 192.168.100.211
 }}}


 config:
 {{{
 include = /etc/prelude/profile/assetscan/client.conf
 include = /etc/prelude/profile/assetscan/global.conf
 }}}

 global.conf:
 {{{
 [prelude]
 node-name = pruebas2
 node-location = 192.168.100.254
 heartbeat-interval=600
 }}}

 The program sends properly alerts but the node-location is not present.

 I use similar file for prelude-lml analyzer and the node locations is the
 one indicated on its global.conf file.


 Thanks a lot for the help


 Helllen

Comment (by yoann):

 The problem might be related to your code, could you please provide a
 pointer to the program exhibiting this behavior?

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/205#comment:1>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel