Re: Prelude and Ossec support

Although I get the following error:

Starting OSSEC HIDS v1.4 (by Daniel B. Cid)...
2007/10/17 11:57:35 ossec-analysisd: prelude-client: Unable to initialize prelude client: could not open '/usr/local/etc/prelude/profile/OSSEC HIDS/config' for reading: No such file or directory

Profile 'OSSEC HIDS' does not exist. In order to create it, please run:
prelude-adduser register OSSEC HIDS "idmef:w" <manager address> --uid 0 --gid 0.
2007/10/17 11:57:35 rules_list: Group 'connection_attempt' not found. Invalid 'if_group'.
ossec-analysisd: Configuration error. Exiting


I have registered the ossec with the following command:
$ prelude-adduser register ossec "idmef:w admin:r" 127.0.0.1 --uid=<uid of ossec user> --gid=<gid of ossec user>

The install documentation of Ossec stated to use the ossec uid/gid, but
aparently the command itself doesn't.
Aswell, it looks for "OSSEC HIDS" in the profile directory. Personally, I 
don't think this would be a good thing to do, at least not for a sensor path
name with spaces in it...

Kind regards,
-- 
Robin Gruyters
Network and Security Engineer
YIRDIS - Betronic Services
I: http://yirdis.com
I: http://betronic.nl
P: +31 (0)20 5659191
F: +31 (0)20 5659190

On Wed, Oct 17, 2007 at 10:18:55AM +0200, Sebastien Tricaud wrote:
> Hi folks,
> 
> A new release of Ossec is available, it is beta2 before releasing the
> next stable that will be 1.4.
> 
> You can grab it here:
> http://www.ossec.net/files/snapshots/ossec-hids-071016.tar.gz
> 
> Installation instructions available there:
> http://www.prelude-ids.org/pipermail/prelude-devel/2007-October/001920.html
> 
> Please test and report anything here so that we could fix stuff before
> it get frozen.
> 
> 
> Thanks,
> Sebastien.
> _______________________________________________
> Prelude-devel site list
> [email protected]
> http://www.prelude-ids.org/mailman/listinfo/prelude-devel

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.3 (FreeBSD)

iD8DBQFHFd5CLh3hlgHmc7MRAgsnAJ49NGpZJCjwQ4/cRQjOM5eRkWbsJQCffVZA
jQIx+BPJJAv8j2CK1yCA5DM=
=ZrVd
-----END PGP SIGNATURE-----