Re: Prelude and Ossec support
"Sebastien Tricaud" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
On 10/17/07, Robin Gruyters <[email protected]> wrote: > Although I get the following error: Hi robin, > > Profile 'OSSEC HIDS' does not exist. In order to create it, please run: > prelude-adduser register OSSEC HIDS "idmef:w" <manager address> --uid 0 --gid 0. I will fix this. > > > I have registered the ossec with the following command: > $ prelude-adduser register ossec "idmef:w admin:r" 127.0.0.1 --uid=<uid of ossec user> --gid=<gid of ossec user> > > The install documentation of Ossec stated to use the ossec uid/gid, but > aparently the command itself doesn't. Right, my mistake, I will fix it. > Aswell, it looks for "OSSEC HIDS" in the profile directory. Personally, I > don't think this would be a good thing to do, at least not for a sensor path > name with spaces in it... The name is set directly from Ossec code, and currently that should be "OSSEC HIDS". I added quotes in libprelude so that the right way to do registration will be displayed. Thanks, Sebastien. _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel