Re: Prelude and Ossec support

Ok, now a different problem:

{{{
- Connecting to 10.8.0.3:4690 prelude Manager server.
- TLS authentication succeed with Prelude Manager.
2007/10/18 10:15:06 rules_list: Group 'connection_attempt' not found. Invalid 'if_group'.
ossec-analysisd: Configuration error. Exiting
}}}

{{{
$ cd rules
$ grep connection_attempt *
attack_rules.xml:    <if_matched_group>connection_attempt</if_matched_group>
courier_rules.xml:    <group>connection_attempt,</group>
ftpd_rules.xml:    <group>connection_attempt</group>
ms_ftpd_rules.xml:    <group>connection_attempt,</group>
proftpd_rules.xml:    <group>connection_attempt,</group>
proftpd_rules.xml:    <group>connection_attempt,</group>
pure-ftpd_rules.xml:    <group>connection_attempt,</group>
vsftpd_rules.xml:    <group>connection_attempt</group>
}}}

I have the following rules included in our ossec.conf:
{{{
  <rules>
    <include>rules_config.xml</include>
    <include>pam_rules.xml</include>
    <include>sshd_rules.xml</include>
    <include>telnetd_rules.xml</include>
    <include>syslog_rules.xml</include>
    <include>arpwatch_rules.xml</include>
    <include>named_rules.xml</include>
    <include>smbd_rules.xml</include>
    <include>hordeimp_rules.xml</include>
    <include>web_rules.xml</include>
    <include>apache_rules.xml</include>
    <include>mysql_rules.xml</include>
    <include>postgresql_rules.xml</include>
    <include>ids_rules.xml</include>
    <include>firewall_rules.xml</include>
    <include>cisco-ios_rules.xml</include>
    <include>sendmail_rules.xml</include>
    <include>imapd_rules.xml</include>
    <include>racoon_rules.xml</include>
    <include>vpn_concentrator_rules.xml</include>
    <include>attack_rules.xml</include>
    <include>ossec_rules.xml</include>
    <include>local_rules.xml</include>
  </rules>
}}}

Kind regards,
-- 
Robin Gruyters
Network and Security Engineer
YIRDIS - Betronic Services
I: http://yirdis.com
I: http://betronic.nl
P: +31 (0)20 5659191
F: +31 (0)20 5659190


On Wed, Oct 17, 2007 at 02:37:02PM +0200, Sebastien Tricaud wrote:
> On 10/17/07, Robin Gruyters <[email protected]> wrote:
> > Although I get the following error:
> 
> Hi robin,
> 
> >
> > Profile 'OSSEC HIDS' does not exist. In order to create it, please run:
> > prelude-adduser register OSSEC HIDS "idmef:w" <manager address> --uid 0 --gid 0.
> 
> I will fix this.
> 
> >
> >
> > I have registered the ossec with the following command:
> > $ prelude-adduser register ossec "idmef:w admin:r" 127.0.0.1 --uid=<uid of ossec user> --gid=<gid of ossec user>
> >
> > The install documentation of Ossec stated to use the ossec uid/gid, but
> > aparently the command itself doesn't.
> 
> Right, my mistake, I will fix it.
> 
> > Aswell, it looks for "OSSEC HIDS" in the profile directory. Personally, I
> > don't think this would be a good thing to do, at least not for a sensor path
> > name with spaces in it...
> 
> The name is set directly from Ossec code, and currently that should be
> "OSSEC HIDS". I added quotes in libprelude so that the right way to do
> registration will be displayed.
> 
> 
> Thanks,
> Sebastien.

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.3 (FreeBSD)

iD8DBQFHFxduLh3hlgHmc7MRAoJ+AJ9Gju9zit8q6qfXTWhiPtRdmLqs1wCglR7v
mn7jWwaPoYRhwWaNu/8BClw=
=b6xJ
-----END PGP SIGNATURE-----