Re: Prelude and Ossec support

Hello Robin,

I would suggest you to ask this on the Ossec mailing list, since it is
not Prelude related and I am not an Ossec expert ;-)




On 10/18/07, Robin Gruyters <[email protected]> wrote:
> Ok, now a different problem:
>
> {{{
> - Connecting to 10.8.0.3:4690 prelude Manager server.
> - TLS authentication succeed with Prelude Manager.
> 2007/10/18 10:15:06 rules_list: Group 'connection_attempt' not found. Invalid 'if_group'.
> ossec-analysisd: Configuration error. Exiting
> }}}
>
> {{{
> $ cd rules
> $ grep connection_attempt *
> attack_rules.xml:    <if_matched_group>connection_attempt</if_matched_group>
> courier_rules.xml:    <group>connection_attempt,</group>
> ftpd_rules.xml:    <group>connection_attempt</group>
> ms_ftpd_rules.xml:    <group>connection_attempt,</group>
> proftpd_rules.xml:    <group>connection_attempt,</group>
> proftpd_rules.xml:    <group>connection_attempt,</group>
> pure-ftpd_rules.xml:    <group>connection_attempt,</group>
> vsftpd_rules.xml:    <group>connection_attempt</group>
> }}}
>
> I have the following rules included in our ossec.conf:
> {{{
>   <rules>
>     <include>rules_config.xml</include>
>     <include>pam_rules.xml</include>
>     <include>sshd_rules.xml</include>
>     <include>telnetd_rules.xml</include>
>     <include>syslog_rules.xml</include>
>     <include>arpwatch_rules.xml</include>
>     <include>named_rules.xml</include>
>     <include>smbd_rules.xml</include>
>     <include>hordeimp_rules.xml</include>
>     <include>web_rules.xml</include>
>     <include>apache_rules.xml</include>
>     <include>mysql_rules.xml</include>
>     <include>postgresql_rules.xml</include>
>     <include>ids_rules.xml</include>
>     <include>firewall_rules.xml</include>
>     <include>cisco-ios_rules.xml</include>
>     <include>sendmail_rules.xml</include>
>     <include>imapd_rules.xml</include>
>     <include>racoon_rules.xml</include>
>     <include>vpn_concentrator_rules.xml</include>
>     <include>attack_rules.xml</include>
>     <include>ossec_rules.xml</include>
>     <include>local_rules.xml</include>
>   </rules>
> }}}
>
> Kind regards,
> --
> Robin Gruyters
> Network and Security Engineer
> YIRDIS - Betronic Services
> I: http://yirdis.com
> I: http://betronic.nl
> P: +31 (0)20 5659191
> F: +31 (0)20 5659190
>
>
> On Wed, Oct 17, 2007 at 02:37:02PM +0200, Sebastien Tricaud wrote:
> > On 10/17/07, Robin Gruyters <[email protected]> wrote:
> > > Although I get the following error:
> >
> > Hi robin,
> >
> > >
> > > Profile 'OSSEC HIDS' does not exist. In order to create it, please run:
> > > prelude-adduser register OSSEC HIDS "idmef:w" <manager address> --uid 0 --gid 0.
> >
> > I will fix this.
> >
> > >
> > >
> > > I have registered the ossec with the following command:
> > > $ prelude-adduser register ossec "idmef:w admin:r" 127.0.0.1 --uid=<uid of ossec user> --gid=<gid of ossec user>
> > >
> > > The install documentation of Ossec stated to use the ossec uid/gid, but
> > > aparently the command itself doesn't.
> >
> > Right, my mistake, I will fix it.
> >
> > > Aswell, it looks for "OSSEC HIDS" in the profile directory. Personally, I
> > > don't think this would be a good thing to do, at least not for a sensor path
> > > name with spaces in it...
> >
> > The name is set directly from Ossec code, and currently that should be
> > "OSSEC HIDS". I added quotes in libprelude so that the right way to do
> > registration will be displayed.
> >
> >
> > Thanks,
> > Sebastien.
>
>
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel