Re: [Prelude Hybrid IDS] #216: mod_security cleanup, and compatibility with version 2.0

#216: mod_security cleanup, and compatibility with version 2.0
-------------------------+--------------------------------------------------
 Reporter:  gegomez      |        Owner:  Peter Vrabec <[email protected]>
     Type:  defect       |       Status:  assigned                         
 Priority:  normal       |    Milestone:  Prelude-LML 0.9.13               
Component:  prelude-lml  |      Version:  0.9                              
 Severity:  normal       |   Resolution:                                   
 Keywords:               |  
-------------------------+--------------------------------------------------

Comment(by [email protected]):

 Replying to [comment:10 yoann]:
 > Replying to [comment:7 [email protected]]:
 > > we appreciate any feedback on our mod_security 2.0 ruleset  attached
 by [email protected].
 >
 > Thanks! could you update the ruleset to include some log sample, using
 the following syntax:

 Yeah, I forgot. Fixed.

 > This is used for regression testing and reviewing generated alerts:
 > {{{
 >   cd prelude-lml/tests
 >   ./loggrep.py ../plugins/pcre/ruleset/<name of your ruleset>.rules |
 ../src/prelude-lml --dry-run --metadata=nowrite,head --batch-mode --no-
 resolve --pcre --dump-unmatched --config ./prelude-lml.conf --text-output
 > }}}

 I tested the ruleset "in action" (apache with modsec, prelude, prewikka)
 and it worked fine. However, I tried to test the ruleset using command you
 mentioned but it ends up with this error messages:

 {{{
 $ ./loggrep.py modsecurity.rules | ../src/prelude-lml --dry-run
 --metadata=nowrite,head --batch-mode --no-resolve --pcre --dump-unmatched
 --config ./prelude-lml.conf --text-output
 Invalid option -- "pcre" (0).
 Invalid option -- "dump-unmatched" (0).
 ./prelude-lml.conf:52: invalid section : "Pcre".
 ./prelude-lml.conf:53: invalid option "ruleset" in "global" section.
 01 Aug 15:44:51 (process:27226) ERROR: couldn't open config file
 /usr/local/etc/prelude-lml/plugins.rules. (regex.c:168 get_regex_table)
 01 Aug 15:44:51 (process:27226) WARNING: error while setting option
 'file': No such file or directory.
 Traceback (most recent call last):
   File "./loggrep.py", line 29, in <module>
     print i[:-1]
 IOError: [Errno 32] Broken pipe
 }}}

 Version of prelude-lml is 0.9.12.2

 {{{
 $ pwd
 /home/dkopecek/devel/prelude-lml/F-9/prelude-lml-0.9.12.2/tests
 $ make tests
 ./loggrep.py ../plugins/pcre/ruleset/*.rules | ../src/prelude-lml --quiet
 --dry-run --metadata=nowrite,head --batch-mode --no-resolve --pcre --dump-
 unmatched --config ./prelude-lml.conf 2>&1 | /bin/grep -Fvf ignored
 grep: ignored: No such file or directory
 Traceback (most recent call last):
   File "./loggrep.py", line 29, in <module>
     print i[:-1]
 IOError: [Errno 32] Broken pipe
 make: *** [tests] Error 2
 }}}

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/216#comment:11>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel