Re: New sensor for Linux deployments
Steve Grubb <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
On Saturday 02 February 2008 12:38:39 Yoann Vandoorselaere wrote: > > Since the name of the sensor changed, you will have to re-register it > > with prelude-manager. I think the name will be stable from here out. The > > new name is simply auditd. I put some instructions in the audisp-prelude > > man page. > > A great addition would be the ability to configure the auditd prelude > profile from the auditd configuration file. Great idea. I'll add that to the TODO file so I remember it. I want to let people try this plugin for a few weeks to see if anyone has feedback about performance, improvements, and whether its useful. I plan to push the new plugin into Fedora in about 6-8 days. We are working on the SE Linux policy to let it run without problems. If anyone is running Fedora 8 and would like to give it a try, use this command: yum --enablerepo=updates-testing install audispd-plugins Then follow the HOWTO mentioned previously. Anyone wanting to play on Fedora 8 today would need to put SE Linux in permissive mode. Best Regards, -Steve _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user