Re: New sensor for Linux deployments

Steve Grubb wrote:
> >
> > Then follow the HOWTO mentioned previously. Anyone wanting to play on Fedora 8
> > today would need to put SE Linux in permissive mode.
> >
> >

Hello Steve,

I can see the auditd sensor offline in the prewikka agent view, maybe
you start prelude with incorrect parameters. You may add:

prelude_client_set_flags(prelude_client,
prelude_client_get_flags(prelude_client) |
PRELUDE_CLIENT_FLAGS_ASYNC_TIMER);

To test auditd, I wrote a program to segfault and I got the following message:

        assessment:
                impact:
                        severity: low (2)
                        completion: (null) (-1)
                        type: other (0)
                        description: An application terminated
abnormally. An attacker may be trying to exploit a weakness in the program.

Few questions:
- Why do you consider this attack as low ? I guess a program
segfaulting, is (well should be) unusual and get a medium impact severity.
- Is there a reason why the completion is null ?


Anyway, this is great work, thanks!
Sebastien.
_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user