Re: Problems implementing Fedora 9 + Prelude + Snort 2.8
Steve Grubb <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
On Thursday 19 June 2008 13:57:11 Mr Andreas Panayiotis Karousios wrote: > Please ignore my previous email I found out that snortd and > prelude-manager do not start up properly. I'd suggest starting with troubleshooting why prelude-manager does not start up. Between it, auditd, and prewikka, you should see something. Then add snort to the mix. The HOWTO does it in that order to make sure that the core is working before adding other sensors. > As I said earlier I followed exactly the manual about Fedora > (http://people.redhat.com/sgrubb/audit/prelude.txt). Step 4 says you should start the prelude-manager and you should see the "OK" message. Did you get that when you first installed and now do not? Did prewikka work at the point when you set it up? Where in the steps did things go wrong? BTW, the snort steps are a work in progress. I decided some steps should be unnecessary if the package was corrected. In the last couple weeks a new snort package was released with those fixes which means I now have to fix the HOWTO. I also got an assigned uid/gid for snortd and prelude-manager, so I have to re-write all the HOWTO to use those. I will post the HOWTO to the Fedora Project wiki when I have verified the new instructions and patched the packages again. > when I start snort service I get a Failed message but for network > manager I get the following: > Warning : prelude-client: error initializing 'prelude-manager' does not > exist > "prelude-manager does not exist. In order to create it, please run > prelude-admin add "prelude-manager" --uid 0 --gid 0 > If I run that I get Could not create already existing profile > 'prelude-manager' You shouldn't get conflicting advice. :) Maybe Yoann (or someone else with code experience) has some idea of how systems get in this state. > Also > if I do prelude-admin list > I get : > Profile Permission Issuer AnalyzerID > ------------------------------------------------ > prelude-manager n/a n/a > auditd idmef:w 526534139443434 > snort idmef:w admin:r 526534139443434 This looks right compared to my system. > So what I'm I forgetting here? Do you get any audit events in prewikka? Does prewikka show any sensors registered? Any heart beats? -Steve _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user