Re: Problem registering snort sensor on a FreeBSDmachine..

Figured this out, should be "prelude-admin registration-server
prelude-manager" on the manager server, and not "snort" or whatever
sensor you're using.  The documentation isn't very clear on this; I
thought I would use the same name on both ends of the transaction.

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Allen
Landsidel
Sent: Tuesday, July 01, 2008 8:37 AM
To: [email protected]
Subject: [prelude-user] Problem registering snort sensor on a
FreeBSDmachine..

Hey list.. I have an issue here with prelude on two FreeBSD 6 machines.
The manager is setup and running well monitoring itself and one other
server with prelude-lml and snort, but when I try to add another snort
sensor to a different machine, it looks like it's getting confused as to
the "analyzerID".  Obviously it won't register properly.

When I run the "prelude-admin register ..." command on the client and
the "prelude-admin registration-server ..." command on the
prelude-manager server machines, it successfully registers (or so it
says).  However, during the registration-server process I see this on
the server:

   Registration request for analyzerID="956159719198173"
permission="idmef:w".

That ID doesn't match what I see on the sensor:

   # prelude-admin list
   Profile Permission Issuer AnalyzerID
   -------------------------------
   snort idmef:w 3354241823991324


Both machines are FreeBSD 6.x/amd64, as is the other client which is
working just fine.

Any thoughts on this?  Thanks.
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user