prelude-admin add command hangs indefinitely

[email protected]
Newsgroups gmane.comp.security.ids.prelude.user
Message-ID <[email protected]>
I'm setting up Prelude-IDS with Auditd on SuSE 10.2 s390x (linux guest 
under z/VM) following the steps on the prelude site at 
http://www.prelude-ids.com

During the step where I am Registering Auditd profile (per 
instructions: 
https://trac.prelude-ids.org/wiki/InstallingAgentThirdpartyAuditd ) the 
system is hanging indefinitely.

I realize there's a warning stating "Generating 1024 bits RSA private 
key... This might take a very long time." but this is taking a 
gawd-awful long time. I left it for several hours and the progress bar 
of "X"s didnt move at ALL.  Is that long enough, or am I being too 
impatient?


/root/audit> #prelude-admin add prelude-manager --uid 0 -
-gid 0
Generating 1024 bits RSA private key... This might take a very long 
time.
[Increasing system activity will speed-up the process].
Generation in progress... X



thats all I get.



After several (4+) hours, I stopped it and ran an strace to see where 
it was hanging:

chown("/usr/local/etc/prelude/profile/prelude-manager", 0, 0) = 0
access("/usr/local/etc/prelude/profile/prelude-manager/key", F_OK) = -1 
ENOENT (
No such file or directory)
write(2, "Generating 1024 bits RSA private"..., 74Generating 1024 bits 
RSA priva
te key... This might take a very long time.
) = 74
write(2, "[Increasing system activity will"..., 56[Increasing system 
activity wi
ll speed-up the process].
) = 56
write(2, "Generation in progress... ", 26Generation in progress... ) = 
26
access("/dev/random", R_OK)             = 0
access("/dev/urandom", R_OK)            = 0
open("/dev/random", O_RDONLY)           = 3
select(4, [3], NULL, NULL, {3, 0}
select(4, [3], NULL, NULL, {3, 0})      = 0 (Timeout)
write(2, "X", 1X)                        = 1
select(4, [3], NULL, NULL, {3, 0})      = 0 (Timeout)
select(4, [3], NULL, NULL, {3, 0})      = 0 (Timeout)
select(4, [3], NULL, NULL, {3, 0})      = 0 (Timeout)
select(4, [3], NULL, NULL, {3, 0})      = 0 (Timeout)
select(4, [3], NULL, NULL, {3, 0})      = 0 (Timeout)
select(4, [3], NULL, NULL, {3, 0})      = 0 (Timeout)
select(4, [3], NULL, NULL, {3, 0})      = 0 (Timeout)
select(4, [3], NULL, NULL, {3, 0})      = 1 (in [3], left {2, 750000})
read(3, "T\242o\372\7\336\'\301", 300)  = 8
select(4, [3], NULL, NULL, {3, 0})      = 0 (Timeout)
select(4, [3], NULL, NULL, {3, 0}



last line repeats indefinitely.



In an attempt to find some way around the key generation step, I ran:

ssh-keygen -b 1024 -t rsa -f 
/usr/local/etc/prelude/profile/prelude-manager/key

to mimic what prelude-admin seemed to be trying to do. That command 
generated a key in less than a second:

Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in 
/usr/local/etc/prelude/profile/prelude-man
ager/key.
Your public key has been saved in 
/usr/local/etc/prelude/profile/prelude-manager
/key.pub.
The key fingerprint is:
e7:ea:02:88:fd:40:29:6b:d1:e9:4e:89:b2:af:7f:b1 root@a70zfaiflg1
[TFAIFLG1-a70zfaiflg1]:/root/audit> #prelude-admin add prelude-manager 
--uid 0 -
-gid 0
Created profile 'prelude-manager' with analyzerID '5242616976203226851'.



Is this adequate? or am I headed for trouble trying to get ssh-keygen 
keys to work?
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.