Re: Question regarding analyzers registration management

Hi Paulo,

Le vendredi 12 septembre 2008 à 17:54 +0100, Paulo Ferreira a écrit :
> Hi,
> I tried to find the answer I need, on prelude documentation, but I
> didn't find any related to the remote registered analyzers management.
> 
> For example, if I add a new profile locally using prelude-admin add
> XXXX, I can list all profiles using prelude-admin list, and I can delete
> the local profiles using prelude-admin del XXXX.
> 
> But my doubt is, when I register a remote analyzer using prelude-admin
> register XXXX on the analyzer machine and prelude-admin
> registration-server on the prelude-manager server machine, how can I
> check how many analyzers are registered in the server and how can I
> delete an analyzer not allowing it to re-connect again later to the
> prelude-manager server?
> 
> Do you know how to do it or where is the documentation explaining such
> procedures?

Currently, prelude-admin registration-server does not keep track of
registered analyzer profile: thus, there is no option allowing to list
remotely registered agents.

However, you can revoke access of a given agent on your prelude-manager
server using the following command:

prelude-admin revoke 'prelude-manager-profile' 'analyzerid-to-revoke'.

After this operation, the remote agent using 'analyzerid-to-revoke'
won't be able to authenticate to prelude-manager anymore.

Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user