Snort ERROR: prelude-client: Unable to initialize prelude client: TLS handshake failed...
christophe taranotte <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Bonjour, I build from ports, Prelude and Snort on a FreeBSD 7.2 i386 box. I sticked to the docs and I registred two users (uid=0, gid=0) with prelude-manager as shown below: >>Profile Permission Issuer AnalyzerID >>-------------------------------------------------------------------------------------- >>prelude-manager idmef:rw admin:rw 598728273677580 >>snort idmef:w admin:r 112048349495541 I added "output alert_prelude" to snort.conf and ran prelude-manager (--debug-level=10) and snort on the foreground. When snort tries to connect to prelude-manager, it returns the following error: >>Initializing Network Interface xl0 >>Decoding Ethernet on interface xl0 >>19 May 17:13:38 (process:17662) INFO: Connecting to 192.0.0.12:4690 prelude Manager server. >>ERROR: prelude-client: Unable to initialize prelude client: TLS handshake failed: A TLS packet with unexpected length was received.. >> >>In order to register this sensor, please run: >>prelude-admin register snort "idmef:w" 192.0.0.12 --uid 0 --gid 0 >> >>Profile 'snort' does not exist. In order to create it, please run: >>prelude-admin register "snort" "idmef:w" <manager address> --uid 0 --gid 0. >>Fatal Error, Quitting.. While prelude-manager dies unexpedently showing no message: >>.... >>19 May 17:13:32 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) >>19 May 17:13:33 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) >>19 May 17:13:34 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) >>19 May 17:13:35 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) >>19 May 17:13:36 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) >>19 May 17:13:37 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) >># The installed port versions are: >>prelude-manager-0.9.14.2_2 >>libprelude-0.9.21.2 >>libpreludedb-0.9.15.1_1 >>gnutls-2.6.5 >>snort-2.8.4.1 My prelude-manager.conf is as follows: >>include = /usr/local/etc/prelude/default/global.conf >>listen = 192.0.0.12 >>connection-timeout = 10 >>sched-priority = high:50 medium:30 low:20 >>sched-buffer-size = 10M >>tls-options = NORMAL >> >>[db] >>type = pgsql >>host = 192.0.0.12 >>port = 55972 >>name = somepgsqldb >>user = somepgsqluser >>pass = somepasswd I reinstalled Prelude and Snort to no avail. Where did I take the wrong turn? Regards, Christophe _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user