Re: ossec and prelude

Hi
I ran the following command on my ossec machine:

root@localhost ~ # prelude-adduser del OSSEC

and then

root@localhost ~ # prelude-adduser register OSSEC "idmef:w admin:r"
192.168.8.31  --uid 515 --gid 516

- Using default TLS settings from /etc/prelude/default/tls.conf:
  - Generated key size: 1024 bits.
  - Authority certificate lifetime: unlimited.
  - Generated certificate lifetime: unlimited.

- Creating analyzer OSSEC.
  - Creating /etc/prelude/profile/OSSEC...
  - Allocated ident for OSSEC: 788183577914045.
    - Generating RSA private key... This might take a very long time.
      [Increasing system activity will speed-up the process.]

    - Generating 1024 bits RSA private key... Done.

  - Creating /var/spool/prelude/OSSEC...

- Registering analyzer OSSEC to 192.168.8.31:5553.

  You now need to start "prelude-adduser" on the server host where
  you need to register to:

  use: "prelude-adduser registration-server <analyzer profile>"
  example: "prelude-adduser registration-server prelude-manager"

  This is used in order to register the 'sending' analyzer to the
'receiving'
  analyzer. <analyzer profile> should be set to the profile name of the
  'receiving' analyzer, the one where 'sending' analyzer will register
to.

  Please remember that "prelude-adduser" should be used to register
  every server used by this analyzer.

  Enter the one-shot password provided by the "prelude-adduser" program:
  - enter registration one-shot password:


after this i ran the following command on my prelude-manager machine:

root@prelude ~ # prelude-admin registration-server prelude-manager

The "qqq223w7" password will be requested by "prelude-admin register"
in order to connect. Please remove the quotes before using it.

Generating 1024 bits Diffie-Hellman key for anonymous authentication...
Waiting for peers install request on :::5553...
Waiting for peers install request on 0.0.0.0:5553...


I entered the pass qqq223w7 on my ossec machine and approved
registration on prelude-manager machine after which i received
segmentation fault on ossec machine as shown below:

- enter registration one-shot password:
  - confirm registration one-shot password:
  - connecting to registration server (192.168.8.31:5553)...
  - Anonymous authentication to registration-server successful.
  - Sending certificate request.
  - Receiving signed certificate.
Segmentation fault

Please help.

On Mon, 2009-06-08 at 14:01 +0530, Yoann Vandoorselaere wrote:
> Hi,
> 
> Le jeudi 04 juin 2009 à 17:51 +0530, lovewadhwa a écrit :
> > i registered ossec as sensor .When i try to restart ossec i m getting
> > the following error:
> > 
> > ossec-analysisd: prelude-client: Unable to initialize prelude client:
> > could not set x509 trust file
> > '/etc/prelude/profile/OSSEC/client.trusted': Error while reading file.
> > 
> > Profile 'OSSEC' does not exist. In order to create it, please run:
> > prelude-adduser register OSSEC "idmef:w" <manager address> --uid 515
> > --gid 516.
> > 
> > While i have profile OSSEC created in /etc/prelude/profile, but he
> > client.trusted file doesn't exist in the specified path.I have tried
> > registering again but receive the same error.
> 
> Before registering OSSEC again, please start by deleting your existing
> profile using the following command: 
>  
> prelude-admin del OSSEC
> 
> Then do the whole registration procedure again. If the problem still
> arise, please send us the typescript of the whole registration
> procedure, so we can have a look at what is going on.
> 
> Regards,
> 

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user