Re: ossec and prelude

anybody out there to help me out please.

On Tue, 2009-06-09 at 10:30 +0530, lovewadhwa wrote:
> Hi
> I ran the following command on my ossec machine:
> 
> root@localhost ~ # prelude-adduser del OSSEC
> 
> and then
> 
> root@localhost ~ # prelude-adduser register OSSEC "idmef:w admin:r"
> 192.168.8.31  --uid 515 --gid 516
> 
> - Using default TLS settings from /etc/prelude/default/tls.conf:
>   - Generated key size: 1024 bits.
>   - Authority certificate lifetime: unlimited.
>   - Generated certificate lifetime: unlimited.
> 
> - Creating analyzer OSSEC.
>   - Creating /etc/prelude/profile/OSSEC...
>   - Allocated ident for OSSEC: 788183577914045.
>     - Generating RSA private key... This might take a very long time.
>       [Increasing system activity will speed-up the process.]
> 
>     - Generating 1024 bits RSA private key... Done.
> 
>   - Creating /var/spool/prelude/OSSEC...
> 
> - Registering analyzer OSSEC to 192.168.8.31:5553.
> 
>   You now need to start "prelude-adduser" on the server host where
>   you need to register to:
> 
>   use: "prelude-adduser registration-server <analyzer profile>"
>   example: "prelude-adduser registration-server prelude-manager"
> 
>   This is used in order to register the 'sending' analyzer to the
> 'receiving'
>   analyzer. <analyzer profile> should be set to the profile name of the
>   'receiving' analyzer, the one where 'sending' analyzer will register
> to.
> 
>   Please remember that "prelude-adduser" should be used to register
>   every server used by this analyzer.
> 
>   Enter the one-shot password provided by the "prelude-adduser" program:
>   - enter registration one-shot password:
> 
> 
> after this i ran the following command on my prelude-manager machine:
> 
> root@prelude ~ # prelude-admin registration-server prelude-manager
> 
> The "qqq223w7" password will be requested by "prelude-admin register"
> in order to connect. Please remove the quotes before using it.
> 
> Generating 1024 bits Diffie-Hellman key for anonymous authentication...
> Waiting for peers install request on :::5553...
> Waiting for peers install request on 0.0.0.0:5553...
> 
> 
> I entered the pass qqq223w7 on my ossec machine and approved
> registration on prelude-manager machine after which i received
> segmentation fault on ossec machine as shown below:
> 
> - enter registration one-shot password:
>   - confirm registration one-shot password:
>   - connecting to registration server (192.168.8.31:5553)...
>   - Anonymous authentication to registration-server successful.
>   - Sending certificate request.
>   - Receiving signed certificate.
> Segmentation fault
> 
> Please help.
> 
> On Mon, 2009-06-08 at 14:01 +0530, Yoann Vandoorselaere wrote:
> > Hi,
> > 
> > Le jeudi 04 juin 2009 à 17:51 +0530, lovewadhwa a écrit :
> > > i registered ossec as sensor .When i try to restart ossec i m getting
> > > the following error:
> > > 
> > > ossec-analysisd: prelude-client: Unable to initialize prelude client:
> > > could not set x509 trust file
> > > '/etc/prelude/profile/OSSEC/client.trusted': Error while reading file.
> > > 
> > > Profile 'OSSEC' does not exist. In order to create it, please run:
> > > prelude-adduser register OSSEC "idmef:w" <manager address> --uid 515
> > > --gid 516.
> > > 
> > > While i have profile OSSEC created in /etc/prelude/profile, but he
> > > client.trusted file doesn't exist in the specified path.I have tried
> > > registering again but receive the same error.
> > 
> > Before registering OSSEC again, please start by deleting your existing
> > profile using the following command: 
> >  
> > prelude-admin del OSSEC
> > 
> > Then do the whole registration procedure again. If the problem still
> > arise, please send us the typescript of the whole registration
> > procedure, so we can have a look at what is going on.
> > 
> > Regards,
> > 
> 
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user