Re: Snort ERROR: prelude-client: Unable to initialize prelude client: TLS handshake failed...
Yoann Vandoorselaere <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <1247231191.31201.5.camel@arwen> |
Hi Christophe, Le mardi 19 mai 2009 à 17:45 +0200, christophe taranotte a écrit : > I build from ports, Prelude and Snort on a FreeBSD 7.2 i386 box. [...] > I added "output alert_prelude" to snort.conf and ran prelude-manager > (--debug-level=10) and snort on the foreground. > > When snort tries to connect to prelude-manager, it returns the following error: > > >>Initializing Network Interface xl0 > >>Decoding Ethernet on interface xl0 > >>19 May 17:13:38 (process:17662) INFO: Connecting to 192.0.0.12:4690 prelude Manager server. > >>ERROR: prelude-client: Unable to initialize prelude client: TLS handshake failed: A TLS packet with unexpected length was received.. > >> > >>In order to register this sensor, please run: > >>prelude-admin register snort "idmef:w" 192.0.0.12 --uid 0 --gid 0 > >> > >>Profile 'snort' does not exist. In order to create it, please run: > >>prelude-admin register "snort" "idmef:w" <manager address> --uid 0 --gid 0. > >>Fatal Error, Quitting.. > > While prelude-manager dies unexpedently showing no message: > > >>.... > >>19 May 17:13:32 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) > >>19 May 17:13:33 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) > >>19 May 17:13:34 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) > >>19 May 17:13:35 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) > >>19 May 17:13:36 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) > >>19 May 17:13:37 (process:17658) DEBUG: woke up 0 timer (prelude-timer.c:146 walk_and_wake_up_timer) > >># Ouch. This look really strange. Libgcrypt is known to exit silently in case of initialization failure, so that might be it. Could you please provide the full output of a prelude-manager session with the following environment variable set (this is trigger earlier than --debug-level=10): LIBPRELUDE_DEBUG=10 prelude-manager [optional arguments] Regards, -- Yoann Vandoorselaere <[email protected]> _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user