Re: registration and connection error

IMHO
you have to register OSSEC with

prelude-admin register ossec "idmef:w" 192.168.1.1 --uid 1001 --gid 1001

before you must delete your prelvios registered OSSEC agent

and after that check your registered agents
prelude-admin list -l


On Tue, Aug 25, 2009 at 1:01 PM, luvalentin <[email protected]> wrote:
> Hello,
>
> I have a problem with prelude-manager and ossec registration.
>
> First, I installed correctly ossec to set prelude:
>
> $ cd ossec-hids-xx
> $ cd src; make setprelude; cd ..
> $ ./install.sh
>
> and I wrote in ossec.conf:
>
>
> yes
>
>
> ossec
>
>
> 1
>
>
>
> then I started prelude-manager (and prelude-correlator in local). And I began registration:
>
> on prelude-manager host (192.168.1.1):
>
> prelude-admin registration-server prelude-manager
>
> on ossec host (192.168.1.2):
>
> prelude-admin register ossec "idmef:w admin:r" 192.168.1.1
>
> registration was a success
>
> but when I started ossec, I had an error on ossec host:
>
> "
> 28 Jul 11:20:35 (process:8340) INFO: Connecting to 192.168.1.1:4690 prelude Manager server.
> 2009/07/28 11:20:36 ossec-analysisd: prelude-client: Unable to initialize prelude client: TLS server certificate not yet activated.
>
> In order to register this sensor, please run:
> prelude-admin register ossec "idmef:w" 192.168.1.1 --uid 1001 --gid 1001
>
> Profile 'ossec' does not exist. In order to create it, please run:
> prelude-admin register "ossec" "idmef:w"  --uid 1001 --gid 1001.
> 2009/07/28 11:20:36 ossec-maild: INFO: E-Mail notification disabled. Clean Exit.
> Started ossec-maild...
> "
>
> and on prelude host:
>
> (process:2454) INFO: [192.168.1.2:58531 0x229684a671575 idmef:w admin:r]: TLS authentication succeed: client certificate is trusted.
> (process:2454) WARNING: [192.168.1.2:58531 0x229684a671575 idmef:w admin:r]: TLS fatal alert from peer: Close notify.
> (process:2454) INFO: [192.168.1.2:58531 0x229684a671575 idmef:w admin:r]: closing connection.
>
> so I don't understand why, but my sensor snort on an other host is ok (registration and start, connection ok)
>
> I don't have forget to set listen=0.0.0.0 on prelude-manager conf.
>
> can you help me please ?
>
>
>
>
>
>
>
>
>  Créez votre adresse électronique [email protected]
>  1 Go d'espace de stockage, anti-spam et anti-virus intégrés.
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user