Re: snort / prelude-manager certificate trust

ScottO wrote:
> This link has some info on the agent registration process if you haven't 
> seen it: 
> https://dev.prelude-ids.com/wiki/prelude/InstallingAgentRegistration

Yep, I've been doing my best to follow the Prelude Handbook online. One of 
the more fuzzy parts is that it does not go into much detail about 
permissions or who to run the commands as. For example, I did not have much 
luck until I tried running all of the commands as root.

> At any rate, if you think about the process, you register the agent, in 
> this case your snort profile with the prelude manager - which has the 
> prelude-manager profile there.  You want all your agents registered and 
> communicating with a central manager or relay manager.  So the profiles 
> are for different distinct components, an agent and a manager - hence 
> the different names.

Right, I understand the different profiles for different components, but I 
guess I was failing to see the relationship between all of the components. I 
was expecting to register a "snort" profile on my snort sensor with a 
corresponding "snort" profile on the prelude-manager machine. I also had to 
register prelude-manager with itself (after adding the profile) to get 
things working properly. In the architecture diagram on the Prelude wiki, it 
appears to show several layers in a hierarchy of reporting from remote 
sensors to remote prelude-managers, which then in turn report back in to a 
centralized prelude-manager somewhere else. I'd like to explore that setup 
at some point (since I will eventually have some remote sensors) so I expect 
I'll have some further questions in the future. I'm guessing that in that 
case, I'd want to register the remote snort profile against the remote 
prelude-manager profile, and then register the remote prelude-manager 
profile with the central prelude-manager profile?

-- 
[ Robert Vineyard | RHCE, Security+ ]    [ [email protected]  ]
[ Information Security Engineer III ]    [ 404.385.6900 | FAX 404.894.4690 ]
[Finding a needle in a haystack isn't hard when every straw is computerized]
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user