Re: Connection Problem between Prelude-manager and remote sensor

On 192.168.233.132 /etc/prelude-manager/prelude-manager.conf, i changed :
Listen 127.0.0.1
Listen 192.168.233.134
FOR
Listen 0.0.0.0
(on the board of Jaime)

On 192.168.233.134 /etc/prelude/default/client.conf
Server-addr = 192.168.233.132

Now, I have another problem. Prelude-lml (192.168.233.134) isn't recognize by prelude-manager (192.168.233.132)
I began handling several times but it doesn't change


On 192.168.233.132

debian:~# prelude-admin registration-server prelude-manager --listen 192.168.233.132
The "wr5qbzpc" password will be requested by "prelude-admin register"
in order to connect. Please remove the quotes before using it.

Generating 1024 bits Diffie-Hellman key for anonymous authentication...
Waiting for peers install request on 192.168.233.132:5553...

Connection from 192.168.233.134:37813...
Registration request for analyzerID="4172561999241046" permission="idmef:w admin:r".
Approve registration? [y/n]: y
192.168.233.134:37813 successfully registered.
debian:~# 


On 192.168.233.134 :

debian:~# prelude-admin register "prelude-lml" "idmef:w admin:r" 192.168.233.132 --uid 0 --gid 0

You now need to start "prelude-admin" registration-server on 192.168.233.132:
example: "prelude-admin registration-server prelude-manager"

Enter the one-shot password provided on 192.168.233.132: 
Confirm the one-shot password provided on 192.168.233.132: 

Connecting to registration server (192.168.233.132:5553)... Authentication succeeded.
Successful registration to 192.168.233.132:5553.

debian:~# prelude-lml
13 Apr 19:10:35 (process:30591) INFO: PCRE plugin loaded 417 rules.
13 Apr 19:10:35 (process:30591) INFO: Monitoring /var/log/messages through pcre[default]
13 Apr 19:10:35 (process:30591) INFO: Monitoring /var/log/auth.log through pcre[default]
13 Apr 19:10:35 (process:30591) WARNING: /var/log/apache2/access.log does not exist.
13 Apr 19:10:35 (process:30591) INFO: Connecting to 192.168.233.132:4689 prelude Manager server.
13 Apr 19:10:35 (process:30591) WARNING: prelude-client: error starting prelude-client: TLS server certificate not yet activated.

In order to register this sensor, please run:
prelude-admin register prelude-lml "idmef:w" 192.168.233.132 --uid 0 --gid 0

Profile 'prelude-lml' does not exist. In order to create it, please run:
prelude-admin register "prelude-lml" "idmef:w" <manager address> --uid 0 --gid 0.
debian:~# 

On 192.168.233.132 /var/log/user.log

Apr 24 21:38:09 debian prelude-manager: INFO: [192.168.233.134:49226 0xed2ec4bc49f56 idmef:w admin:r]: TLS authentication succeed: client certificate is trusted.
Apr 24 21:38:09 debian prelude-manager: WARNING: [192.168.233.134:49226 0xed2ec4bc49f56 idmef:w admin:r]: TLS fatal alert from peer: Close notify.
Apr 24 21:38:09 debian prelude-manager: INFO: [192.168.233.134:49226 0xed2ec4bc49f56 idmef:w admin:r]: closing connection.

-----Message d'origine-----
De : Jaime Ventura [mailto:[email protected]] 
Envoyé : mardi 4 mai 2010 17:08
À : CHEVALIER, Guillaume
Cc : [email protected]
Objet : Re: [prelude-user] Connection Problem between Prelude-manager and remote sensor

The logs you send are just about the prelude-manager.
And it seems like you cant even start it because prelude-manager cant
bind to specified IP.
On /etc/prelude-manager/prelude-manager.conf  you have something like:
listen = 0.0.0.0
You dont really need to change unless you have multiple IPs and want to
bind prelude-manager to only one.
If so you can change that line to
listen = 192.168.233.134
but this IP must be applied on an interface of the server where you are
running prelude-manager. If not, prelude-manager wont be able to bind to
it either.

If I understood correctly I, you want prelude-lml to run on a different
e server.
So you have to change /etc/prelude/default/client.conf on that different
server.
After taht, you need to register the prelude-lml.

One final note, use the "reply all", so everyone receive the message.

Jaime

CHEVALIER, Guillaume wrote:
> Oups its 192.168.233.134:4689 (It's just a mistake on the email)
> I must have prelude-manager on 192.168.233.134?
> For the moment I just prelude-lml
>
>
> -----Message d'origine-----
> De : Jaime Ventura [mailto:[email protected]] 
> Envoyé : mardi 4 mai 2010 16:16
> À : CHEVALIER, Guillaume
> Cc : [email protected]
> Objet : Re: [prelude-user] Connection Problem between Prelude-manager and remote sensor
>
> Hi,
> I don't know if you changed the ip addresses on purpose, but:
>
> 192.168.233.134 must be a IP assigned to the machine(prelude-manager.conf).
>
> and
>
> on the file client.conf these's a missing octet.  "192.168.132:4689" is not a valid IP:port.
>
>
> Jaime
>
>
> CHEVALIER, Guillaume wrote:
>   
>> Hello,
>> I installed prelude-manager 1.0, lml, correlator and prewikka on the same device. I installed prelude-lml on another device. I registered all plugins. I changed the /etc/prelude-manager/prelude-manager.conf to listen the remote device. ( I added listen 192.168.233.134:4689)
>> I changed in /etc/prelude/default/client.conf server-addr with the IP of prelude-manager device.(server-addr = 192.168.132:4689).
>> And this'd given :
>>
>> Debian:# /etc/init.d/prelude-manager restart
>> Restarting prelude-manager : prelude-manager24 Apr 02 :14 :17 (process :5707) INFO : Subscribing Normalize to active decoding plugins.
>> Failed!
>>
>> In user.log :
>> Apr 24 02:14:17 debian prelude-manager : INFO: server started (listening on 127.0.0.1 port 4690).
>> Apr 24 02:14:17 debian prelude-manager : WARNING: error initializing server on 192.168.134:4689: could not bind socket: Cannot assign requested address.
>> Apr 24 02:14:17 debian prelude-manager : WARNING: option error: error while setting option 'listen': could not bind socket: Cannot assign requested address.
>>
>> Someone can help me ?
>> Thank you
>>
>> Guillaume
>> </PRE><p style="font-family:arial;color:grey" style="font-size:13px">This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.</p><PRE>
>> _______________________________________________
>> Prelude-user site list
>> [email protected]
>> http://lists.prelude-technologies.com/mailman/listinfo/prelude-user
>>   
>>     
>
>
>
>
>
>
> This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is 
> intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to 
> read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message 
> in error, please notify the sender immediately and delete all copies of this message.
>
>   






This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is 
intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to 
read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message 
in error, please notify the sender immediately and delete all copies of this message.

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user