Re: Prewikka - Encoded aditional data (bug, feature or mistake)
Honza Mach <[email protected]> Thu, 05 May 2011 10:44:20 +0200
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Organization | CESNET, z.s.p.o. |
| Message-ID | <[email protected]> |
Hello everybody, meanwhile I was doing some research and probably discovered the source of the problem. I enabled logging to the text files via the prelude-manager`s textmod reporting plugin. All information was displayed unencrypted including the aditional data, so I guess that the problem must be in the db reporting plugin, or in the underlying libpreludedb library. I was unable to find place where the encryption is done so far. Am I the only one experiencing this issue? Any help is much appreciated, best regards --- Honza Mach On Wed, 2011-05-04 at 14:20 +0200, Honza Mach wrote: > Hello everybody, > > I recently installed the whole prelude suite on the Debian 6.0 Squeeze > machines using the provided packages (most recent packages of the 1.0.0 > Prelude version). Everything works fine, but when I was browsing the > Prewikka interface, I discovered, that on the detailed view page of one > particular alert, the section ADITIONAL DATA contains somehow > encrypted/encoded information (please see the attached screenshot). In > my opinion, in this particular example fields 'Log received from' and > 'Original Log' should be in readable form. Other fields are not > affected, for example 'Text' and 'Description' are readable. > > I checked the database directly and table 'prelude_additionaldata' > contains these encrypted/encoded information as well, database tables > 'prelude_classification', 'prelude_impact' and other on the other hand > contain unencrypted/unencoded data. > > Is this the feature of the system? If it is, is it somehow possible to > display the information in clear text form (because this way it is > useless for me). > > Or is it a bug in prelude? Isn't it encoding something it shouldn't or > forgets to decode after reception? > > Or is it a bug in Prewikka interface, that forgets to decode after > reading from database? > > Or is it my mistake, some misconfiguration? > > Everything else seems normal and works properly. Does anyone else > encountered the same problem/behaviour as I did? > > Thank you very much in advance for your time, any help is much > appreciated. > > Best regards > > _______________________________________________ > Prelude-user site list > [email protected] > http://lists.prelude-technologies.com/mailman/listinfo/prelude-user _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-technologies.com/mailman/listinfo/prelude-user