Re: Prewikka - Encoded aditional data (bug, feature or mistake)

Honza Mach <[email protected]> Thu, 05 May 2011 10:44:20 +0200
Newsgroups gmane.comp.security.ids.prelude.user
Organization CESNET, z.s.p.o.
Message-ID <[email protected]>
Hello everybody,

meanwhile I was doing some research and probably discovered the source
of the problem. I enabled logging to the text files via the
prelude-manager`s textmod reporting plugin. All information was
displayed unencrypted including the aditional data, so I guess that the
problem must be in the db reporting plugin, or in the underlying
libpreludedb library. I was unable to find place where the encryption is
done so far.

Am I the only one experiencing this issue?

Any help is much appreciated, best regards

---
Honza Mach

On Wed, 2011-05-04 at 14:20 +0200, Honza Mach wrote:
> Hello everybody,
> 
> I recently installed the whole prelude suite on the Debian 6.0 Squeeze
> machines using the provided packages (most recent packages of the 1.0.0
> Prelude version). Everything works fine, but when I was browsing the
> Prewikka interface, I discovered, that on the detailed view page of one
> particular alert, the section ADITIONAL DATA contains somehow
> encrypted/encoded information (please see the attached screenshot). In
> my opinion, in this particular example fields 'Log received from' and
> 'Original Log' should be in readable form. Other fields are not
> affected, for example 'Text' and 'Description' are readable.
> 
> I checked the database directly and table 'prelude_additionaldata'
> contains these encrypted/encoded information as well, database tables
> 'prelude_classification', 'prelude_impact' and other on the other hand
> contain unencrypted/unencoded data.
> 
> Is this the feature of the system? If it is, is it somehow possible to
> display the information in clear text form (because this way it is
> useless for me). 
> 
> Or is it a bug in prelude? Isn't it encoding something it shouldn't or
> forgets to decode after reception?
> 
> Or is it a bug in Prewikka interface, that forgets to decode after
> reading from database?
> 
> Or is it my mistake, some misconfiguration?
> 
> Everything else seems normal and works properly. Does anyone else
> encountered the same problem/behaviour as I did?
> 
> Thank you very much in advance for your time, any help is much
> appreciated.
> 
> Best regards
> 
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-technologies.com/mailman/listinfo/prelude-user


_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user