Re: Prewikka - Encoded aditional data (bug, feature or mistake)

Honza Mach <[email protected]> Thu, 05 May 2011 12:37:27 +0200
Newsgroups gmane.comp.security.ids.prelude.user
Organization CESNET, z.s.p.o.
Message-ID <[email protected]>
Hello again,

I was doing more research and I think I found the source of the problem.
I first encountered the issue when using PostgreSQL as database backend.
I installed the mysql and let manager to write to both databases. As I
suspected, database contained unencrypted data and so did the aditional
data in the alert detail view.

So my guess is that the problem is somewhere in the postgresql database
plugin.

I will report this bug to the prelude bugtracker.

Have a nice day

---
Honza Mach

On Thu, 2011-05-05 at 10:44 +0200, Honza Mach wrote:
> Hello everybody,
> 
> meanwhile I was doing some research and probably discovered the source
> of the problem. I enabled logging to the text files via the
> prelude-manager`s textmod reporting plugin. All information was
> displayed unencrypted including the aditional data, so I guess that the
> problem must be in the db reporting plugin, or in the underlying
> libpreludedb library. I was unable to find place where the encryption is
> done so far.
> 
> Am I the only one experiencing this issue?
> 
> Any help is much appreciated, best regards
> 
> ---
> Honza Mach
> 
> On Wed, 2011-05-04 at 14:20 +0200, Honza Mach wrote:
> > Hello everybody,
> > 
> > I recently installed the whole prelude suite on the Debian 6.0 Squeeze
> > machines using the provided packages (most recent packages of the 1.0.0
> > Prelude version). Everything works fine, but when I was browsing the
> > Prewikka interface, I discovered, that on the detailed view page of one
> > particular alert, the section ADITIONAL DATA contains somehow
> > encrypted/encoded information (please see the attached screenshot). In
> > my opinion, in this particular example fields 'Log received from' and
> > 'Original Log' should be in readable form. Other fields are not
> > affected, for example 'Text' and 'Description' are readable.
> > 
> > I checked the database directly and table 'prelude_additionaldata'
> > contains these encrypted/encoded information as well, database tables
> > 'prelude_classification', 'prelude_impact' and other on the other hand
> > contain unencrypted/unencoded data.
> > 
> > Is this the feature of the system? If it is, is it somehow possible to
> > display the information in clear text form (because this way it is
> > useless for me). 
> > 
> > Or is it a bug in prelude? Isn't it encoding something it shouldn't or
> > forgets to decode after reception?
> > 
> > Or is it a bug in Prewikka interface, that forgets to decode after
> > reading from database?
> > 
> > Or is it my mistake, some misconfiguration?
> > 
> > Everything else seems normal and works properly. Does anyone else
> > encountered the same problem/behaviour as I did?
> > 
> > Thank you very much in advance for your time, any help is much
> > appreciated.
> > 
> > Best regards
> > 
> > _______________________________________________
> > Prelude-user site list
> > [email protected]
> > http://lists.prelude-technologies.com/mailman/listinfo/prelude-user
> 
> 
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-technologies.com/mailman/listinfo/prelude-user


_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user