Re: Prewikka - Encoded aditional data (bug, feature or mistake)
Honza Mach <[email protected]> Thu, 05 May 2011 12:37:27 +0200
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Organization | CESNET, z.s.p.o. |
| Message-ID | <[email protected]> |
Hello again, I was doing more research and I think I found the source of the problem. I first encountered the issue when using PostgreSQL as database backend. I installed the mysql and let manager to write to both databases. As I suspected, database contained unencrypted data and so did the aditional data in the alert detail view. So my guess is that the problem is somewhere in the postgresql database plugin. I will report this bug to the prelude bugtracker. Have a nice day --- Honza Mach On Thu, 2011-05-05 at 10:44 +0200, Honza Mach wrote: > Hello everybody, > > meanwhile I was doing some research and probably discovered the source > of the problem. I enabled logging to the text files via the > prelude-manager`s textmod reporting plugin. All information was > displayed unencrypted including the aditional data, so I guess that the > problem must be in the db reporting plugin, or in the underlying > libpreludedb library. I was unable to find place where the encryption is > done so far. > > Am I the only one experiencing this issue? > > Any help is much appreciated, best regards > > --- > Honza Mach > > On Wed, 2011-05-04 at 14:20 +0200, Honza Mach wrote: > > Hello everybody, > > > > I recently installed the whole prelude suite on the Debian 6.0 Squeeze > > machines using the provided packages (most recent packages of the 1.0.0 > > Prelude version). Everything works fine, but when I was browsing the > > Prewikka interface, I discovered, that on the detailed view page of one > > particular alert, the section ADITIONAL DATA contains somehow > > encrypted/encoded information (please see the attached screenshot). In > > my opinion, in this particular example fields 'Log received from' and > > 'Original Log' should be in readable form. Other fields are not > > affected, for example 'Text' and 'Description' are readable. > > > > I checked the database directly and table 'prelude_additionaldata' > > contains these encrypted/encoded information as well, database tables > > 'prelude_classification', 'prelude_impact' and other on the other hand > > contain unencrypted/unencoded data. > > > > Is this the feature of the system? If it is, is it somehow possible to > > display the information in clear text form (because this way it is > > useless for me). > > > > Or is it a bug in prelude? Isn't it encoding something it shouldn't or > > forgets to decode after reception? > > > > Or is it a bug in Prewikka interface, that forgets to decode after > > reading from database? > > > > Or is it my mistake, some misconfiguration? > > > > Everything else seems normal and works properly. Does anyone else > > encountered the same problem/behaviour as I did? > > > > Thank you very much in advance for your time, any help is much > > appreciated. > > > > Best regards > > > > _______________________________________________ > > Prelude-user site list > > [email protected] > > http://lists.prelude-technologies.com/mailman/listinfo/prelude-user > > > _______________________________________________ > Prelude-user site list > [email protected] > http://lists.prelude-technologies.com/mailman/listinfo/prelude-user _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-technologies.com/mailman/listinfo/prelude-user