Prelude

Samhain
Prev | Chapter 4. Configuration of logging facilities | Next

# 4.9. Prelude

| REQUIREMENTS
| This facility requires that you have compiled with the --with-prelude option to include support for prelude. Of course you need the libprelude client library for this to work.

For Prelude 0.8, timestamp messages will automatically be converted to Prelude heartbeat messages.

For Prelude 0.9, timestamp messages are dropped, and the built-in heartbeat mechanism of the libprelude library is used.

| Note
| The following configuration options can only be used with libprelude 0.9. The should be placed the [Misc] section of the configuration file, if you use them. The 'PreludeMapTo...' options do not affect in any way whether a message is reported by samhain to the prelude manager (for this there is 'PreludeSeverity' in the [Log] section); they only affect the 'Impact severity' shown on the prelude side.

PreludeProfile

  PreludeProfile=`profile_name`

  Specify the profile to use. The default is 'samhain'.

PreludeMapToInfo

  PreludeMapToInfo=`list of samhain severities`

  The severities that should be mapped to impact severity 'info' for prelude. (default: none).

PreludeMapToLow

  PreludeMapToInfo=`list of samhain severities`

  The severities that should be mapped to impact severity 'low' for prelude. (default: debug, info).

PreludeMapToMedium

  PreludeMapToMedium=`list of samhain severities`

  The severities that should be mapped to impact severity 'medium' for prelude. (default: notice, warn, err).

PreludeMapToHigh

  PreludeMapToHigh=`list of samhain severities`

  The severities that should be mapped to impact severity 'high' for prelude. (default: crit, alert).

## 4.9.1. Prelude-specific command-line options

With libprelude 0.9, the following prelude-specific command-line options are accepted:

1. --prelude Prelude generic options are following. This option must be given before the following options are used.

2. --profile <arg> Profile to use for this analyzer

3. --heartbeat-interval <arg> Number of seconds between two heartbeats

4. --server-addr <arg> Address where this sensor should report to (addr:port)

5. --analyzer-name <arg> Name for this analyzer

## 4.9.2. Registering to a Prelude 0.9 manager

| Sensor name/profile
| For libprelude 0.9, the default sensor name/profile is 'samhain'. However, version 2.0.6 of samhain still had 'Samhain' (as for libprelude 0.8). For versions of samhain later than 2.0.6, there is an option PreludeProfile=`profile` (in the [Misc] section) to set a user-defined name/profile.

In order to register samhain as a Prelude sensor, you need to run on the sensor host and on the manager host the prelude-adduser command.

    sensor # prelude-adduser register samhain "idmef:w admin:r" <manager host>

    - Using default TLS settings from /usr/local/etc/prelude/default/tls.conf:
      - Generated key size: 1024 bits.
      - Authority certificate lifetime: unlimited.
      - Generated certificate lifetime: unlimited.

    - Adding analyzer samhain.
      - Creating /usr/local/etc/prelude/profile/samhain...
      - Using already allocated ident for samhain: 1312010545704259.
      - Creating /usr/local/var/spool/prelude/samhain...

    - Registring analyzer samhain to localhost.

      You now need to start "prelude-adduser" on the server host where
      you need to register to:

      use: "prelude-adduser registration-server <analyzer profile>"
      example: "prelude-adduser registration-server prelude-manager"

      This is used in order to register the 'sending' analyzer to the 'receiving'
      analyzer. <analyzer profile> should be set to the profile name of the
      'receiving' analyzer, the one where 'sending' analyzer will register to.

      Please remember that "prelude-adduser" should be used to register
      every server used by this analyzer.

      Enter the one-shot password provided by the "prelude-adduser" program:

      - Enter registration one shot password:

    manager # prelude-adduser registration-server prelude-manager

    - Using default TLS settings from /usr/local/etc/prelude/default/tls.conf:
      - Generated key size: 1024 bits.
      - Authority certificate lifetime: unlimited.
      - Generated certificate lifetime: unlimited.

    - Adding analyzer samhain.
      - Creating /usr/local/etc/prelude/profile/samhain...
      - Using already allocated ident for samhain: 1312010545704259.
      - Creating /usr/local/var/spool/prelude/samhain...

    - Starting registration server.
      - generated one-shot password is "fz64g2h2".

        This password will be requested by "prelude-adduser" in order to connect.
        Please remove the first and last quote from this password before using it.

      - Waiting for peers install request...

You now have to type in the one-shot password generated on "manager" at the password prompt on "sensor", (twice, for confirmation). Then on "manager" you will be asked to approve the registration. Type 'y', and you are finished.

The configuration file for the samhain sensor is `/usr/local/etc/prelude/profile/samhain/config`

## 4.9.3. Registering to a Prelude 0.8 manager

| Sensor name/profile
| For libprelude 0.8, the sensor name/profile is 'Samhain'.

In order to register samhain as a Prelude sensor, you need to run on the Prelude manager the command: manager-adduser, and on the client the command sensor-adduser --sensorname Samhain --uid `0` --manager-addr `x.x.x.x`.

Both commands are interactive, and apparently should be run simultaneously, where manager-adduser will generate a 'one-shot password' that must be entered in sensor-adduser. This is how it looks on the Prelude manager:

    bash$ manager-adduser

    Generated one-shot password is "0ltdgbgy".

    This password will be requested by "sensor-adduser" in order to connect.
    Please remove the first and last quote from this password before using it.

    - Waiting for install request from Prelude sensors...
    - Connection from 127.0.0.1.
    sensor choose to use PLAINTEXT communication method.
    successfully created user calvin.

    Sensor registered correctly.

And this is the dialog on the client:

    bash$ sensor-adduser --sensorname Samhain --uid 0 --manager-addr 127.0.0.1

    Now please start "manager-adduser" on the Manager host where
    you wish to add the new user.

    Please remember that you should call "sensor-adduser" for each configured
    Manager entry.

    Press enter when done.

    Please use the one-shot password provided by the "manager-adduser" program.

    Enter registration one shot password :
    Please confirm one shot password :
    connecting to Manager host (127.0.0.1:5553)... Succeeded.

    Username to use to authenticate : calvin
    Please enter a password for this user :
    Please re-enter the password (comfirm) :
    Register user "calvin" ? [y/n] : y
    Plaintext account creation succeed with Prelude Manager.
    Allocated ident for Samhain@somehost: 61534998304562071.

The libprelude client library has a configuration file `/etc/prelude-sensors/sensors-default.conf` where you can configure e.g. the network address of the Prelude manager.

Prev | Home | Next
Console | Up | Using samhain with nagios