/usr/share/doc/samhain/manual.html/clients.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Registering a client</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuring yule, the log server"
HREF="yule.html"><LINK
REL="PREVIOUS"
TITLE="Important installation notes"
HREF="droproot.html"><LINK
REL="NEXT"
TITLE="Enabling logging to the server"
HREF="enabling-logging-to-the-server.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="droproot.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 6. Configuring <SPAN
CLASS="APPLICATION"
>yule</SPAN
>, the log server</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="enabling-logging-to-the-server.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="CLIENTS"
>6.3. Registering a client</A
></H1
><P
>Clients must be registered with 
<SPAN
CLASS="APPLICATION"
>yule</SPAN
> to make a connection. <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Connection
attempts by unknown clients will be rejected.</I
></SPAN
>
The respective section in the server configuration file looks like:</P
><PRE
CLASS="PROGRAMLISTING"
>  [Clients]  
  #  
  # A client 
  # 
  Client=HOSTNAME_CLIENT1@salt1@verifier1 
  #  
  # another one
  # 
  Client=HOSTNAME_CLIENT2@salt2@verifier2 
  # </PRE
><P
>These entries have to be computed in the following way:</P
><P
><P
></P
><OL
TYPE="1"
><LI
><P
>        Choose a <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>password</I
></SPAN
> (16 chars hexadecimal, i.e. only
        0 -- 9, a -- f, A -- F allowed. To generate a random password, 
        you may use:
    </P
><PRE
CLASS="SCREEN"
>        <SAMP
CLASS="PROMPT"
>sh$ </SAMP
><KBD
CLASS="USERINPUT"
>yule --gen-password</KBD
>
    </PRE
></LI
><LI
><P
>        Use the program <B
CLASS="COMMAND"
>samhain_setpwd</B
> 
	to reset the password in the
        compiled <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>client</I
></SPAN
> binary (that is, 
	<SPAN
CLASS="APPLICATION"
>samhain</SPAN
>, 
	not <SPAN
CLASS="APPLICATION"
>yule</SPAN
>) to the 
	one you have chosen.
        <B
CLASS="COMMAND"
>samhain_setpwd</B
> takes three arguments:
	(1) the binary name, (2) an extension to append to the new binary, and
	(3) the password. It will read the executable binary (argument 1), 
	insert the
	password (argument 3), and write a modified binary with the specified 
	extension (argument 2). 
	Run <B
CLASS="COMMAND"
>samhain_setpwd</B
> without arguments 
	for usage information. Example:
    </P
><PRE
CLASS="SCREEN"
>        <SAMP
CLASS="PROMPT"
>sh$ </SAMP
><KBD
CLASS="USERINPUT"
>samhain_setpwd samhain EXT 0123456789ABCDEF</KBD
>
    </PRE
></LI
><LI
><P
>        Use the server's convenience function '-P' to create a registration 
        entry. Example: 
    </P
><PRE
CLASS="SCREEN"
>        <SAMP
CLASS="PROMPT"
>sh$ </SAMP
><KBD
CLASS="USERINPUT"
>yule -P 0123456789ABCDEF</KBD
>
    </PRE
></LI
><LI
><P
>        The output will look like: 
    </P
><P
>        <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Client=HOSTNAME@salt@verifier</I
></SPAN
>
    </P
><P
>        You now have to replace <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>HOSTNAME</I
></SPAN
> with the fully
        qualified domain name of the host on which the client should
        run (<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>exception</I
></SPAN
>: if the server cannot determine
	the fully qualified hostname, you may need to use the numerical
	address instead. You will see the problem in a 'Connection refused'
	message from the server).
    </P
></LI
><LI
><P
>        Put the registration entry into the servers's configuration
        file, under the section heading <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>[Clients]</I
></SPAN
> 
        (see <A
HREF="clients.html"
>Section 6.3</A
>&#62;). 
        You need to send SIGHUP to the server for the new entry to take
        effect.
    </P
></LI
><LI
><P
>        Repeat steps (1) -- (5) for any number of clients you need 
        (actually, you need a registration entry for each client's host,
        but you don't neccesarily need different passwords for 
        each client. I.e. you may skip steps (1) -- (3)).
    </P
></LI
></OL
></P
><P
>If you have a default directory layout, a <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>[Clients]</I
></SPAN
> 
section
right at the end of the server config file, and your client is 
client.mydomain.com, then you could e.g. do:</P
><P
><PRE
CLASS="SCREEN"
><SAMP
CLASS="PROMPT"
>bash$</SAMP
> <KBD
CLASS="USERINPUT"
>PASSWD=`yule --gen-password`</KBD
>
<SAMP
CLASS="PROMPT"
>bash$</SAMP
> <KBD
CLASS="USERINPUT"
>samhain_setpwd samhain new $PASSWD</KBD
>
<SAMP
CLASS="PROMPT"
>bash$</SAMP
> <KBD
CLASS="USERINPUT"
>scp samhain.new  root@client.mydomain.com:/usr/local/sbin/samhain</KBD
>
<SAMP
CLASS="PROMPT"
>bash$</SAMP
> <KBD
CLASS="USERINPUT"
>ENTRY=`yule -P $PASSWD | sed s%HOSTNAME%client.mydomain.com%`</KBD
>
<SAMP
CLASS="PROMPT"
>bash$</SAMP
> <KBD
CLASS="USERINPUT"
>echo $ENTRY &#62;&#62; /etc/yulerc</KBD
>
<SAMP
CLASS="PROMPT"
>bash$</SAMP
> <KBD
CLASS="USERINPUT"
>kill -HUP `cat /var/run/yule.pid`</KBD
></PRE
></P
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="droproot.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="enabling-logging-to-the-server.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Important installation notes</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="yule.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Enabling logging to the server</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / clients.html
