/usr/share/doc/samhain/manual.html/preludedetails.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Prelude</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuration of logging facilities"
HREF="basic-configuration.html"><LINK
REL="PREVIOUS"
TITLE="Console"
HREF="consoledetails.html"><LINK
REL="NEXT"
TITLE="Using samhain with nagios"
HREF="nagios.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="consoledetails.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 4. Configuration of logging facilities</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="nagios.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="PRELUDEDETAILS"
>4.9. Prelude</A
></H1
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>REQUIREMENTS</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  This facility requires that you have compiled with the 
  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>--with-prelude</I
></SPAN
> option to include support
  for prelude. Of course you need the libprelude client library
  for this to work.
  </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>The following configuration options can only be used.
They should be placed the [Misc] section of the configuration file, if
you use them. The 'PreludeMapTo...' options do not affect in any way whether
a message is reported by samhain to the prelude manager 
(for this there is 'PreludeSeverity' in the [Log] section); they only affect
the 'Impact severity' shown on the prelude side. </P
></TD
></TR
></TABLE
></DIV
><P
>  <P
></P
><DIV
CLASS="VARIABLELIST"
><DL
><DT
>PreludeProfile</DT
><DD
><P
>	<B
CLASS="COMMAND"
>PreludeProfile=<TT
CLASS="REPLACEABLE"
><I
>profile_name</I
></TT
></B
>
        </P
><P
>	Specify the profile to use. The default is 'samhain'.
        </P
></DD
><DT
>PreludeMapToInfo</DT
><DD
><P
>	<B
CLASS="COMMAND"
>PreludeMapToInfo=<TT
CLASS="REPLACEABLE"
><I
>list of samhain severities</I
></TT
></B
>
        </P
><P
>	The severities that should be mapped to impact severity 'info' for prelude.
	(default: none).
        </P
></DD
><DT
>PreludeMapToLow</DT
><DD
><P
>	<B
CLASS="COMMAND"
>PreludeMapToInfo=<TT
CLASS="REPLACEABLE"
><I
>list of samhain severities</I
></TT
></B
>
        </P
><P
>	The severities that should be mapped to impact severity 'low' for prelude.
	(default: debug, info).
        </P
></DD
><DT
>PreludeMapToMedium</DT
><DD
><P
>	<B
CLASS="COMMAND"
>PreludeMapToMedium=<TT
CLASS="REPLACEABLE"
><I
>list of samhain severities</I
></TT
></B
>
        </P
><P
>	The severities that should be mapped to impact severity 'medium' for prelude.
	(default: notice, warn, err).
        </P
></DD
><DT
>PreludeMapToHigh</DT
><DD
><P
>	<B
CLASS="COMMAND"
>PreludeMapToHigh=<TT
CLASS="REPLACEABLE"
><I
>list of samhain severities</I
></TT
></B
>
        </P
><P
>	The severities that should be mapped to impact severity 'high' for prelude.
	(default: crit, alert).
        </P
></DD
></DL
></DIV
>        </P
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="PRELUDECL"
>4.9.1. Prelude-specific command-line options</A
></H2
><P
>The following prelude-specific command-line options
are accepted:</P
><P
></P
><OL
TYPE="1"
><LI
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>--prelude</I
></SPAN
>
      Prelude generic options are following. This option must be given
      before the following options are used.</P
></LI
><LI
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>--profile &lt;arg&gt;</I
></SPAN
>
Profile to use for this analyzer</P
></LI
><LI
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>--heartbeat-interval &lt;arg&gt;</I
></SPAN
>
Number of seconds between two heartbeats</P
></LI
><LI
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>--server-addr &lt;arg&gt;</I
></SPAN
>
Address where this sensor should report to
                          (addr:port)</P
></LI
><LI
><P
><SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>--analyzer-name &lt;arg&gt;</I
></SPAN
>
Name for this analyzer</P
></LI
></OL
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="PRELUDE9"
>4.9.2. Registering to a Prelude manager</A
></H2
><DIV
CLASS="TIP"
><P
></P
><TABLE
CLASS="TIP"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/tip.gif"
HSPACE="5"
ALT="Tip"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Sensor name/profile</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>  The default sensor name/profile is 'samhain'. However,
  version 2.0.6 of <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> still had 'Samhain'
  For versions of 
  <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> later than 2.0.6, there is an option 
  <B
CLASS="COMMAND"
>PreludeProfile=<TT
CLASS="REPLACEABLE"
><I
>profile</I
></TT
></B
>
  (in the [Misc] section) to set a user-defined name/profile.
  </P
></TD
></TR
></TABLE
></DIV
><P
>In order to register <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> as a
<SPAN
CLASS="APPLICATION"
>Prelude</SPAN
> sensor, you need to run on the
sensor host and on the manager host the <B
CLASS="COMMAND"
>prelude-admin</B
>
command.</P
><PRE
CLASS="SCREEN"
><SAMP
CLASS="PROMPT"
>sensor # </SAMP
><KBD
CLASS="USERINPUT"
>prelude-admin register samhain "idmef:w admin:r" &lt;manager host&gt; --uid=prelude --gid=prelude</KBD
>

You now need to start "prelude-admin" registration-server on 127.0.0.1:
example: "prelude-admin registration-server prelude-manager"

Enter the one-shot password provided on 127.0.0.1: </PRE
><PRE
CLASS="SCREEN"
><SAMP
CLASS="PROMPT"
>manager # </SAMP
><KBD
CLASS="USERINPUT"
>prelude-admin registration-server prelude-manager</KBD
>

The "76g4h8au" password will be requested by "prelude-admin register"
in order to connect. Please remove the quotes before using it.

Generating 1024 bits Diffie-Hellman key for anonymous authentication...
Waiting for peers install request on 0.0.0.0:5553...
Waiting for peers install request on :::5553...&#13;</PRE
><P
>You now have to type in the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>one-shot password</I
></SPAN
> generated
on &quot;manager&quot; at the password prompt on &quot;sensor&quot;, 
(twice, for confirmation). Then on &quot;manager&quot; you will be asked to
approve the registration. Type 'y', and you are finished.</P
><P
>The configuration file for the samhain sensor is 
<TT
CLASS="FILENAME"
>/etc/prelude/profile/samhain/config</TT
></P
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="consoledetails.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="nagios.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Console</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="basic-configuration.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Using samhain with nagios</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / preludedetails.html
