- le SITE - contribuer - le FORUM - liste évènements - livres sécurité info - @abcdelasecurite (twitter) - groupe Facebook - admin
Le portail dédié à la sécurité informatique et la protection des données, systèmes, réseaux, vie privée et usagers d'Internet.
Forum prévention, configuration, astuces, matériel, logiciel, informations ... hors warez crack serial
Vous n'êtes pas connecté.
Pages: 1
- Accueil
- » H-IDS, N-IDS, sniffer, sonde
- » how to make an existing Snort work on OSSIM
#1 25-07-2012 17:22:08
- amine
- anonyme
how to make an existing Snort work on OSSIM
Dear all,
I have been trying to make existing SNORT (on backtrack) work on OSSIM. Through the iso image, I installed 3 components of OSSIM ( Server, framwork & DB) in the first machine. Then T tried to install ossim-agent in other machine (backtrack) in the same network, in order to use snort as an existing feature on backtrack. And now, i'm trying tirelessly to force the agent to communicate with the server.
On the client side, I followed the steps listed below to my snort machine :
- I copied the following directories:
/etc/ossim/agent/ + /usr/share/ossim-agent and the file /usr/bin/ossim-agent
- In the file /etc/ossim/agent/config.cfg i add
[snort_syslog-cfg]
host=127.0.0.1
pass=temporal
port=9390
user=root
*************************
[snortunified_eth0-cfg]
host=127.0.0.1
pass=temporal
port=9390
user=test
I activated only Snort/ossim-agent plugins:
[plugins]
ossim-agent=/etc/ossim/agent/plugins/ossim-agent.cfg
ossim-monitor=/etc/ossim/agent/plugins/ossim-monitor.cfg
snort_syslog=/etc/ossim/agent/plugins/snort_syslog.cfg
snortunified_eth0=/etc/ossim/agent/plugins/snortunified_eth0.cfg
when i check on ???
snort_syslog=/etc/ossim/agent/plugins/snort_syslog.cfg location: /var/log/%(process)s/alert ???
snortunified_eth0=/etc/ossim/agent/plugins/snortunified_eth0.cfg directory : /var/log/snort ???
On the serverside: I activated Snort sensor in ossim-setup, finally when i execute the following command:
# ossim-agent -f -d -c -v /etc/ossim/agent/config.cfg or even ossim-agent -d
I get the following message :
usr/share/ossim-agent/ossim_agent/ParserUtil.py:35: DeprecationWarning: the md5 module is deprecated; use hashlib instead
import md5
Traceback (most recent call last):
File "/usr/bin/ossim-agent", line 7, in <module>
from ossim_agent.Agent import Agent
File "/usr/share/ossim-agent/ossim_agent/Agent.py", line 46, in <module>
from ParserLog import ParserLog
File "/usr/share/ossim-agent/ossim_agent/ParserLog.py", line 37, in <module>
import pyinotify #deb package python-pyinotify
ImportError: No module named pyinotify
Is the followed steps are the righ ones?II there any missed configuration?How can I make this agent work?Please advise me with any indication that might be helpfull. Thank you