I could get through 'Intrusion Detection: Snort, Base, MySQL, and Apache2 On Ubuntu 7.10 (Gutsy Gibbon) (Updated)' without problem but tried my hand at 'Intrusion Detection: Snort (IDS), OSSEC (HbIDS) And Prelude (HIDS) On Ubuntu Gutsy Gibbon' and cannot get snort to hook up with prelude.
WhenI start snort with snort -c /etc/snort/snort.conf snort aborts and I get the following error:
ERROR: unknown output plugin: 'alert_prelude'Fatal Error, Quitting..
I check the configuration out put of
./configure -enable-dynamic-plugin -enable-prelude
and I see the following:
checking for libprelude-config... no
checking for libprelude - version >= 0.9.6... no
*** The libprelude-config script installed by LIBPRELUDE could not be found
*** If LIBPRELUDE was installed in PREFIX, make sure PREFIX/bin is in
*** your path, or set the LIBPRELUDE_CONFIG environment variable to the
*** full path to libprelude-config.
Now that is positively weired, as I have successfully installed prelude-manager and prelude-lml on my ubuntu 7.10 server and even succeeded connecting the manager with the agent. the version of the manager in the Ubuntu package is .9.8, the version of the agent is .9.10 so there should be no problem, one would have thought.
BTW, a search on libprelude-config with $ find -name "libprelude-config" gave no result.
Where should these libprelude files live? how can i see their version? How can I ensure snort knows where they are?
Any input is appreciated.
PS: The script 'Intrusion Detection: Snort (IDS), OSSEC (HbIDS) And Prelude (HIDS) On Ubuntu Gutsy Gibbon' has some typos:
./configure -enable-dynamicplugin --eanble-prelude
I am usure it should be enable not eanble, but what about the hyphens? why has one parameter two (--), the other one hyphen (-)? One would think only one is correct? Can someone confirm please?
Also, it says further is the script:
Scroll down the list to the section with "# output alert_prelude: profile=snort", remove the "#é in front of this line and that's it.
well, that line does not exist. There are only the lines:
# output alert_prelude
# output alert_prelude: profile=snort-profile-name
So should it be 'output alert_prelude', 'output alert_prelude: profile=snort-profile-name' or 'output alert_prelude: profile=snort'?
These things may not cause anything, as I have tried various combinations in several reinstalls and always come to the same error as shown above.