1prelude-admin(1) General Commands Manual prelude-admin(1)
2
6 prelude-admin - Manage agents accounts
7
10 prelude-admin <subcommand> [options] [args]
11 prelude-admin add <profile name> [--uid UID] [--gid GID]
13 prelude-admin chown <profile name> [--uid UID] [--gid GID]
15 prelude-admin del <profile name>
17 prelude-admin rename <profile name> <profile name>
19 prelude-admin register <profile name> <wanted permission> <registra‐
21 tion-server address> [--uid UID] [--gid GID] [--passwd=PASSWD>]
22 [--passwd-file=<FILE>]
23 prelude-admin registration-server <profile name> [--uid UID] [--gid
25 GID] [--prompt] [--passwd=PASSWD>] [--passwd-file=<FILE>] [--keepalive]
26 [--no-confirm] [--listen]
27 prelude-admin revoke <profile> <analyzerID> [--uid UID] [--gid GID]
29
32 In order for an agent to communicate with a manager, it must be regis‐
33 tered. Registration involves several steps:
34 - Allocating a unique identity for the agent
35 - Creating directory to be used by the agent (example: failover pur‐
36 pose)
37 - Registering to a remote 'prelude-manager': get a signed X509 cer‐
38 tificate that will allow communication between agent and manager using
39 the specified permissions.
40 All this information is stored in an agent profile.
42 An agent profile is identified by its name. When an agent is started,
44 it will load the profile of the same name as the program itself, that
45 is, if your agent is named "prelude-lml", the agent will load the pro‐
46 file named "prelude-lml".
47 The name of the profile can be overridden using the '--prelude --pro‐
49 file name_of_my_profile' command line option. It is possible to define
50 the profile name so that you can have several instances of one agent
51 running with different permissions, using different profiles.
52 Note that profiles are not specific to agents, but are used in all pro‐
54 grams of the Prelude suite (agents, managers, etc).
55 If you are not sure which permission your agent should get, just start
57 it and default permissions will be displayed.
58
61 <profile name> is the default name of the agent you are installing or
62 your own defined name.
63 If you start your agent without prior registration, a warning is dis‐
65 played including the default profile name on how to register the agent.
66 <requested permission> is the permission your agent needs. It is com‐
68 posed of permission attributes (idmef or admin) and access type:
69 read/write (r/w). By default, an agent need permissions for writing
70 IDMEF to a manager, and reading administrative command sent to it. That
71 is: "idmef:w admin:r".
72 <manager address> is the address of the prelude-manager you wish to
74 register. This can either be its IP address or its hostname. If you
75 made a local installation, you can write localhost to connect via unix
76 socket.
77 Remember to use the correct uid/gid when registering your agent. For
79 instance, if you want to register snort (running with snort euid /
80 egid), use --uid snort --gid snort.
81 add <analyzer profile>
84 Setup a new agent user.
85 --uid=UID UID or user to use to setup agent files.
87 --gid=GID GID or group to use to setup agent files.
89 chown <analyzer profile>
93 Change analyzer owner.
94 --uid=UID UID or user to use to setup agent files.
96 --gid=GID GID or group to use to setup agent files.
98 del <analyzer profile>
102 The delete command will remove the agent files created through
103 "add" command. Once this is done, the analyzer can't be used
104 unless "register" or "add" is called again.
105 rename <analyzer profile> <analyzer profile>
109 Rename an existing analyzer.
110 register <profile name> <wanted permission> <registration-server
114 address>
115 Register an analyzer.
116 Register and create the analyzer basic setup if needed. It will
118 also configure communication of this analyzer with a receiving
119 analyzer (like a Manager) through the specified registration-
120 server.
121 --uid=UID UID or user to use to setup analyzer files.
123 --gid=GID GID or group to use to setup analyzer files.
125 --passwd=PASSWD Use provided password instead of prompting it.
127 --passwd-file=-|FILE Read password from file instead of prompting
129 it (- for stdin).
130 registration-server <profile name>
134 Start a registration server to register agents. This is used in
135 order to register 'sending' analyzer to 'receiving' analyzer.
136 <profile name> should be set to the profile name of the 'receiv‐
137 ing' analyzer, the one where 'sending' analyzer will register to.
138 --uid=UID UID or user to use to setup 'receiving' analyzer files.
140 --gid=GID GID or group to use to setup 'receiving' analyzer files.
142 --prompt Prompt for a password instead of auto generating it.
144 --passwd=PASSWD Use provided password instead of auto generating
146 it.
147 --passwd-file=-|FILE Read password from file instead of auto gen‐
149 erating it (- for stdin).
150 --keepalive Register analyzer in an infinite loop.
152 --no-confirm Do not ask for confirmation on agent registration.
154 --listen Address to listen on for registration request (default is
156 any:5553).
157 revoke <profile name>
160 Revoke access to <profile> for the given analyzerID.
161 --uid=UID UID or user to use to setup analyzer files.
163 --gid=GID GID to group to use to setup analyzer files.
165 --help
168 Print help
169
172 This man page has been written by Frederic Motte
173 19 June 2007 prelude-admin(1)