Uploading Policy Fails - IDS Policy Manager v2 Usage

Forum IDS Policy Mana... IDS Policy Mana... Uploading Policy Fails

3/24/2008 11:08 PM

	mattspierce
2 posts

Uploading Policy Fails

I've been trying to work out whats going on for a few days now and I need help. Uploading a policy to my sensor results in the following error message.

Policy Log
----------

Gathering Information: Started
Gathering Information: Complete
Build Policy from Database: Started
Build Policy from Database: Complete

Upload Log
----------

Connect to Sensor: Started
Error during Logon: Received unexpected channel request from server.

Restart Log
-----------

Doing a test connection on the sensor yeilds the following error.

Connect - OK
Executing -uname -a;id
Error - Command return :1
Disconnect - Command return : 1

The sensors log file shows the user connects and then disconnects.

I've fidgeted with the sshd config for a few days now. I've tried certificate auth, Challengeauth on and off, password auth on/off, GSAPPI off, PAM on and off. Now I'm stuck.

3/25/2008 1:56 AM

	Jeff Dell
219 posts
www.activeworx.com

Re: Uploading Policy Fails

Can you use something like putty and SSH into the box from the host that is running IDSPM? if so, what happens when you run uname -a? Also, what is the underlying os?

Cheers,
Jeff

3/25/2008 2:43 PM

	mattspierce
2 posts

Re: Uploading Policy Fails

Thanks for the follow up, a new day, a new viewpoint. I had shell=/bin/false on my snort account. Makes sense for a service account when I think about what I was thinking about.

6/9/2008 4:43 PM

	Fenrir
3 posts

Re: Uploading Policy Fails

Hi,

I've got the same kind of problem. When I try to upload a policy to my snort sensor, when I hit "start", I get the status "Sensor needs to be updated", and the "progress" bar becomes "log" bar in a flash, the log contains: "Error Uploading to Sensor : Input string was not in a correct format."

IDSPM 2.2.0.20 (stand alone) is installed on a classic winXP box, Snort 2.8.1 is on a fedora core 8 box.

I don't know linux well yet, so I was wondering if there was something I missed. The Upload protocol is File copy, to the directory where snort is installed on fedora, the authentication is by password, using a classic user access.

I was wondering another thing, not really related to this matter. Where does IDSPM get the rules ? Is it taking them from where snort is installed ?

Thanks in advance, and if you need some more information, I'll answer fast enough ^^

6/18/2008 12:53 PM

	cx
17 posts

Re: Uploading Policy Fails

Fenrir wrote

Hi,

I've got the same kind of problem. When I try to upload a policy to my snort sensor, when I hit "start", I get the status "Sensor needs to be updated", and the "progress" bar becomes "log" bar in a flash, the log contains: "Error Uploading to Sensor : Input string was not in a correct format."

IDSPM 2.2.0.20 (stand alone) is installed on a classic winXP box, Snort 2.8.1 is on a fedora core 8 box.

I don't know linux well yet, so I was wondering if there was something I missed. The Upload protocol is File copy, to the directory where snort is installed on fedora, the authentication is by password, using a classic user access.

I was wondering another thing, not really related to this matter. Where does IDSPM get the rules ? Is it taking them from where snort is installed ?

Thanks in advance, and if you need some more information, I'll answer fast enough ^^

Try and set your upload protocol to SFTP. Also ensure that the user you are using to upload the file is the same user as what snort is running with.

Cheers

Craig

6/18/2008 2:36 PM

	Fenrir
3 posts

Re: Uploading Policy Fails

I've tried that as well, with the snort user and with the root and my own account as well but to no avail -_-

Does snort need to be off for this to work ?

Page 1 of 1

Forum

IDS Policy Mana...

Uploading Policy Fails