


prelude-admin(1)                                 prelude-admin(1)


NAME
       prelude-admin - Manage agents accounts


SYNOPSIS
       prelude-admin <subcommand> [options] [args]

       prelude-admin add <profile name> [--uid UID] [--gid GID]

       prelude-admin chown <profile name> [--uid UID] [--gid GID]

       prelude-admin del <profile name>

       prelude-admin rename <profile name> <profile name>

       prelude-admin  register  <profile  name> <wanted permission> <registra-
       tion-server  address>  [--uid  UID]  [--gid   GID]   [--passwd=PASSWD>]
       [--passwd-file=<FILE>]

       prelude-admin  registration-server  <profile  name>  [--uid UID] [--gid
       GID] [--prompt] [--passwd=PASSWD>] [--passwd-file=<FILE>] [--keepalive]
       [--no-confirm] [--listen]

       prelude-admin revoke <profile> <analyzerID> [--uid UID] [--gid GID]


DESCRIPTION
       In  order for an agent to communicate with a manager, it must be regis-
       tered. Registration involves several steps:
        - Allocating an unique identity for the agent
        - Creating directory to be used by the agent (example:  failover  pur-
       pose)
        -  Registering  to  a remote 'prelude-manager': get a signed X509 cer-
       tificate that will allow communication between agent and manager  using
       the specified permissions.

       All these informations are stored in an agent profile.

       An  agent  profile is identified by its name. When an agent is started,
       it will load the profile of the same name as the program  itself,  that
       is,  if your agent is named "prelude-lml", the agent will load the pro-
       file named "prelude-lml".

       The name of the profile can be overriden using the '--prelude --profile
       name_of_my_profile'  command  line option. It is possible to define the
       profile name so that you can have several instances of one  agent  run-
       ning with different permissions, using different profiles.

       Note that profiles are not specific to agents, but are used in all pro-
       grams of the Prelude suite (agents, managers, etc).

       If you are not sure which permission your agent should get, just  start
       it and default permissions will be displayed.




                           19 June 2007                         1





prelude-admin(1)                                 prelude-admin(1)


OPTIONS
       <profile  name>  is the default name of the agent you are installing or
       your own defined name.

       If you start your agent without prior registration, a warning  is  dis-
       played including the default profile name on how to register the agent.

       <requested permission> is the permission your agent needs. It  is  com-
       posed  of  permission  attributes  (idmef  or  admin)  and access type:
       read/write (r/w). By default, an agent  need  permissions  for  writing
       IDMEF to a manager, and reading administrative command sent to it. That
       is : "idmef:w admin:r".

       <manager address> is the address of the  prelude-manager  you  wish  to
       register.  this  can  either  be its IP address or its hostname. If you
       made a local installation, you can write localhost to connect via  unix
       socket.

       Remember  to  use  the correct uid/gid when registering your agent. For
       instance, if you want to register snort  (running  with  snort  euid  /
       egid), use --uid snort --gid snort.


       add <analyzer profile>
            Setup a new agent user.

            --uid=UID UID or user to use to setup agent files.

            --gid=GID GID or group to use to setup agent files.



       chown <analyzer profile>
            Change analyzer owner.

            --uid=UID UID or user to use to setup agent files.

            --gid=GID GID or group to use to setup agent files.



       del <analyzer profile>
            The  delete  command  will  remove the agent files created through
            "add" command. Once this is  done,  the  analyzer  can't  be  used
            unless "register" or "add" is called again.



       rename <analyzer profile> <analyzer profile>
            Rename an existing analyzer.



       register <profile name> <wanted permission> <registration-server



                           19 June 2007                         2





prelude-admin(1)                                 prelude-admin(1)


       address>
            Register an analyzer.

            Register and create the analyzer basic setup if needed.   It  will
            also  configure  communication  of  this analyzer with a receiving
            analyzer (like a  Manager)  through  the  specified  registration-
            server.

            --uid=UID UID or user to use to setup analyzer files.

            --gid=GID GID or group to use to setup analyzer files.

            --passwd=PASSWD Use provided password instead of prompting it.

            --passwd-file=-|FILE  Read password from file instead of prompting
            it (- for stdin).



       registration-server <profile name>
            Start a registration server to register agents.  This is  used  in
            order  to  register  'sending'  analyzer  to 'receiving' analyzer.
            <profile name> should be set to the profile name of the

            --uid=UID UID or user to use to setup 'receiving' analyzer  files.

            --gid=GID GID or group to use to setup 'receiving' analyzer files.

            --prompt Prompt for a password instead of auto generating it.

            --passwd=PASSWD Use provided password instead of  auto  generating
            it.

            --passwd-file=-|FILE  Read password from file instead of auto gen-
            erating it (- for stdin).

            --keepalive Register analyzer in an infinite loop.

            --no-confirm Do not ask for confirmation on agent registration.

            --listen Address to listen on for registration request (default is
            any:5553).


       revoke <profile name>
            Revoke access to <profile> for the given analyzerID.

            --uid=UID UID or user to use to setup analyzer files.

            --gid=GID GID to group to use to setup analyzer files.


       --help
            Print help



                           19 June 2007                         3





prelude-admin(1)                                 prelude-admin(1)


AUTHOR
       This man page has been written by Frederic Motte























































                           19 June 2007                         4


