Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
W
Warden
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Wiki
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Package Registry
Container Registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Pavel Valach
Warden
Commits
33642609
Commit
33642609
authored
13 years ago
by
Tomáš Plesník
Browse files
Options
Downloads
Patches
Plain Diff
chyby doplneni sekce Update a Uninstallation; celkova kontrola dokumentu
parent
37d20c83
No related branches found
No related tags found
No related merge requests found
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
src/warden-client/doc/README
+79
-44
79 additions, 44 deletions
src/warden-client/doc/README
with
79 additions
and
44 deletions
src/warden-client/doc/README
+
79
−
44
View file @
33642609
...
@@ -8,10 +8,12 @@ Content
...
@@ -8,10 +8,12 @@ Content
B. Installation Dependencies
B. Installation Dependencies
C. Registration
C. Registration
D. Installation
D. Installation
E. Integration with Local Applications
E. Update
F. Client Upgrade
F. Uninstallation
G. Functions, Arguments and Calls
G. Configuration
H. Authors
H. Integration with Local Applications
I. Functions, Arguments and Calls
J. Authors
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
A. Overall Information
A. Overall Information
...
@@ -30,19 +32,25 @@ A. Overall Information
...
@@ -30,19 +32,25 @@ A. Overall Information
1.1.0 (2012-02-16) - DOPLNIT
1.1.0 (2012-02-16) - DOPLNIT
3. Package structure
- DOPLNIT
3. Package structure
warden-client/
warden-client/
doc/
doc/
CHANGELOG
example-sender.pl.txt
example-sender.pl.txt
example-receiver.pl.txt
example-receiver.pl.txt
INSTALL
LICENSE
README
README.cesnet
etc/
etc/
package_version.txt
warden-client.conf
warden-client.conf
var/
lib/
lib/
WardenClientConf.pm
WardenClientSend.pm
WardenClientSend.pm
WardenClientReceive.pm
WardenClientReceive.pm
WardenConf.pm
var/
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
B. Installation Dependencies
B. Installation Dependencies
...
@@ -70,20 +78,39 @@ C. Registration
...
@@ -70,20 +78,39 @@ C. Registration
Each client is defined by its hostname, service name, type of client, type
Each client is defined by its hostname, service name, type of client, type
of requested events and CIDR the client is allowed to communicate from only.
of requested events and CIDR the client is allowed to communicate from only.
Hostname - hostname of client to be registered
Hostname hostname of client to be registered
Service name - Text string. Unique name of the service
Service name Text string. Unique name of the service
the client is integrated in.
the client is integrated in.
E.g. 'ScanDetector_1.0'. This is mandatory for
E.g. 'ScanDetector_1.0'. This is mandatory for
'Sender' client. Default value null is used for
'Sender' client. Default value null is used for
'Receiver' client.
'Receiver' client.
Type of client - Either 'Sender' or 'Receiver'.
Type of requested events - Type of events the client only accepts from
Type of client Either 'Sender' or 'Receiver'.
Type of requested events Type of events the client only accepts from
Warden server. This is mandatory only for
Warden server. This is mandatory only for
'Receiver' client. Default value null is used
'Receiver' client. Default value null is used
for 'Sender' client. Brief information about
for 'Sender' client. Brief information about
event types is provided in section G. Functions
event types is provided in section G. Functions
arguments and calls.
arguments and calls.
CIDR - CIDR stands for IP address or IP (sub)net
Receiving of own events Receiving of sent events from my
organization = yes/no (organizations are
separated based on the top-level and
second-level domain). This is mandatory only
for 'Receiver' client.
Description tags Tags are case insensitive alphanumeric strings,
designed to allow event receivers to do more
general filtering according to event source.
Receiver can for example decide to use only
events originating at honeypots, or filter out
events, generated by human conclusions or
correlation engines. This is mandatory only
for 'Sender' client.
CIDR CIDR stands for IP address or IP (sub)net
the client is going to communicate from. Any
the client is going to communicate from. Any
communications between the client and Warden
communications between the client and Warden
Server must be performed from IP address from
Server must be performed from IP address from
...
@@ -131,9 +158,39 @@ D. Installation
...
@@ -131,9 +158,39 @@ D. Installation
warden-client to be run under root privileges though.
warden-client to be run under root privileges though.
5. Configuration file
5. Configuration file
You are advised to check configuration file
After successful installation process you are advised to check configuration
warden-client/etc/warden-client.conf. After installation.
file warden-client/etc/warden-client.conf. For more information see section
G. Configuration below.
6. Usage of install.sh
Usage: $ ./install.sh [-d <directory>] [-u <user>] [-k <ssl_key_file>]
[-c <ssl_cert_file>] [-a <ssl_ca_file>] [-hV]"
-d <directory> installation directory (default: /opt)
-u <user> owner of warden client package (user for
running detection scripts)
-k <ssl_key_file> SSL certificate key file path
-c <ssl_cert_file> SSL certificate file path
-a <ssl_ca_file> CA certificate file path
-h print this help
-V print script version number and exit
Example: $ ./install.sh -d /opt -u detector -k /etc/ssl/private/client.key
-c /etc/ssl/certs/client.pem -a /etc/ssl/certs"
--------------------------------------------------------------------------------
E. Update - DOPLNIT
To upgrade a client, install a new version.
--------------------------------------------------------------------------------
F. Uninstallation - DOPLNIT
To upgrade a client, install a new version.
--------------------------------------------------------------------------------
G. Configuration
SOAP protocol is used for handling communication between server and clients.
SOAP protocol is used for handling communication between server and clients.
Therefore, correct URI of Warden server must be set.
Therefore, correct URI of Warden server must be set.
...
@@ -155,24 +212,8 @@ D. Installation
...
@@ -155,24 +212,8 @@ D. Installation
SSL_CA_FILE - path to a CA file
SSL_CA_FILE - path to a CA file
e.g. '/etc/ssl/certs/tcs-ca-bundle.pem'
e.g. '/etc/ssl/certs/tcs-ca-bundle.pem'
6. Usage of install.sh
Usage: $ ./install.sh [-d <directory>] [-u <user>] [-k <ssl_key_file>]
[-c <ssl_cert_file>] [-a <ssl_ca_file>] [-hV]"
-d <directory> installation directory (default: /opt)
-u <user> owner of warden client package (user for
running detection scripts)
-k <ssl_key_file> SSL certificate key file path
-c <ssl_cert_file> SSL certificate file path
-a <ssl_ca_file> CA certificate file path
-h print this help
-V print script version number and exit
Example: $ ./install.sh -d /opt -u detector -k /etc/ssl/private/client.key
-c /etc/ssl/certs/client.pem -a /etc/ssl/certs"
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
E
. Integration with Local Applications
H
. Integration with Local Applications
(Note: Clients need to be registered on server to be able to communicate with
(Note: Clients need to be registered on server to be able to communicate with
server properly. See section C. Registration for more information about
server properly. See section C. Registration for more information about
...
@@ -187,7 +228,7 @@ E. Integration with Local Applications
...
@@ -187,7 +228,7 @@ E. Integration with Local Applications
warden-client sender functionality.
warden-client sender functionality.
Brief information about syntax of sending functions and functionality is
Brief information about syntax of sending functions and functionality is
provided in section
G
. Functions arguments and calls.
provided in section
I
. Functions arguments and calls.
2. Client receiver (this type of clients uploads events from Warden server)
2. Client receiver (this type of clients uploads events from Warden server)
...
@@ -201,13 +242,9 @@ E. Integration with Local Applications
...
@@ -201,13 +242,9 @@ E. Integration with Local Applications
Brief information about syntax of receiving functions and functionality is
Brief information about syntax of receiving functions and functionality is
provided in section G. Functions arguments and calls.
provided in section G. Functions arguments and calls.
--------------------------------------------------------------------------------
F. Client Upgrade
To upgrade a client, install a new version.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
G
. Functions, Arguments and Calls
I
. Functions, Arguments and Calls
1. WardenClientSend::saveNewEvent
1. WardenClientSend::saveNewEvent
...
@@ -327,14 +364,12 @@ G. Functions, Arguments and Calls
...
@@ -327,14 +364,12 @@ G. Functions, Arguments and Calls
attribute ID - unique id of this particular event (BIGINT).
attribute ID - unique id of this particular event (BIGINT).
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
H
. Authors
J
. Authors
Development: Tomas PLESNIK <plesnik@ics.muni.cz>
Development: Tomas PLESNIK <plesnik@ics.muni.cz>
Jan SOUKAL <soukal@ics.muni.cz>
Jan SOUKAL <soukal@ics.muni.cz>
Copyright (C) 2012 Cesnet z.s.p.o
Copyright (C)
2011-
2012 Cesnet z.s.p.o
Special thanks go to Martin Drasar from CSIRT-MU for his help and support
Special thanks go to Martin Drasar from CSIRT-MU for his help and support
in the development of Warden system.
in the development of Warden system.
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment