------[ CHANGES ]------
* prelude-manager-0.9.7.1:
- Fix compilation issue on system where ferror is not declared as a function,
regression introduced in 0.9.7 (#186).
* prelude-manager-0.9.7:
- Fix a startup problem on system with different address of different family
mapping to the same IP.
- Fix for system using the GnuLib poll replacement modules. The module was
broken when used in conjunction with server socket.
- Various portability fixes (this release should compile and run on OSX out of the box).
* prelude-manager-0.9.6.1:
- Fix possible undefined reference to GnuLib symbols.
- Verbose error message in case of Authentication initialization failure.
* prelude-manager-0.9.6:
- In case an IDMEF-Service object contain neither name or port
attribute, set name to "unknown" in order to avoid IDMEF DTD
validation issue.
- Normalize analyzer(*).node.
- Fix OpenBSD getaddrinfo() problem.
* prelude-manager-0.9.5:
- Store Prelude-Manager FIFO into the profile backup directory so that FIFO
are per profile. Fix #151.
- Update libwrap check, don't statically link libwrap. Cleanup. Fix #144.
- XMLmod: Implement CorrelationAlert processing.
- XMLmod: No ntpstamp attribute in File/Inode element datetime fields.
- XMLmod: permission -> Permission, as per IDMEF DTD requirements.
- XMLmod: Process the Checksum IDMEF element.
- XMLmod: Make AdditionalData validation pass (IDMEF v15 -> v16 change).
- XMLmod: disable-buffering option argument is optional.
- XMLmod: Correct DTD loading error.
- XMLmod: Avoid NULL libxml warning.
* prelude-manager-0.9.4.1:
- Enable write notification on queued write (Fix reverse relaying).
- Fix IDMEF message scheduler warning when plugin failover is enabled.
* prelude-manager-0.9.4:
- Fix reverse relaying on some architecture due to thread safety
issue.
- Server scalability improvement in case of message burst.
- Start work on a normalization plugin. Very simple for now, mostly
sanitize IDMEF Address and IDMEF Service classes.
- When an analyzer have read and write permission to prelude-manager,
avoid acting as an echo server, don't send received message from this
analyzer to itself.
- When no listen address is specified, try to bind all
system address (both ipv4/ipv6).
- Send an alert to the peer on handshake failure, so that
the peer have some information on what happened.
- Consistency work accross all plugin logfile option.
- Various bug fixes and improvements.
* prelude-manager-0.9.3:
- Only send TLS alert if there is one queued, fix a possible crash.
- Emit warning if prelude-failover problem arise.
- Improve error handling.
- Improve db plugin log option, "-" now mean stdout.
- Various bug fixes.
* prelude-manager-0.9.2:
- Allow "file" configuration settings to be set from the
database plugin, to handle file based database (SQLite).
- prelude-manager has been updated to check the loaded revocation
list, if available. This was needed since the recent prelude-adduser
addition allowing to create analyzer revocation list.
- Remove line size limitation on specified IDMEF-criteria.
- Remove all ancillary groups as well as setgid-ing.
- Fix idmef-criteria-filter option conflict.
- Fix a possible crash if no listen address is specified, but a
reverse relay is used.
- Much better error reporting.
* prelude-manager-0.9.1:
- Ability to listen on multiple IP address.
- Fix possible race condition with per-sensor queue creation.
- Fix orphaned disk queues that could remain un-flushed in case
of incorrect Manager shutdown.
- Cleanup.
* prelude-manager-0.9.0:
- 0.9.0 final.
- Improve error reporting.
- Fix failover on relaying.
- Fix warnings.
* prelude-manager-0.9.0-rc8:
- Re-establish signal handler for older Unix.
- New user/group configuration option, that might be used so
that prelude-manager, if started as root, drop privilege.
- Change from old port number (5554) to IANA assignated port number
for Prelude (4690).
* prelude-manager-0.9.0-rc7:
- Allocate an unique instance ID per connecting analyzer. Allow
to make the difference between two parallel connection from the
same analyzer.
- FD_CLOEXEC on opened fd: Fix file descriptor leak on SIGHUP.
* prelude-manager-0.9.0-rc6:
- Correct textmod printing of microseconds.
- Check permission on startup and refuse to start if there
is a problem. Should prevent some users mistake.
- Fix problem with Xmlmod handling of text data (was creating
problem in case they contained the & character).
- More detailed error messages.
- GCC4 warnings fixes & 64bits platform warnings fixes.
More C89 compliance.
* prelude-manager-0.9.0-rc5:
- Fix leak on local configuration message.
- Default to listening on localhost instead of UNIX domain socket.
- Fix compilation problem on system lacking PRIu64 definition.
* prelude-manager-0.9.0-rc4:
- Make filter option handling more consistant.
- Fix recursive analyzer routing, endianess issue.
- Error return triggered by option beautification.
- More detailed error messages.
- Option priority re-ordering.
- Decrease verbosity level.
* prelude-manager-0.9.0-rc3:
- Don't declare the client to be a reader until we get to the
capability message. This way, if the user get permission wrong
(applying more permission than needed), only client hardwired permission apply.
- Fix memory leak.
* prelude-manager-0.9.0-rc2:
- Xmlmod fixes.
- Change analyzer class from "Manager" to "Concentrator"
- Better database plugin error reporting.
- Fix an error when starting the database plugin from command line.
- Safe filter plugin destroy hook.
- Relaying plugin now provide a destroy hook.
- Fix IRIX & OpenBSD compilation.
- Direct GnuTLS CFLAGS handling.
* prelude-manager-0.9.0-rc1:
This list covers the important axes of developments of Prelude-IDS 0.9.
It is however far from being exhaustive.
*** Prelude-Manager: Collects and normalize events.
The Prelude-Manager is a high-availability server which collect and
normalize information from distributed sensors and store them into a
database (or any kind of user provided media). It also provide the
ability to relay received events to one or several other prelude-manager
servers. It also provide you the ability to filter received events so
that you can provide specific action for specific event.
- Clients using libprelude can now request copies of alert from a
Manager. Additionally, Prelude-Manager will backup alerts received while
a 'querying' analyzer was offline and emit them when it reconnect.
- New access control system, allowing to specify the type of operation a
given client is allowed to do.
- Support failover at the Report plugin level, allowing for example to
setup a fallback if one of the report plugin fail (example: if the
database used by a report plugin goes down).
- Improved scheduler fairness across different sensors.
- Use ephemeral Diffie Hellman parameters.
- Allow loading of multiple instances of the same plugin, the Manager
can now report to an unlimited number plugin instances (example: you can
now have multiple database).
- Modular filtering system, allowing to define IDMEF criteria, and to
bind action to be issued when an event match theses rules.
- Use libpreludedb.
- Support plugin dl-preopening on platform without dlopen() or dlsym().
------[ SUPPORT ] ------
Improving Prelude is costly, but you can help! We are looking for
organizations that find Prelude useful and wish to contribute back.
Commercial support contracts for Prelude are available, and they help
finance continued maintenance. PreludeIDS Technologies, a privately held
company, is currently funding Prelude maintenance.
------[ DOWNLOAD ]------
http://prelude-ids.org/download/releases/prelude-manager-0.9.7.1.tar.gz
http://prelude-ids.org/download/releases/prelude-manager-0.9.7.1.tar.gz.sig
http://prelude-ids.org/download/releases/prelude-manager-0.9.7.1.tar.gz.md5
------[ MD5SUM ]------
4af593e21b41faa220d9dc9648df4a85 prelude-manager-0.9.7.1.tar.gz
------[ OpenPGP key ]------
gpg --keyserver wwwkeys.pgp.net --recv-keys 0x23D2FAC3
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iQIVAwUARYqkfxHxO34j0vrDAQKYpxAAhcXUT/l8LX4AsRzwdg80s3txpglY/XBN
XpxC9cfuJ7hCeN6CB2sTDRpWq2pAhqB0KLV0rkDkyUKlcHwm9yWVQkA2ZZ3Cg1nG
A7erC0d0pTufkMgWIF3U26u0X39Hb9KR4vX+XUVjXqzAc3Xr2XGI6gMbljgQJT/N
zumQYkLLlfZ9FBclZZULMDu7rAr3jbY27k+/OxheYfA65G4Ve9U52ES+vnxEuNI9
SQZn2F/sXWIk2JIjTtjK99bcFtO0csyXAQrNx8VPqWe7qdL1iDUUKk3/FeSyFfBZ
9v874RXXP/zkgsSs8nBSnkVsQjDctLSgUQB+BOOvmTQKVVEKYAHuUFSnKH8d428h
FAIi17kQlRuSZTW0CQWrhKCmgzOfGdkYGB1VYsIf8W/rtWv3IFHEz5J2v1lfxddD
iZXbBFt9q+unA67KfSHwBxSSjm7NHMAyfEbfrTrI1valvJkHENqosdG1slI4YZWX
9tVClQkjq/fVvdmUAE85YXYafa33AVohcwyPRg872Xs2jM/rbkaoljQLR8x+DbHB
dbvbtHbtizHxW+6SIGKlk/IWsRXgqfMCoiS9sDk8/aEoz8J2g7uYP8jcPMVkvx3S
YjSfmGXfS+0T6xDxZZrghsm8Asc9s18nHioA0R1wkYNzSNDT03h5Lf/GR8Q0KySj
azOcrVo0uVw=
=nopY
-----END PGP SIGNATURE-----
