What Is the
root User?
The user root on the sensor is used
strictly for configuration of the operating system. It is not used for daily
administrative tasks. The main function root is used for is sysconfig-sensor, explained in detail later in this chapter.
The root account is used for the following tasks:
-
Bootstrapping the sensor by executing the sysconfig-sensor command
-
For certain system level commands, such as snoop
-
When installing signature updates or service packs
-
When starting or stopping the IDM web services
The snoop command is a handy one to remember
since you can use it to verify that the sensor can see the traffic you are
interested in. snoop captures packets from the network and
displays their contents to the screen. It can be saved to a file if needed. If
snoop cannot see the traffic, neither can the IDS sensor monitor interface. snoop examines the raw traffic on your network and can be
executed to look at any interface.
For example:
# snoop -d spwr0 port 45000
Using device /dev/spwr (promiscuous mode)
10.0.0.8 -> 10.0.0.4 UDP D=45000 S=45000 LEN=52
10.0.0.8 -> 10.0.0.4 UDP D=45000 S=45000 LEN=52
10.0.0.8 -> 10.0.0.4 UDP D=45000 S=45000 LEN=52
10.0.0.8 -> 10.0.0.4 UDP D=45000 S=45000 LEN=52
The preceding output is an example of the sensor 10.0.0.8 sending
packets on UPD 45000, but no packets are received. If the two devices were
communicating properly, the snoop output would look like
the following:
# snoop -d spwr0 port 45000
Using device /dev/iprb (promiscuous mode)
10.0.0.4 -> sensor1 UDP D=45000 S=45000 LEN=56
sensor1 -> 10.0.0.4 UDP D=45000 S=45000 LEN=56
172.18.124.142 -> sensor1 UDP D=45000 S=45000 LEN=56
sensor1 -> 172.18.124.194 UDP D=45000 S=45000 LEN=56
Notice traffic is flowing on UDP 45000 in both directions.
|
Note |
If both sides are sending and receiving UDP 45000 packets
and the output of the command idsconns says that a
connection has not been established, go back and troubleshoot the postoffice parameters on the sensor and the management
device. |
The architecture is set up in a way that certain commands
work specifically with root but not for user netrangr. root is used to
initialize the sensor and make configuration changes as needed down the road.
Even when telneting into the sensor, netrangr is used and the user must su to
root in order to perform root tasks for configuration, or to modify a setting or
permission in the Unix architecture.
Sections
Comments (0 posted)
Syndication
