Prelude-IDS - The Hybrid IDS framework

JT ASI 2005

Yoann Vandoorselaere — 2006-01-11T12:47:36Z

Yoann Vandoorselaere, PreludeIDS Technologies CTO, has given a conference at the Journée ASI 2005, INSA Rouen, on the topic of hybrid IDS. The slides are available in french. - Conferences

Prelude Hybrid IDS 0.9.0 released

Yoann Vandoorselaere — 2005-09-20T11:45:57Z

After several years of development, the Prelude team is pleased to announce the public release of version 0.9.0 of the Prelude Hybrid Intrusion Detection System.

What is Prelude Hybrid IDS ?

Prelude was born from the observation that more and more IDS systems exist each with their own focus, but no framework exists in order to unify and centralize events provided by these different systems.

We believe that relying on a single source of information in order to do security analysis is not sufficient, since different analysis methods have different advantages, and that unifying these methods in a strong and powerful product is the only way to produce a comprehensive security analysis tool.

Prelude is a Hybrid IDS framework, that is, a product enabling all security applications, be it open-source or proprietary, to report to a centralized system. In order to achieve this task, Prelude relies on the IDMEF (Intrusion Detection Message Exchange Format) IETF standard, that enables different kinds of sensors to generate events using a unique language.

Prelude provides a C, Python, and Perl framework so that you can convert existing security applications to use the Prelude Framework. It also provides sensors such as a log analyzer (Prelude-LML). A Prelude sensor is a program which has the ability to use the Prelude Framework.

Prelude benefits from its ability to find traces of malicious activity from different sensors (Snort, honeyd, Nessus Vulnerability Scanner, Samhain, hundred of systems logs, and many others) in order to better verify attack vectors and in the end to perform automatic correlation between the various events.

Prelude is licensed under the terms of the GNU General Public License version 2 and is available from http://www.prelude-ids.org/. PreludeIDS Technologies provides commercial licenses of software libraries “Libprelude” & “Libpreludedb”, in order to enable the developement of interoperable proprietary solutions.

Downloading

All components of the Prelude hybrid IDS suite version 0.9.0 can be downloaded from the Download section. Support for Prelude 0.9.0 is currently being tested in Shadow, Sancp, and Mwcollect

Documentation

The Prelude Handbook is a collaborative effort trying to come up with complete Prelude-IDS documentation covering architecture, installation, and configuration of the Prelude Framework.

It is the most up-to-date documentation at this time, and covers Prelude-IDS 0.9.

Commercial Support

The PreludeIDS Technologies company, which develops the Prelude Intrusion Detection System, provides corporate level support and development. While providing the core components of the system under the Open Source development model, it also offers additional products and custom development geared to the needs of larger corporate clients.

The company, already present in many types of industries, is particularly focused on providing expertise regarding ID&P (Intrusion Detection and Prevention) for medium to large sized infrastructures (multinational, telecoms, etc), entities handling highly confidential data (military, banks, etc) and networks with remote access (e-learning, telecommuting, etc.)

Today, in close cooperation with its worldwide Certified Partners, PreludeIDS Technologies brings its Prelude expertise via a broad range of products and services:

PrewikkaPro professional front-end (including advanced ticket system, remote sensor management and graphical fully interactive statistics).
Increased database performance for corporate users.
Commercial licenses for Prelude library.
Prelude system customization.
Software maintenance and technical support.
Deployment, Integration.
Consulting, Training, etc.

See http://www.prelude-ids.com for more information.

What's new in 0.9 ?

This list covers the important axes of developments of Prelude-IDS 0.9. It is however far from being exhaustive.

Prelude Framework:

The Prelude framework has been stabilized, and a lot of consistency work has been going on. The C API should remain stable at this point, and we now offer Python and Perl bindings for interacting with Prelude.

C++ applications should now compile with the library. New and powerful API like idmef-path (defining a path within an IDMEF message tree, assigning/retrieving it) and IDMEF criteria filtering has been introduced.

We spent a lot of time working closely with the IDWG getting missing IDMEF features implemented. The result of this work is available in IDMEF v14, which we are compliant with.

Support for IDMEF optional integer.
Message routing across distributed Manager for remote sensors administration.

The failover subsystem, used when the communication with a Prelude-Manager goes down, now supports transactions and quotas.

Unique message identifier are now generated on the sender (not by the routing managers) side, and fully optional per IDMEF specifications.

Full IPv6 support for client/manager connectivity.

Use GnuTLS instead of OpenSSL. Authentication is now always done through TLS, and the encryption later can be dropped if the connection is local. Usage of a single tool for sensor registration using SRP (Secure Remote Password protocol).

Allow multiple analyzer instance through the use of profiles.

Enhanced portability (we should now build successfully on architecture such as Tru64/AIX).

The default analyzer heartbeat rate was increased.

PreludeDB Framework

The PreludeDB Library provides an abstraction layer upon the type and the format of the database used to store IDMEF alerts.

It allows developers to use the Prelude IDMEF database easily and efficiently without worrying about SQL, and to access the database independently of it's type and format.

Prelude-Manager: Collects and normalizes vents.

The Prelude-Manager is a high-availability server which collects and normalizes events from distributed sensors.

It provide the ability to relay received events to one or several other prelude-manager servers. Filtering received events is possible so that you can hook actions to specific events.

Clients using libprelude can now request copies of alerts from a Manager. Additionally, Prelude-Manager will backup alerts received while a 'querying' analyzer was offline and emit them once reconnected.

New permissions system, allowing control of authorized client operations.

Support for failover at the Report plugin level, allowing for example, to setup a failover if one of the report plugins fails (example: if the database used by a report plugin goes down).

Improved scheduler fairness across different sensors.

Allow loading of multiple instances of the same plugin, the Manager can now report to an unlimited number plugin instances (example: you can now have multiple database).

Modular filtering system, allowing to define IDMEF criteria, and to bind action to be issued when an event match theses rules.

Use libpreludedb for database reporting.
Support plugin dl-preopening on platform without dlopen() or dlsym().

Prelude-LML: Log analyzer, Syslog events collector.

Prelude-LML is an high performance signature based log analyzer monitoring logfile and syslog received messages for suspicious activity. It handles events generated by a large set of components, including but not limited to: BigIP, Grsecurity, Honeyd, ipchains, Netfilter, ipfw, Nokia ipso, Nagios, Norton Antivirus Corporate Edition, NTsyslog, PAM, Portsentry, Postfix, Proftpd, ssh, etc.

Prelude-LML achieves a very high EPS threshold, supperior to some commercial offerings, on low end hardware.

Handles the whole IDMEF object set.
Supports any log format through the use of PCRE.
Support for multiple/optional regular expressions.
Supports jump/optional jump between different rules.

New rules for: Arbor Networks Peakflow system, Dell OM, Shadow Utils, Modsecurity, Netscreen, P3Scan, ClamAV, Sendmail, Tripwire, APC Environmental Monitoring Unit, CISCO PIX, Cisco VPN Concentrator, Microsoft SQL Server, PAM, pcAnywhere, Oracle, Webmin, Wu-Ftpd, Systrace, identd, arpwatch, pure-ftpd, Apache, Dlink, SeLinux.

Per log file ruleset are now possible.
Support plugin dl-preopening on platform without dlopen() or dlsym().
Optimization work.

Prelude enabled Snort 2.4.1 / Prelude NIDS:

One of the important advancements in this release is that we deprecated Prelude-NIDS in favor of using Snort as our default NIDS sensor.

We believe that today, there is no reason to spend time working on another NIDS sensor when Snort already exists and already provides the functionality we need.

As of version 2.4.0 vanilla Snort distribution includes Prelude support. You can get Snort from http://www.snort.org

Prewikka: The Prelude-IDS console.

Prewikka is a professional looking application providing advanced features like contextual filtering, aggregation, etc. Prewikka is a large step forward compared to Piwi.

Prewikka also encorporates access to advanced filters and various network tools. As well as user management and heartbeat monitoring for sensors.

Prewikka creates an intuitive front-end for the Prelude Framework.

Credits for this release:

Frank van Vliet (bugfix, auditing, Sancp sensor)
Gene Gomez (LML rulesets)
Hervé Debar (IDMEF work/support, libpreludedb)
Jascha Dub
Krzysztof Zaraska (Libprelude, Libpreludedb)
Markus Alkio - Citadec (Prewikka)
Mickael Profeta (Debian packages)
Miika Keskinen - Citadec (Prewikka)
Nicolas Delon (Libprelude, Libpreludedb, Prewikka)
Rob Holland (Prelude LML, Prewikka work)
Sébastien Tricaud (Documentation work, Database)
Yoann Vandoorselaere (Libprelude, Libpreludedb, Prewikka, Prelude-LML, Snort sensor, Prelude-Import, Prelude-Manager).
Anyone we may have forgotten.

Others contributors:

Cedric Foll (Database delete optimisation)
Daniel Black (Prewikka —root prefix installation option)
Davor Ocelic (libpreludedb)
Frédéric Motte (Criteria parser escaping fixes)
Gaël Girard (Artwork)
James A.Overton (Prewikka Safari rendering fixes)
Jochen Schlick Gaël Girard (bugfix Artwork)
Nikos Mavrogiannopoulos (GnuTLS help)
Rodolphe Ortalo (bugfix)
Simon Josefsson (GnuTLS help)
Sylvain Gil (Prewikka MacOSX module loading)
Vincent Deffontaines (Nagios ruleset update)
Stéphane Loeuillet
Yann Droneaud (Autoconf work)

PAM 0.79 released with Prelude support

Yoann Vandoorselaere — 2005-03-31T17:01:19Z

PAM (Pluggable Authentication Modules for Linux) 0.79, which include Prelude 0.9 support, has just been released: Announcement. - News / news

Prelude 0.9 Handbook

Yoann Vandoorselaere — 2005-03-29T23:45:59Z

The Prelude Handbook is a collaborative effort trying to come up with a complete Prelude-IDS documentation covering architecture, installation, and configuration instruction.

It is the most up-to-date documentation at this time.

If you're looking for Prelude 0.9 documentation, then have a look at http://trac.prelude-ids.org, which contain the most up to date information regarding to Prelude.

Commercial support

Yoann Vandoorselaere — 2005-03-29T23:14:37Z

Commercial support and professional services are available from the PreludeIDS Technologies company.

Prelude-IDS suite 0.9.0-rc1 released.

Yoann Vandoorselaere — 2005-03-29T22:00:00Z

After several years of development, the Prelude team is pleased to announce the public release candidate 1 of version 0.9.0 of the Prelude Hybrid Intrusion Detection System.

What is Prelude Hybrid IDS ?

Prelude was born from the observation that more and more IDS system each with their own specialism have been made available, but that no framework exist in order to unify and centralize events provided by these different systems.

We believe that relying on a single source of information in order to do security analysis is not sufficient since different analysis methods have different advantages, and that unifying theses methods in a strong and powerful product is the only way to produce a stronger security analysis tool.

Prelude is a Hybrid IDS framework, that is, a product enabling all security applications, be it open-source or proprietary, to report to a centralized system. In order to achieve this task, Prelude relies on the IDMEF (Intrusion Detection Message Exchange Format) IETF standard, that enables different kind of sensors to generate events using an unique language.

Prelude provides a C, Python, and Perl framework so that you can convert existing security application to use the Prelude system. It also provides sensors such as a log analyzer (Prelude-LML). A Prelude sensor is a program which has the ability to use the Prelude framework.

Prelude benefits from its ability to find traces of malicious activity from different sensors (Snort, honeyd, Nessus Vulnerability Scanner, Samhain, hundred of systems logs, and many others) in order to better verify an attack and in the end to perform automatic correlation between the various events.

Prelude is licensed under the terms of the GNU General Public License version 2 and is available from http://www.prelude-ids.org/

Downloading

All components of the Prelude hybrid IDS suite 0.9.0-rc1 can be downloaded from the Download section. Support for Prelude 0.9.0 is upcoming in PAM (Pluggable Authentication Modules) and Samhain.

Documentation

The Prelude Handbook is a collaborative effort trying to come up with a complete Prelude-IDS documentation covering architecture, installation, and configuration instruction.

It is the most up-to-date documentation at this time, and covers Prelude-IDS 0.9.

Enhanced Functionality

The PreludeIDS Technologies company provide a ticket system, remote configuration capability and enhanced navigable statistics for the Prelude system. Check http://www.prelude-ids.com , or contact PreludeIDS Technologies for more information.

Commercial Support

PreludeIDS Technologies is a software company specializing in security. It develops, supports and markets the open source Prelude hybrid IDS system world-wide.

We provide Functionality enhancements, Technical support, Commercial license, Training and Consultancy.

See http://www.prelude-ids.com for more information.

What's new in 0.9 ?

This list covers the important axes of developments of Prelude-IDS 0.9. It is however far from being exhaustive.

Prelude Framework:

The Prelude framework has been stabilized, and a lot of consistency work has been going on. The C API should remain mostly stable at this point, and we now offer Python and Perl bindings for interacting with Prelude.

We spent a lot of time working closely with the IDWG getting missing IDMEF feature implemented. The result of this work is available in IDMEF v14, which we are compliant with.

Support for IDMEF optional integer.
Message routing across distributed Manager for remote sensors administration.

The failover subsystem, used when the communication with a Prelude-Manager goes down, now support transaction and quota.

Unique message identifier are now generated on the sender (not by the routing managers) side, and fully optional per IDMEF specifications.

Full IPv6 support for client/manager connectivity.

Allow multiple analyzer instance through the use of profiles.

Enhanced portability (we should now build successfully on architecture such as Tru64/AIX).

The default analyzer heartbeat rate was increased.

PreludeDB framework

The PreludeDB Library providing an abstraction layer upon the type and the format of the database used to store IDMEF alerts.

It allows developers to use the Prelude IDMEF database easily and efficiently without worrying about SQL, and to access the database independently of it's type and format.

Prelude-Manager: Collects and normalizes events.

The Prelude-Manager is a high-availability server which collects and normalizes events from distributed sensors.

It provide the ability to relay received events to one or several other prelude-manager servers. Filtering received events is possible so that you can hook actions to specific events.

Clients using libprelude can now request copies of alert from a Manager. Additionally, Prelude-Manager will backup alerts received while a 'querying' analyzer was offline and emit them when it reconnect.

New permission system, allowing to control authorized client operations.

Support failover at the Report plugin level, allowing for example to setup a fallback if one of the report plugin fail (example: if the database used by a report plugin goes down).

Improved scheduler fairness across different sensors.

Allow loading of multiple instances of the same plugin, the Manager can now report to an unlimited number plugin instances (example: you can now have multiple database).

Modular filtering system, allowing to define IDMEF criteria, and to bind action to be issued when an event match theses rules.

Use libpreludedb for database reporting.
Support plugin dl-preopening on platform without dlopen() or dlsym().

Prelude-LML: Log analyzer, Syslog events collector.

Prelude-LML is a signature based log analyzer monitoring logfile and syslog received messages for suspicious activity. It handle events generated by a large set of components, including but not limited to: BigIP, Grsecurity, Honeyd, ipchains, Netfilter, ipfw, Nokia ipso, Nagios, Norton Antivirus Corporate Edition, NTsyslog, PAM, Portsentry, Postfix, Proftpd, ssh, etc.

Handle the whole IDMEF object set.
Support any log format through the use of PCRE.
Support for multiple/optional regular expressions.
Support jump/optional jump between different rules.

New rules for: Dell OM, Shadow Utils, Modsecurity, P3Scan, Tripwire, ClamAV, Sendmail, Tripwire, APC Environmental Monitoring Unit, CISCO PIX, Cisco VPN Concentrator, Microsoft SQL Server, PAM, pcAnywhere, Oracle, Webmin, Wu-Ftpd.

Per log file ruleset are now possible.
Support plugin dl-preopening on platform without dlopen() or dlsym().
Optimization work.

Prelude enabled Snort 2.3.2 / Prelude NIDS:

One of the important move in this release is that we deprecated Prelude-NIDS in favor of using Snort as our default NIDS sensor.

We believe that today, there is no reason to spend time working on another NIDS sensor when Snort already exist and already provide the functionality we need. Instead of this, we distribute a Snort version using a Prelude output module. We hope that it will be included in the vanilla Snort distribution.

Prewikka: The Prelude-IDS console.

Originally written by Markus Alkio and Miika Keskinen, it was rapidly adopted as the new Prelude frontend.

Prewikka is a professional looking application providing advanced feature like contextual filtering, aggregation, etc. Prewikka is a large step forward compared to Piwi.

As of now, Prewikka use advanced CSS features and won't work under Internet Explorer. We'll be working on fixing this ASAP (and any help would be appreciated).

Credits for this release:

Davor Ocelic (libpreludedb)
Gene Gomez (LML rulesets)
Hervé Debar (IDMEF work&support, libpreludedb)
Jascha Wanger
Jochen Schlick (bug fix)
Krzysztof Zaraska (Libprelude, Libpreludedb)
Markus Alkio - Citadec (Prewikka)
Mickael Profeta (Debian packages)
Miika Keskinen - Citadec (Prewikka)
Nicolas Delon (Libprelude, Libpreludedb, Prewikka)
Rob Holland (Prelude LML work)
Rodolphe Ortalo (bug fixing)
Sébastien Tricaud (Documentation work)
Simon Josefsson (GnuTLS support)
Stéphane Loeuillet
Yann Droneaud (Autoconf work)
Yoann Vandoorselaere (Libprelude, Libpreludedb, Prewikka, Prelude-LML, Snort+Prelude output, Prelude-Import, Prelude-Manager).
Anyone I may have forgotten.

Others contributors:

Gaël Girard (Artwork)
Nikos Mavrogiannopoulos (GnuTLS help)
Simon Josefsson (GnuTLS help)

Companies which supported the project:

Dreamlab
Digital-Network

Anonymous SVN repository access protocol change

Yoann Vandoorselaere — 2005-03-14T12:00:18Z

In order to access the Prelude repository as an anonymous user, you should now use http://svn.prelude-ids.org instead of https://svn.prelude-ids.org.

This change has been made because of problem in the way SVN request credentials.

Prelude development versions available again

Yoann Vandoorselaere — 2005-03-06T19:26:40Z

The Prelude team is very happy to announce today the reopening of the Prelude repository.

Thus after several weeks of closure and the written commitment [1] from the Exaprotect company in their press release dated 12 January 2005 to not use the Prelude system anymore since the middle of february we think that nothing, today, is opposing the reopening of the Prelude repository.
However, we regret that the Exaprotect company didn't conform to the GPL terms from the beginning.

In the end, we hope that the fact of having left opened the access to stable versions of the Prelude source code has permitted you to compensate for this nuisance.

Happy downloading and see you very soon for the Prelude 0.9 release!

[1] "ExaProtect Technology a décidé d'abandonner l'utilisation du logiciel libre Prelude" (Translation: "Exaprotect Technology has decided to abandon using the Prelude free software")

Answer to Exaprotect

Yoann Vandoorselaere — 2005-01-19T17:00:57Z

Prelude took note of the official statement of Exaprotect and intends to refute it point by point.

1) About the small contributions to Prelude quoted by Mr Christophe Briguet: these contributions are insignificant.

simple.c patch: simple.c.patch

This modification to the "simple" plugin (today called "pcre"), adds a new control variable and a condition. There are 2 lines of code constituting the "algorithm", and 9 lines of code for the variable declaration and hook to the "simple" parser. Two lines of code doesn't constitute a significant contribution.

Checkpoint plugin, Welf plugin:

These plugins were never integrated into LML because of the poor quality of the code.

These plugins would have hurt prelude-LML's performance and decreased its maintainability and its stability. The code was obviously written by someone without sufficient knowledge of system programming.

Unfortunately Exaprotect didn't talk to the Prelude team before writing the code. Had they done so, we would have advised them that the best path to take would be to add the functionality to the "simple" plugin itself rather than add two new plugins.

Exaprotect finally abandoned their plugin code and asked the Prelude team to modify the "simple" plugin to provide the needed functionality.

2) About Exaprotect promoting Prelude to their customers : the promotion was not systematic and many discussions were necessary.

When Exaprotect was formed it did not bring, to our knowledge, any benefit to the Prelude system.

As Prelude was a significant feed to the Exaprotect system, it seems natural that they would promote it to their customers. However, Exaprotect only mentioned Prelude to people who already knew of the ties between the two projects.

Each time Exaprotect flirted with legal limits without crossing the border to punishable behavior, the Prelude team endeavored to point out this attitude to Exaprotect and requested that it adjust its website to mention Prelude, to stop making profit from OSS without showing some sincerity, reciprocity and some honesty towards its OSS partner.

It took years for the Exaprotect company to grant our request to point out the Prelude project on it's website (during the second half of 2004).

3) About the claimed Prelude project benefit, and the alleged multiples experience feedback of Exaprotect.

For three years, we did not fail to satisfy Exaprotect ceaseless requests (in concrete terms: request for bugs resolution, request for functionality).

These requests were relating to features which Exaprotect intended to sell to their customers, or the use of Prelude in environments where it could not have been tested by the Prelude team.

We always endeavored to be available and to provide fixes and features to our partner with the result that we can count more than twenty free incidents (including support and functionality development) during the last 8 months. Some of these requests cost several weeks of development to the team.

4) About the claimed participation in financing the development of version 0.9 of Prelude : it was actually a contracted developer who was sacked before the end of the agreed term, as the developer can easily demonstrate if asked by the relevant authority.

The recruitment was aimed at the development of specific functionality intended for one Exaprotect's customers: a "large account of international scale" according to Mr. Briguet's own terms.

As the developments were aimed at features for Exaprotect to resell with profit (of which Prelude recevied no share) it does not seem to us that Exaprotect should speak about "sponsoring" but rather about recruiting, added value, appreciation and commercial deals.

In addition, as described in the preceding official statement, this contract related to 6 months. Exaprotect broke the contract at the end of the first 3 months.

5) About the recruiting by Exaprobe of a first "Prelude" "engineer" in 2003

In 2003, an agreement was made between Exaprotect and Prelude: Exaprotect was to engage a developer of the project who would work on the needs of Prelude and Exaprotect in parallel.

Thus, it was agreed that this programmer should create a modular correlation agent, whose heart was open source, but with the possibility to load proprietary plugins to satisfy Exaprotect's objectives.

However, the bonds between Prelude and the developer soon distended. He seemed to give priority to Exaprotect proprietary objectives and to ignore his open work source work.

Exaprotect reconsidered the initial agreement: this agent is now completely proprietary.

6) Exaprotect claims that : "to perennialize this collaboration, ExaProtect Technology tried on several occasions to work in a constructive way with Mr. Yoann Vandoorselaere (proposal for a contract of employment of unspecified duration, contract of subcontracting via a third company) without success."

The situation is quite different actually. Each of Exaprotect's proposals involved ruining the Prelude project and was at odds with Open Source ethics.

7) Further information:

The users will be able to check for themselves when the Prelude repository reopens, the scale of the contributions of Exaprotect / Exaprobe to the project source code:

 yoann@arwen /tmp/prelude $ svn co https://svn.prelude-ids.org/{trunk,branches/0-8} yoann@arwen /tmp/prelude $ ls -l 0-8/ trunk/ 0-8/: total 4 drwxr-xr-x 8 yoann users 624 Jan 13 17:27 libprelude drwxr-xr-x 10 yoann users 992 Jan 13 17:27 nessus-core drwxr-xr-x 13 yoann users 872 Jan 13 17:27 piwi drwxr-xr-x 6 yoann users 584 Jan 13 17:27 prelude-lml drwxr-xr-x 8 yoann users 632 Jan 13 17:27 prelude-manager drwxr-xr-x 7 yoann users 648 Jan 13 17:27 prelude-nids drwxr-xr-x 4 yoann users 448 Jan 13 17:27 prelude-pflogger trunk/: total 6 drwxr-xr-x 3 yoann users 296 Jan 13 17:25 idmef-draft drwxr-xr-x 9 yoann users 672 Jan 13 17:25 libprelude drwxr-xr-x 7 yoann users 496 Jan 13 17:25 libpreludedb drwxr-xr-x 9 yoann users 552 Jan 13 17:27 libqsearch drwxr-xr-x 4 yoann users 96 Jan 13 17:25 pimf drwxr-xr-x 13 yoann users 872 Jan 13 17:27 piwi drwxr-xr-x 6 yoann users 520 Jan 13 17:25 prelude-cm-agent drwxr-xr-x 4 yoann users 264 Jan 13 17:25 prelude-fic drwxr-xr-x 5 yoann users 320 Jan 13 17:25 prelude-gtk-frontend drwxr-xr-x 7 yoann users 584 Jan 13 17:25 prelude-lml drwxr-xr-x 8 yoann users 512 Jan 13 17:27 prelude-manager drwxr-xr-x 8 yoann users 608 Jan 13 17:25 prelude-nids drwxr-xr-x 4 yoann users 448 Jan 13 17:25 prelude-pflogger drwxr-xr-x 7 yoann users 320 Jan 13 17:27 prewikka drwxr-xr-x 4 yoann users 1248 Jan 13 17:25 pylude drwxr-xr-x 9 yoann users 704 Jan 13 17:27 snort-2.2 yoann@arwen /tmp/prelude $ find . -name '*.[ch]' | xargs grep -i "exaprotect\|exaprobe" yoann@arwen /tmp/prelude $

Aside from the 11 line patch described at the top of this mail, the only contribution of Exaprotect to Prelude was in the form of LML signatures. That absolutely does not constitute a significant contribution.

8) Conclusions

In order to compare the Exaprotect attitude with real and sincere contributions by various companies to the Prelude project:

MandrakeSoft hired Yoann Vandoorselaere, sponsoring Prelude, for almost 3 years.

Digital-Network and the Transnode company deal with the hosting of the Prelude server, and the support costs sometimes necessary on the server. The machine is placed on a multi-homed transit link of 100 Mb/s, which we are authorized to use fully. (maximum cost estimated depending on the throughput: 72 000 Euros/years).

Dreamlab offered a server to the Prelude team for hosting the project. This company also contributed financially to the project multiple time. Mr Nicolas Mayencourt, of the Dreamlab company, also contributed to the Prelude project by coming to Lyon from Switzerland in order to meet the Exaprotect company and to help reach an agreement with Prelude.

These 3 companies approached Prelude and contributed varying amounts, made good on their promises and were faithful to the open-source spirit of the Prelude project.

Quite to the contrary, Exaprotect's attitude towards Prelude, and to the community in general, was that they could benefit from the innocent naivety, the voluntary help and precariousness. Probation periods being reset instead of maturing into proper employment, recruiting but laying off at the last minute. Exaprotect plays patron by preaching well-worn "realistic" economic visions to voluntary and famished penguins without acknowledging the origin of the technology which they sometimes claim to have invented.

We wish here to thank the companies and the individuals who allowed the Prelude team to develop serious solutions for their customers: without technical compromise, hybrid solution or pretense.

We wish to thank here the few people who do not pretend but help, believe and engage truly.

We hope with their help to save Prelude from the shipwreck in which the flood of words and broken promises stranded it.

The SVN repository will thus be reopened in February as soon as we have assurance that Exaprotect does not use any element of our program, since, unfortunately, no compensation is to be expected from them. The Exaprotect company committed not to use Prelude from February 2005 in their official statement.

Réponse à Exaprotect

Yoann Vandoorselaere — 2005-01-19T17:00:31Z

Prelude a pris connaissance du communiqué d'Exaprotect et entend le réfuter point par point.

1) S'agissant des maigres contributions d'Exaprotect à Prelude citées par monsieur Christophe Briguet: ces apports sont insignifiants.

Patch simple.c: simple.c.patch

Cette modification au plugin "simple" (aujourd'hui renommé "pcre"), consiste en l'ajout d'une nouvelle variable de contrôle et d'une condition. Il s'agit de 2 lignes de code constituant l'algorithme, et 9 lignes de code de déclaration de variable et de branchement dans le parseur de "simple". Autant dire qu'il ne s'agit pas d'une contribution révélatrice de l'implication d'Exaprotect.

Plugin Checkpoint, plugin Welf:

Les deux plugins dont il est question ici, et dont le but était l'analyse des journaux systèmes Checkpoint et Welf n'ont jamais été intégrés à LML pour cause des failles présentes dans leur code.

Ces 2 plugins auraient pénalisé les performances de prelude-LML, mais encore auraient-ils diminué sa maintenabilité et sa sécurité, le code n'ayant visiblement pas été écrit par une personne disposant de connaissances suffisantes en matière de programmation système.

A ce sujet, les critiques que nous avons pu émettre concernant ces plugins ont incliné l'entreprise Exaprotect à réclamer au projet Prelude, en remplacement, une adaptation du plugin "simple" de façon à ce qu'il puisse autoriser la gestion des journaux systèmes concernés.

L'entreprise Exaprotect aura donc abandonné de son propre chef sa propre contribution.

2) Au sujet de la promotion du système Prelude auprès des clients d'Exaprotect : la citation n'est pas systématique et de nombreuses mises au point ont été nécessaires.

A sa création, l'entreprise Exaprotect n'apportait à notre connaissance aucune valeur ajoutée au système Prelude.

Dans un contexte où Prelude était une source importante d'alimentation du système d'Exaprotect, il était tout naturel qu'elle le plesbicite auprès de ses clients. Pour autant, nous avons déploré que l'entreprise Exaprotect ne cite le système Prelude que dans des conditions où le public avait connaissance de la dépendance à Prelude de leur solution EAS.

En revanche, Exaprotect s'est abstenue de nous citer spontanément chaque fois que, s'adressant à un public profane, cette société pouvait s'attendre à ce que l'omission de citer Prelude ne fût pas relevée par ses interlocuteurs.

Comme à chaque fois qu'Exaprotect flirt discrètement avec les limites de la licéité sans franchir au grand jour la frontière d'une conduite sanctionnable, l'équipe Prelude s'est efforcée de signaler son inconduite à son partenaire en l'invitant à redresser le tir en citant Prelude et, d'une facon générale, en l'engageant à ne pas adhérer au monde de l'open source par opportunisme et intérêt unilatéral, mais en manifestant plutôt de la sincérité, de la réciprocité, de la vérité dans ses rapports avec la source d'alimentation principale de sa technologie.

Il aura ainsi fallu des années à l'entreprise Exaprotect pour que celle-ci n'accède à nos requêtes et signale le projet Prelude sur son site (durant le 2 ème semestre 2004).

3) Au sujet des prétendus multiples retours d'expérience d'Exaprotect dont aurait bénéficié Prelude.

Pendant trois ans, nous n'avons pas manqué de satisfaire les demandes incessantes d'Exaprotect (en terme concret : demande de résolution de bugs, demande de fonctionnalités).

Ces demandes n'étaient pas désintéressées mais correspondaient, bien au contraire aux attentes de leurs clients, ou à l'utilisation de Prelude dans des environnements où celui ci n'avait pu être testé.

Nous nous sommes toujours efforcés d'être disponible et d'apporter satisfaction à notre partenaire en sorte que nous pouvons compter plus d'une vingtaine d'interventions gratuites (incluant support et développement de fonctionnalités) au cours des 8 derniers mois. Certaines de ces demandes ont coûté plusieurs semaines de développement à l'équipe.

Il est inutile de rappeler le coût de ce genre de prestations lorsqu'elles sont facturées par une société, prestations qui ont été fournies gratuitement à l'entreprise Exaprotect.

4) Au sujet de la participation prétendue au financement du développement de la version 0.9 de Prelude : il s'agit, en réalité, d'une embauche rompue avant le terme convenu ainsi que le salarié pourrait en justifier à tout moment.

L'embauche visait le développement de fonctionnalités spécifiques destinées à l'un des clients de l'entreprise Exaprotect : un "grand compte d'envergure internationale" selon les propres termes de M. Briguet.

S'agissant du développement par un salarié de fonctionnalités visant leur revente avec profit à un client il ne nous semble pas qu'Exaprotect doive parler de "sponsoring" mais plutôt d'embauche, de valeur ajoutée, de plus-value et d'opération commerciale.

Par ailleurs, comme indiqué dans le précédent communiqué, la durée convenue pour ce contrat était de six mois. Exaprotect a rompu le contrat au bout de trois mois.

5) Au sujet de l'embauche par Exaprobe d'un premier "ingénieur" "Prelude" en 2003

En 2003, un accord avait été passé entre Exaprotect et Prelude: Exaprotect devait embaucher un développeur du projet qui travaillerait à la fois sur les besoins de Prelude et les besoins d'Exaprotect.

Ainsi, il était convenu que ce programmeur devrait créer un agent de corrélation modulaire, dont le coeur était open source, mais avec la possibilité d'ajout de plugins propriétaires pour satisfaire les objectifs d'Exaprotect.

Or, contre toute attente, dès son embauche par Exaprotect, les liens entre Prelude et le développeur se sont distendus. Il semblait accorder la priorité aux objectifs propriétaires d'Exaprotect et se désintéresser de son travail open source.

De son côté Exaprotect est revenu sur l'accord initial : cet agent est totalement propriétaire.

6) Exaprotect prétend que : "Pour pérenniser cette collaboration, ExaProtect Technology a tenté à maintes reprises de travailler de manière constructive avec M. Yoann Vandoorselaere (proposition d'un contrat de travail à durée indéterminée, contrat de sous-traitance via une société tierce) sans succès."

Il en va tout autrement en réalité, chaque proposition d'Exaprotect revenait à confisquer la propriété de Prelude en sorte que nous ne pouvions réserver une suite favorable à de telles offres.

7) Complément d'information:

Les utilisateurs pourront vérifier par eux-mêmes lors de la réouverture du repository Prelude, l'échelle des contributions d'Exaprotect/Exaprobe au code source du projet:

 yoann@arwen /tmp/prelude $ svn co https://svn.prelude-ids.org/{trunk,branches/0-8} yoann@arwen /tmp/prelude $ ls -l 0-8/ trunk/ 0-8/: total 4 drwxr-xr-x 8 yoann users 624 Jan 13 17:27 libprelude drwxr-xr-x 10 yoann users 992 Jan 13 17:27 nessus-core drwxr-xr-x 13 yoann users 872 Jan 13 17:27 piwi drwxr-xr-x 6 yoann users 584 Jan 13 17:27 prelude-lml drwxr-xr-x 8 yoann users 632 Jan 13 17:27 prelude-manager drwxr-xr-x 7 yoann users 648 Jan 13 17:27 prelude-nids drwxr-xr-x 4 yoann users 448 Jan 13 17:27 prelude-pflogger trunk/: total 6 drwxr-xr-x 3 yoann users 296 Jan 13 17:25 idmef-draft drwxr-xr-x 9 yoann users 672 Jan 13 17:25 libprelude drwxr-xr-x 7 yoann users 496 Jan 13 17:25 libpreludedb drwxr-xr-x 9 yoann users 552 Jan 13 17:27 libqsearch drwxr-xr-x 4 yoann users 96 Jan 13 17:25 pimf drwxr-xr-x 13 yoann users 872 Jan 13 17:27 piwi drwxr-xr-x 6 yoann users 520 Jan 13 17:25 prelude-cm-agent drwxr-xr-x 4 yoann users 264 Jan 13 17:25 prelude-fic drwxr-xr-x 5 yoann users 320 Jan 13 17:25 prelude-gtk-frontend drwxr-xr-x 7 yoann users 584 Jan 13 17:25 prelude-lml drwxr-xr-x 8 yoann users 512 Jan 13 17:27 prelude-manager drwxr-xr-x 8 yoann users 608 Jan 13 17:25 prelude-nids drwxr-xr-x 4 yoann users 448 Jan 13 17:25 prelude-pflogger drwxr-xr-x 7 yoann users 320 Jan 13 17:27 prewikka drwxr-xr-x 4 yoann users 1248 Jan 13 17:25 pylude drwxr-xr-x 9 yoann users 704 Jan 13 17:27 snort-2.2 yoann@arwen /tmp/prelude $ find . -name '*.[ch]' | xargs grep -i "exaprotect\|exaprobe" yoann@arwen /tmp/prelude $

Comme dit précédemment, et mis à part un patch de 11 lignes décrit en haut de ce mail, la seule contribution d'Exaprotect à Prelude a été sous forme de signatures pour LML. Ce qui ne constitue absolument pas une contribution importante.

8) Conclusion

A titre de comparaison d'avec l'attitude d'Exaprotect il est possible de citer ici les apports réels et spontanés de différentes sociétés ayant contribué au projet Prelude:

MandrakeSoft a embauché Yoann Vandoorselaere, sponsorisant Prelude, pendant presque 3 ans.

Digital-Network et la société Transnode prennent en charge l'hébergement du serveur Prelude, et le coût des interventions parfois nécessaires sur le serveur. La machine est placée sur un lien de transit 100 Mb/s multi-opérateur, que nous sommes autorisés à utiliser pleinement. (coût maximum estimé selon débit: 72 000 Euros / ans).

Dreamlab a offert un serveur à l'équipe Prelude pour l'hébergement du projet. Cette société a aussi contribué financièrement au projet à de multiples reprises. Monsieur Nicolas Mayencourt, de la société Dreamlab, a aussi contribué au projet Prelude en venant personnellement à Lyon depuis la Suisse afin de rencontrer l'entreprise Exaprotect et d'aider à l'atteinte d'un accord avec Prelude.

Ces 3 sociétés ont contribué de leur propre chef sur des montants qui ont uniquement été évalués par eux mêmes, et toujours en se conformant tant à la lettre qu'à l'esprit open source au Projet Prelude. A l'inverse l'attitude de la société Exaprotect vis-à-vis de Prelude et de notre communauté s'est le plus souvent bornée à profiter de la naïveté, du bénévolat et de la précarité : de périodes d'essai reconduites en rupture de pourparlers, d'embauche-sponsoring en débauchage de dernière minute, ce partenaire différent joue au mécène en prêchant sa vision économique éculée qualifiée de "réaliste" auprès des pingouins bénévoles et affamés sans jamais insister ensuite publiquement sur l'origine généreuse et éthique de la technologie qu'il prétend parfois avoir "inventée".

Nous souhaitons ici remercier les sociétés et les individus qui nous ont permis de développer des solutions sérieuses pour leur clientèle : sans compromis technique, sans solution bâtarde, sans cache-misère ni faux semblant.

En un mot comme en 100000 lignes de code source qui forment le projet Prelude comme en 100000 heures que nous leur avons consacrées depuis ce matin de 1998 où nous avons rêvé les fourmis que vous voyez sur le site web nous souhaitons remercier ici les quelques personnes qui ne font pas semblant mais aident, croient et s'engagent pour de vrai.

Nous espèrons avec eux sauver Prelude du naufrage dans lequel l'ont échoué le flot des paroles et promesses non tenues.

Le SVN sera donc réouvert dans le courant du mois de février dès que nous aurons l'assurance que l'entreprise Exaprotect n'utilise plus aucun élément de notre programme, étant donné que, malheureusement plus aucun dédommagement n'est à attendre de leur part. L'entreprise Exaprotect s'est en effet engagée dans son communiqué à ne plus utiliser Prelude à partir de février 2005.