[Dshield] Problems with uploading Logfiles

Jerry Thomas thomas at sbcc.edu
Wed Feb 4 17:46:50 GMT 2004


I could not get the Checkpoint "by the book" config to work either. 
After some browsing Dshield's site and making a guess or two, I came up
with the following for stormcenters.conf  It is able to get the block
list correctly and there is no error in the smartdefense log.  However,
i do not get any credit for lines uploaded and when I capture an upload
session with sniffer, there does not seem to be enough data.  Johannes
Ullrich is aware of the issue and is working on a solution.

I am running FW1 NGAI on a ipso 3.7 (BSD linux) platform.  Don't know
running it based on windows.  

Download
:DataURL ("https://secure.dshield.org/feeds/block.txt")
:CertificateFileName (equifax.cer)
:SignatureURL (dummy)
:SigPubKeyFileName (dummy)
:RefreshInterval (120)
:ExpireDataAfter (3)

Upload
:UploadURL ("https://secure.dshield.org/post.php")

>>> Daniel.Paul at shd-online.de 2/3/2004 11:57:34 PM >>>
I've got some problems with uploading logfiles from my Checkpoint FW-1
testsystem, and I'm not sure about the reason.

There are two entries in Logfile:

1:
Product:      	SmartDefense
Origin:         	cpmodule (IP)
Type:           	Log
Action:         	 
Information:	StormAgentName: CPDShield
                    	StormAgentAction: SSL
                    	StormAgentMsg: Certificate validation failed for
URL:
https://checkpoint.dshield.org/post.php?user=myemailaddress&pass=my_dshield_userid


2:
Product:      	SmartDefense
Origin:         	cpmodule (IP)
Type:           	Log
Action:         	 
Information:	StormAgentName: CPDShield
                    	StormAgentAction: Upload
                    	StormAgentMsg: Error getting request from storm
center.

Any idea for problem solution???

Best regards and thanks in advance

Daniel Paul





More information about the list mailing list