[Bro] Bro Cluster Issue

epsalon135 epsalon135 at yahoo.com
Thu Aug 26 15:11:38 PDT 2010


Greetings group,

 I'm having an issue with Bro and clustering. I keep getting this error:

[BroControl] > install
removing old policies in /usr/local/bro/share/bro/.site ... done.
creating policy directories ... done.
installing site policies ... done.
generating broctl-layout.bro ... done.
generating analysis-policy.bro ... done.
generating local-networks.bro ... done.
updating nodes ... Permission denied (publickey,keyboard-interactive).
warning: connection to 10.10.2.13 broke
Permission denied (publickey,keyboard-interactive).
warning: connection to 10.10.2.14 broke
warning: connection to 10.10.2.13 broke
warning: connection to 10.10.2.14 broke
warning: connection to 10.10.2.13 broke
warning: connection to 10.10.2.14 broke
warning: connection to 10.10.2.13 broke
warning: connection to 10.10.2.14 broke
warning: cannot create directory /usr/local/bro/spool/tmp on worker-1
warning: cannot create directory /usr/local/bro/spool/tmp on worker-2
warning: cannot create directory /usr/local/bro/spool/tmp on worker-1
warning: cannot create directory /usr/local/bro/spool/tmp on worker-2
warning: cannot create directory /usr/local/bro/spool/tmp on worker-1
warning: cannot create directory /usr/local/bro/spool/tmp on worker-2
warning: cannot create directory /usr/local/bro/spool/tmp on worker-1
warning: cannot create directory /usr/local/bro/spool/tmp on worker-2
warning: error rsyncing to 10.10.2.13: ['Permission denied (publickey,keyboard-interactive).\r', 'rsync: connection unexpectedly closed (0 bytes received so far) [sender]', 'rsync error: unexplained error (code 255) at io.c(600) [sender=3.0.6]']
warning: error rsyncing to 10.10.2.14: ['Permission denied (publickey,keyboard-interactive).\r', 'rsync: connection unexpectedly closed (0 bytes received so far) [sender]', 'rsync error: unexplained error (code 255) at io.c(600) [sender=3.0.6]']
done.

I thought I had all my permissions correct but I guess not. I know rsync works and ssh (with out a password). 

Any thoughts? 

Thanks,

--John



      
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20100826/f8bd7c82/attachment.html 


More information about the Bro mailing list