Re: [ossec-list] cannot get policy auditing to work

[dan (ddp)]

On Tue, Mar 28, 2017 at 5:16 PM, Keith Goodlip  wrote:
> I've been trying to setup policy audit in a lab I've set up to no avail.
>
> My setup is 2 servers (server, client) using CentOS 7.3 and RPMs from the
> atomic repository (selinux, firewalld are disabled) (ipv6 is enabled)
>
> All server processes are up and running:
>
> [root@ossec-server ossec]# bin/ossec-control status
> ossec-monitord is running...
> ossec-logcollector is running...
> ossec-remoted is running...
> ossec-syscheckd is running...
> ossec-analysisd is running...
> ossec-maild is running...
> ossec-execd is running...
> ossec-dbd is running...
>
>
> client enrolled via manage_agents and I can see it registered and active:
>
> [root@ossec-server ossec]# bin/agent_control -i 001
> OSSEC HIDS agent_control. Agent information:
>Agent ID:   001
>Agent Name: ossec-client.infosec
>IP address: 172.16.29.6/32
>Status: Active
>
>Operating system:Linux ossec-client.infosec
> 3.10.0-514.10.2.el7.x86_64 #1 SMP Fri Mar 3 00:04:05 UTC 2017 x86_64
>Client version:  OSSEC HIDS v2.9.0 / 9fd969bbe7f4a3f52951a3e3acb1953b
>Last keep alive: Tue Mar 28 23:09:30 2017
>
>Syscheck last started  at: Tue Mar 28 23:00:35 2017
>Rootcheck last started at: Tue Mar 28 22:41:41 2017
>
>
> here is my agent.conf:
> 
>   
> 
> 3600
>
> 
> /etc,/usr/bin,/usr/sbin
> /bin,/sbin
>
> 
> /etc/mtab
> /etc/mnttab
> /etc/hosts.deny
> /etc/mail/statistics
> /etc/random-seed
> /etc/adjtime
> /etc/httpd/logs
> /etc/utmpx
> /etc/wtmpx
> /etc/cups/certs
> /etc/dumpdates
> /etc/svc/volatile
>
>   
>
>   
>   
> syslog
> /var/log/messages
>   
>
>   
> syslog
> /var/log/secure
>   
>
>   
> syslog
> /var/log/maillog
>   
>
>   
> syslog
> /var/log/yum.log
>   
>
>   
> syslog
> /var/ossec/logs/active-responses.log
>   
>
>   
> /var/ossec/etc/shared/rootkit_files.txt
>
> /var/ossec/etc/shared/rootkit_trojans.txt
> /var/ossec/etc/shared/system_audit_rcl.txt
>
> /var/ossec/etc/shared/cis_rhel7_linux_rcl.txt
>   
>
> 
>
> MD5 matches between /var/ossec/etc/shared/agent.conf and the client version
> I get from bin/agent_control -i 001
>
> However I'm not getting any results from the  system_audit.
>
> What am I doing wrong?
>

Try running ossec-syscheckd in debug mode, and check ossec.log for
messages about it.

> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[ossec-list] cannot get policy auditing to work

[Keith Goodlip]

I've been trying to setup policy audit in a lab I've set up to no avail.

My setup is 2 servers (server, client) using CentOS 7.3 and RPMs from the 
atomic repository (selinux, firewalld are disabled) (ipv6 is enabled)

All server processes are up and running:

*[root@ossec-server ossec]# bin/ossec-control status*
*ossec-monitord is running...*
*ossec-logcollector is running...*
*ossec-remoted is running...*
*ossec-syscheckd is running...*
*ossec-analysisd is running...*
*ossec-maild is running...*
*ossec-execd is running...*
*ossec-dbd is running...*


client enrolled via manage_agents and I can see it registered and active:

*[root@ossec-server ossec]# bin/agent_control -i 001*
*OSSEC HIDS agent_control. Agent information:*
*   Agent ID:   001*
*   Agent Name: ossec-client.infosec*
*   IP address: 172.16.29.6/32*
*   Status: Active*

*   Operating system:Linux ossec-client.infosec 
3.10.0-514.10.2.el7.x86_64 #1 SMP Fri Mar 3 00:04:05 UTC 2017 x86_64*
*   Client version:  OSSEC HIDS v2.9.0 / 
9fd969bbe7f4a3f52951a3e3acb1953b*
*   Last keep alive: Tue Mar 28 23:09:30 2017*

*   Syscheck last started  at: Tue Mar 28 23:00:35 2017*
*   Rootcheck last started at: Tue Mar 28 22:41:41 2017*


here is my agent.conf:

  

3600


/etc,/usr/bin,/usr/sbin
/bin,/sbin


/etc/mtab
/etc/mnttab
/etc/hosts.deny
/etc/mail/statistics
/etc/random-seed
/etc/adjtime
/etc/httpd/logs
/etc/utmpx
/etc/wtmpx
/etc/cups/certs
/etc/dumpdates
/etc/svc/volatile

  

  
  
syslog
/var/log/messages
  

  
syslog
/var/log/secure
  

  
syslog
/var/log/maillog
  

  
syslog
/var/log/yum.log
  

  
syslog
/var/ossec/logs/active-responses.log
  

  
/var/ossec/etc/shared/rootkit_files.txt

/var/ossec/etc/shared/rootkit_trojans.txt
/var/ossec/etc/shared/system_audit_rcl.txt

/var/ossec/etc/shared/cis_rhel7_linux_rcl.txt
  



MD5 matches between /var/ossec/etc/shared/agent.conf and the client version 
I get from *bin/agent_control -i 001*

However I'm not getting any results from the  system_audit.

What am I doing wrong? 

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.