Hi, my active response don't work correctly.
see logs: Thu Apr 10 15:40:08 AMT 2008 /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 200.207.117.34 1207856408.1306074 20101 Thu Apr 10 15:40:18 AMT 2008 /usr/local/ossec-hids/active-response/bin/host-deny.sh add - 65.59.242.641207856418.1307576 20101 Thu Apr 10 15:40:18 AMT 2008 /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 65.59.242.64 1207856418.1307576 20101 Thu Apr 10 15:40:58 AMT 2008 /usr/local/ossec-hids/active-response/bin/host-deny.sh delete - 200.155.80.31 1207852830.1175796 20101 Thu Apr 10 15:40:58 AMT 2008 /usr/local/ossec-hids/active-response/bin/host-deny.sh add - 201.3.38.371207856458.1308657 20100 Thu Apr 10 15:40:58 AMT 2008 /usr/local/ossec-hids/active-response/bin/firewall-drop.sh delete - 200.155.80.31 1207852830.1175796 20101 Thu Apr 10 15:40:58 AMT 2008 /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 201.3.38.371207856458.1308657 20100 Thu Apr 10 15:41:12 AMT 2008 /usr/local/ossec-hids/active-response/bin/host-deny.sh add - 200.148.86.711207856472.1310679 20101 Thu Apr 10 15:41:12 AMT 2008 /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 200.148.86.71 1207856472.1310679 20101 ^C server serveruser /home/serveruser # date Thu Apr 10 15:41:59 AMT 2008 prime kbarbosa /usr/home/kbarbosa # pfctl -t ossec_fwtable -T show server serveruser /home/serveruser # date Thu Apr 10 15:42:07 AMT 2008 server serveruser /home/serveruser # in log active response add ip, don't show problem or error: active-response/bin/firewall-drop.sh add - 200.148.86.71 1207856472.1310679 20101 but in : pfctl -t ossec_fwtable -T show don't show ips added and don't block conections. what is the problem? why ossec don't show errors? i change log level in internal_options.conf to 2, but the same problem happen and don't show errors. i try use script directly: # /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add ossec 65.59.242.64 # pfctl -t ossec_fwtable -T show # /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add root 65.59.242.64 # pfctl -t ossec_fwtable -T show but don't work too. SO: FREEBSD FW: Packet Filter PS: sorry for my bad english, i'm learning. OBS: Se tiver algum brasileiro que possa dar um auxílio pode entrar em contato diretamente pelo mail. Thanks, -- Kivanio Pereira Barbosa Cel 8121-4248 www.eiqconsultoria.com.br
