Hi Kivanio, By default ossec will use ipfilter on FreeBSD instead of pf. You need to replace the default active response script with the pf one:
# cd /var/ossec/active-response/bin # mv firewall-drop.sh old-drop.sh # cp -pr pf.sh firewall-drop.sh That should do it. You can also run the script manually to try it out: # /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 1.2.3.4 1207856472.1310679 20101 Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On Thu, Apr 10, 2008 at 4:55 PM, Kivanio Barbosa <[EMAIL PROTECTED]> wrote: > Hi, > > my active response don't work correctly. > > see logs: > > > > Thu Apr 10 15:40:08 AMT 2008 > /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - > 200.207.117.34 1207856408.1306074 20101 > Thu Apr 10 15:40:18 AMT 2008 > /usr/local/ossec-hids/active-response/bin/host-deny.sh add - 65.59.242.64 > 1207856418.1307576 20101 > Thu Apr 10 15:40:18 AMT 2008 > /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - > 65.59.242.64 1207856418.1307576 20101 > Thu Apr 10 15:40:58 AMT 2008 > /usr/local/ossec-hids/active-response/bin/host-deny.sh delete - > 200.155.80.31 1207852830.1175796 20101 > Thu Apr 10 15:40:58 AMT 2008 > /usr/local/ossec-hids/active-response/bin/host-deny.sh add - 201.3.38.37 > 1207856458.1308657 20100 > Thu Apr 10 15:40:58 AMT 2008 > /usr/local/ossec-hids/active-response/bin/firewall-drop.sh delete - > 200.155.80.31 1207852830.1175796 20101 > Thu Apr 10 15:40:58 AMT 2008 > /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 201.3.38.37 > 1207856458.1308657 20100 > Thu Apr 10 15:41:12 AMT 2008 > /usr/local/ossec-hids/active-response/bin/host-deny.sh add - 200.148.86.71 > 1207856472.1310679 20101 > Thu Apr 10 15:41:12 AMT 2008 > /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - > 200.148.86.71 1207856472.1310679 20101 > ^C > server serveruser /home/serveruser # date > Thu Apr 10 15:41:59 AMT 2008 > prime kbarbosa /usr/home/kbarbosa # pfctl -t ossec_fwtable -T show > server serveruser /home/serveruser # date > Thu Apr 10 15:42:07 AMT 2008 > server serveruser /home/serveruser # > > in log active response add ip, don't show problem or error: > > active-response/bin/firewall-drop.sh add - 200.148.86.71 1207856472.1310679 > 20101 > > but in : pfctl -t ossec_fwtable -T show > > don't show ips added and don't block conections. > > > what is the problem? > why ossec don't show errors? > > i change log level in internal_options.conf to 2, but the same problem > happen and don't show errors. > > i try use script directly: > > > # /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add ossec > 65.59.242.64 > # pfctl -t ossec_fwtable -T show > # /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add root > 65.59.242.64 > # pfctl -t ossec_fwtable -T show > > > but don't work too. > > > SO: FREEBSD > FW: Packet Filter > > PS: sorry for my bad english, i'm learning. > > OBS: Se tiver algum brasileiro que possa dar um auxílio pode entrar em > contato diretamente pelo mail. > > > Thanks, > > -- > Kivanio Pereira Barbosa > Cel 8121-4248 > > www.eiqconsultoria.com.br
