Hi Daniel,
i did change scripts.
the problem happen with pf script.
server server /usr/home/server #
/usr/local/ossec-hids/active-response/bin/firewall-drop.sh add -
1.2.3.41207856472.1310679 20101
server server /usr/home/server # pfctl -t ossec_fwtable -T show
server server /usr/home/server #
/usr/local/ossec-hids/active-response/bin/firewall-drop.sh
/usr/local/ossec-hids/active-response/bin/firewall-drop.sh: <action>
<username> <ip>
server server /usr/home/server #
/usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 1.2.3.4
server server /usr/home/server # pfctl -t ossec_fwtable -T show
server server /usr/home/server # cat
/usr/local/ossec-hids/active-response/bin/firewall-drop.sh
#!/bin/sh
# Author: Rafael M. Capovilla
# Last modified: Jul 15, 2006 - Rafael M. Capovilla
# 15/Jul - Added support to OpenBSD/FreeBSD pf rules
UNAME=`uname`
GREP=`which grep`
PFCTL="/sbin/pfctl"
# Getting pf rules file.
PFCTL_RULES=`${GREP} pf_rules /etc/rc.conf | awk -F"=" '{print $2}' | awk
'{print $1}'`
if [ "X${PFCTL_RULES}" = "X" ]; then
PFCTL_RULES="/etc/pf.conf"
fi
On Sun, Apr 13, 2008 at 5:01 PM, Daniel Cid <[EMAIL PROTECTED]> wrote:
>
> Hi Kivanio,
>
> By default ossec will use ipfilter on FreeBSD instead of pf. You need
> to replace the default active response
> script with the pf one:
>
> # cd /var/ossec/active-response/bin
> # mv firewall-drop.sh old-drop.sh
> # cp -pr pf.sh firewall-drop.sh
>
> That should do it. You can also run the script manually to try it out:
>
> # /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add -
> 1.2.3.4 1207856472.1310679 20101
>
>
> Hope it helps.
>
> --
> Daniel B. Cid
> dcid ( at ) ossec.net
>
> On Thu, Apr 10, 2008 at 4:55 PM, Kivanio Barbosa <[EMAIL PROTECTED]>
> wrote:
> > Hi,
> >
> > my active response don't work correctly.
> >
> > see logs:
> >
> >
> >
> > Thu Apr 10 15:40:08 AMT 2008
> > /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add -
> > 200.207.117.34 1207856408.1306074 20101
> > Thu Apr 10 15:40:18 AMT 2008
> > /usr/local/ossec-hids/active-response/bin/host-deny.sh add -
> 65.59.242.64
> > 1207856418.1307576 20101
> > Thu Apr 10 15:40:18 AMT 2008
> > /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add -
> > 65.59.242.64 1207856418.1307576 20101
> > Thu Apr 10 15:40:58 AMT 2008
> > /usr/local/ossec-hids/active-response/bin/host-deny.sh delete -
> > 200.155.80.31 1207852830.1175796 20101
> > Thu Apr 10 15:40:58 AMT 2008
> > /usr/local/ossec-hids/active-response/bin/host-deny.sh add - 201.3.38.37
> > 1207856458.1308657 20100
> > Thu Apr 10 15:40:58 AMT 2008
> > /usr/local/ossec-hids/active-response/bin/firewall-drop.sh delete -
> > 200.155.80.31 1207852830.1175796 20101
> > Thu Apr 10 15:40:58 AMT 2008
> > /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add -
> 201.3.38.37
> > 1207856458.1308657 20100
> > Thu Apr 10 15:41:12 AMT 2008
> > /usr/local/ossec-hids/active-response/bin/host-deny.sh add -
> 200.148.86.71
> > 1207856472.1310679 20101
> > Thu Apr 10 15:41:12 AMT 2008
> > /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add -
> > 200.148.86.71 1207856472.1310679 20101
> > ^C
> > server serveruser /home/serveruser # date
> > Thu Apr 10 15:41:59 AMT 2008
> > prime kbarbosa /usr/home/kbarbosa # pfctl -t ossec_fwtable -T show
> > server serveruser /home/serveruser # date
> > Thu Apr 10 15:42:07 AMT 2008
> > server serveruser /home/serveruser #
> >
> > in log active response add ip, don't show problem or error:
> >
> > active-response/bin/firewall-drop.sh add - 200.148.86.711207856472.1310679
> > 20101
> >
> > but in : pfctl -t ossec_fwtable -T show
> >
> > don't show ips added and don't block conections.
> >
> >
> > what is the problem?
> > why ossec don't show errors?
> >
> > i change log level in internal_options.conf to 2, but the same problem
> > happen and don't show errors.
> >
> > i try use script directly:
> >
> >
> > # /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add ossec
> > 65.59.242.64
> > # pfctl -t ossec_fwtable -T show
> > # /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add root
> > 65.59.242.64
> > # pfctl -t ossec_fwtable -T show
> >
> >
> > but don't work too.
> >
> >
> > SO: FREEBSD
> > FW: Packet Filter
> >
> > PS: sorry for my bad english, i'm learning.
> >
> > OBS: Se tiver algum brasileiro que possa dar um auxílio pode entrar em
> > contato diretamente pelo mail.
> >
> >
> > Thanks,
> >
> > --
> > Kivanio Pereira Barbosa
> > Cel 8121-4248
> >
> > www.eiqconsultoria.com.br
>
--
Kivanio Pereira Barbosa
Cel 8121-4248
www.eiqconsultoria.com.br
