Hi Daniel, i see your mensage about ossec 1.5 so i remove ossec 1.4 and install 1.5.
the same problem happen. server server /usr/local/ossec # tail -f logs/active-responses.log Sun Apr 13 19:42:55 AMT 2008 /usr/local/ossec/active-response/bin/host-deny.sh add - 89.13.24.981208130175.568 20100 Sun Apr 13 19:42:55 AMT 2008 /usr/local/ossec/active-response/bin/firewall-drop.sh add - 89.13.24.981208130175.568 20100 ^C server server /usr/local/ossec # pfctl -t ossec_fwtable -T show server server /usr/local/ossec # cat /etc/hosts.deny ALL:89.48.135.87 ALL:89.48.62.163 ALL:217.235.146.142 ALL:92.228.210.101 ALL:91.37.126.196 ALL:89.57.6.219 ALL:77.181.89.215 ALL:79.234.249.31 ALL:77.134.83.174 ALL:77.178.150.133 ALL:217.235.220.210 ALL:77.179.187.66 ALL:77.183.179.60 ALL:87.167.138.240 ALL:75.126.23.220 ALL:217.232.206.235 ALL:77.179.9.47 ALL:84.145.5.163 ALL:89.13.24.98 ALL:79.234.249.31 ALL:89.48.62.163 ALL:217.235.146.142 ALL:89.48.161.32 ALL:201.3.34.169 The host-deny.sh works fine but firewall-drop.sh don't. -- Kivanio Pereira Barbosa Cel 8121-4248 www.eiqconsultoria.com.br
