I haven't looked at the script yet, but you'll need to add a sudo command in order for the pf commands to work, which means you'll have to edit the sudoers file (using visudo) to allow the ossec user to modify the table.
The command should look like this: sudo /sbin/pfctl -ef /etc/pf.conf I'll explain it in more detail later when I have a chance to read the documentation, but that should get you by for now. -Kevin -----Original Message----- From: [email protected] [mailto:[EMAIL PROTECTED] Behalf Of Kivanio Barbosa Sent: Tuesday, April 22, 2008 1:32 PM To: [email protected] Subject: [ossec-list] Re: active-response with freebsd and PF Daniel, i think you don't understand what i said. i did all this. i add table, add rules, add all. ossec is using the script and in log show the ip and other things, don't show errors. but when i show table of PF, the table is clear. The rules of PF don't block ip because ip is not include in table. then, the ossec said that ip was added, but the ip is not include in table. the block using hosts is fine. do you understand? OBS: Acho que meu inglês está péssimo hehe, o ossec mostra no log a inclusão do ip, porém ele não inclui o ip, quando listo os ips da tabela, ela está limpa, porém ele inclui corretamente no hosts. Se eu mudar o nome da tabela, da erro, com isso sei que ele está usando a tabela certa, o único erro, é que o ip não consta na tabela, ou seja, ele diz que faz, mas na realidade não está fazendo, estou com o mesmo problema em 2 BSDs. tentei corrigir o script, porém aparentemente está tudo certo, e não consegui identificar nada fora do ossec que pudesse estar interferindo, por isso estou perguntando para ver se não era um bug conhecido, desculpe o incomodo. Pode responder em inglês mesmo ;) On Tue, Apr 22, 2008 at 12:50 PM, Daniel Cid <[EMAIL PROTECTED]> wrote: Hi Kivanio, Did you follow the steps in the configuration for pf? http://www.ossec.net/main/manual/#active-response-config " On PF, you need to create a table in your config and deny all the traffic to it. Add the following lines at the beginning of your rules and reload pf (pfctl -F all && pfctl -f /etc/pf.conf): table <ossec_fwtable> persist #ossec_fwtable block in quick from <ossec_fwtable> to any block out quick from any to <ossec_fwtable> " Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Sun, Apr 13, 2008 at 8:50 PM, Kivanio Barbosa <[EMAIL PROTECTED]> wrote: > Hi Daniel, > > i see your mensage about ossec 1.5 so i remove ossec 1.4 and install 1.5. > > the same problem happen. > > > > server server /usr/local/ossec # tail -f logs/active-responses.log > Sun Apr 13 19:42:55 AMT 2008 > /usr/local/ossec/active-response/bin/host-deny.sh add - 89.13.24.98 > 1208130175.568 20100 > Sun Apr 13 19:42:55 AMT 2008 > /usr/local/ossec/active-response/bin/firewall-drop.sh add - 89.13.24.98 > 1208130175.568 20100 > ^C > server server /usr/local/ossec # pfctl -t ossec_fwtable -T show > server server /usr/local/ossec # cat /etc/hosts.deny > ALL:89.48.135.87 > ALL:89.48.62.163 > ALL:217.235.146.142 > ALL:92.228.210.101 > ALL:91.37.126.196 > ALL:89.57.6.219 > ALL:77.181.89.215 > ALL:79.234.249.31 > ALL:77.134.83.174 > ALL:77.178.150.133 > ALL:217.235.220.210 > ALL:77.179.187.66 > ALL:77.183.179.60 > ALL:87.167.138.240 > ALL:75.126.23.220 > ALL:217.232.206.235 > ALL:77.179.9.47 > ALL:84.145.5.163 > ALL:89.13.24.98 > ALL:79.234.249.31 > ALL:89.48.62.163 > ALL:217.235.146.142 > ALL:89.48.161.32 > ALL:201.3.34.169 > > > The host-deny.sh works fine but firewall-drop.sh don't. > > > -- > Kivanio Pereira Barbosa > Cel 8121-4248 > > www.eiqconsultoria.com.br -- Kivanio Pereira Barbosa Cel 8121-4248 www.eiqconsultoria.com.br This message may contain confidential or proprietary information and is intended solely for the individual(s) to whom it is addressed. If you are not a named addressee you should not disseminate, distribute or copy this e-mail or act upon the information contained herein. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.
