Daniel,
I wrote in first mail that i did it.
so, I make all again, see:
My SO is FREEBSD 7.0, not OpenBSD, OK?
FreeBSD server.org.br 7.0-RELEASE FreeBSD 7.0-RELEASE #8: Thu Mar 20
12:06:04 AMT 2008 [EMAIL PROTECTED]:/usr/src/sys/i386/compile/server
i386
server joao /usr/home/joao # /bin/csh -x (I use csh instead of sh)
You have mail.
server joao /usr/local/ossec # cd logs/
chdir logs/
set prompt=`hostname -s` joao `pwd` #
hostname -s
pwd
LAST LOGS:
server joao /usr/local/ossec/logs # tail -f active-responses.log
tail -f active-responses.log
Wed Apr 23 15:34:08 AMT 2008
/usr/local/ossec/active-response/bin/host-deny.sh delete -
200.154.55.41208978646.1095546 20101
Wed Apr 23 15:34:08 AMT 2008
/usr/local/ossec/active-response/bin/host-deny.sh delete -
64.15.125.2201208978568.1092931 20101
Wed Apr 23 15:34:09 AMT 2008
/usr/local/ossec/active-response/bin/firewall-drop.sh delete -
200.154.55.41208978646.1095546 20101
Wed Apr 23 15:34:09 AMT 2008
/usr/local/ossec/active-response/bin/firewall-drop.sh delete -
64.15.125.2201208978568.1092931 20101
Wed Apr 23 15:34:24 AMT 2008
/usr/local/ossec/active-response/bin/host-deny.sh add -
64.15.120.1631208979264.1112819 20101
Wed Apr 23 15:34:24 AMT 2008
/usr/local/ossec/active-response/bin/firewall-drop.sh add -
64.15.120.1631208979264.1112819 20101
Wed Apr 23 15:37:14 AMT 2008
/usr/local/ossec/active-response/bin/host-deny.sh delete -
64.15.125.2261208978772.1096671 20101
Wed Apr 23 15:37:14 AMT 2008
/usr/local/ossec/active-response/bin/firewall-drop.sh delete -
64.15.125.2261208978772.1096671 20101
Wed Apr 23 15:37:36 AMT 2008
/usr/local/ossec/active-response/bin/host-deny.sh add -
64.15.117.2101208979456.1117309 20101
Wed Apr 23 15:37:36 AMT 2008
/usr/local/ossec/active-response/bin/firewall-drop.sh add -
64.15.117.2101208979456.1117309 20101
TABLE CLEAR:
server joao /usr/local/ossec/logs # pfctl -t ossec_fwtable -T show
pfctl -t ossec_fwtable -T show
I TRY USE MANUALLY:
server joao /usr/local/ossec/logs #
/usr/local/ossec/active-response/bin/firewall-drop.sh add -
200.221.7.401208979566.1118443 20101
/usr/local/ossec/active-response/bin/firewall-drop.sh add -
200.221.7.401208979566.1118443 20101
cat: "/etc/pf.conf": No such file or directory
IN MANUAL THE SCRIPT DON'T SUCH FILE, THE I EDIT FILE AND SET THE PATH
/etc/pf.conf INSTEAD VARIABLE ${PFCTL_RULES}
server joao /usr/local/ossec/logs # mcedit
../active-response/bin/firewall-drop.sh
mcedit ../active-response/bin/firewall-drop.sh
TRY AGAIN:
server joao /usr/local/ossec/logs #
/usr/local/ossec/active-response/bin/firewall-drop.sh add -
200.221.7.401208979566.1118443 20101
/usr/local/ossec/active-response/bin/firewall-drop.sh add -
200.221.7.401208979566.1118443 20101
ALL OK, BUT:
server joao /usr/local/ossec/logs # pfctl -t ossec_fwtable -T show
pfctl -t ossec_fwtable -T show
server joao /usr/local/ossec/logs #
TABLE STAYED CLEAR.
On Wed, Apr 23, 2008 at 2:01 PM, Daniel Cid <[EMAIL PROTECTED]> wrote:
>
> Hi Kevin,
>
> The active responses are run by the ossec-execd process as root. So
> there is no need to use sudo
> in there... I initially thought about that, but since sudo is not
> widely supported, I decided to stick with
> running as root instead.
>
> Kivanio,
>
> Do you mind running the active response manually? Try
>
> # /bin/sh -x /var/ossec/active-response/bin/firewall-drop.sh add XXX
> 192.168.2.1
>
> And then check the content of the table:
>
> # pfctl -t ossec_fwtable -T show
>
> If that doesn' t work, please show us the output from /bin/sh -x
> (debugging enabled)... I tried this
> over on OpenBSD and is working fine...
>
>
> Thanks,
>
>
> --
> Daniel B. Cid
> dcid ( at ) ossec.net
>
>
