Daniel,
i forgot to say ossec is 1.5 beta, but the same happend with 1.4.
On Wed, Apr 23, 2008 at 4:00 PM, Kivanio Barbosa <[EMAIL PROTECTED]> wrote:
> Daniel,
> I wrote in first mail that i did it.
>
> so, I make all again, see:
>
> My SO is FREEBSD 7.0, not OpenBSD, OK?
>
> FreeBSD server.org.br 7.0-RELEASE FreeBSD 7.0-RELEASE #8: Thu Mar 20
> 12:06:04 AMT 2008 [EMAIL PROTECTED]:/usr/src/sys/i386/compile/server
> i386
>
>
> server joao /usr/home/joao # /bin/csh -x (I use csh instead of sh)
> You have mail.
>
> server joao /usr/local/ossec # cd logs/
> chdir logs/
> set prompt=`hostname -s` joao `pwd` #
> hostname -s
> pwd
>
> LAST LOGS:
>
> server joao /usr/local/ossec/logs # tail -f active-responses.log
> tail -f active-responses.log
> Wed Apr 23 15:34:08 AMT 2008
> /usr/local/ossec/active-response/bin/host-deny.sh delete -
> 200.154.55.41208978646.1095546 20101
> Wed Apr 23 15:34:08 AMT 2008
> /usr/local/ossec/active-response/bin/host-deny.sh delete -
> 64.15.125.2201208978568.1092931 20101
> Wed Apr 23 15:34:09 AMT 2008
> /usr/local/ossec/active-response/bin/firewall-drop.sh delete -
> 200.154.55.4 1208978646.1095546 20101
> Wed Apr 23 15:34:09 AMT 2008
> /usr/local/ossec/active-response/bin/firewall-drop.sh delete -
> 64.15.125.220 1208978568.1092931 20101
> Wed Apr 23 15:34:24 AMT 2008
> /usr/local/ossec/active-response/bin/host-deny.sh add -
> 64.15.120.1631208979264.1112819 20101
> Wed Apr 23 15:34:24 AMT 2008
> /usr/local/ossec/active-response/bin/firewall-drop.sh add -
> 64.15.120.1631208979264.1112819 20101
> Wed Apr 23 15:37:14 AMT 2008
> /usr/local/ossec/active-response/bin/host-deny.sh delete -
> 64.15.125.2261208978772.1096671 20101
> Wed Apr 23 15:37:14 AMT 2008
> /usr/local/ossec/active-response/bin/firewall-drop.sh delete -
> 64.15.125.226 1208978772.1096671 20101
> Wed Apr 23 15:37:36 AMT 2008
> /usr/local/ossec/active-response/bin/host-deny.sh add -
> 64.15.117.2101208979456.1117309 20101
> Wed Apr 23 15:37:36 AMT 2008
> /usr/local/ossec/active-response/bin/firewall-drop.sh add -
> 64.15.117.2101208979456.1117309 20101
>
>
> TABLE CLEAR:
>
> server joao /usr/local/ossec/logs # pfctl -t ossec_fwtable -T show
> pfctl -t ossec_fwtable -T show
>
>
> I TRY USE MANUALLY:
>
> server joao /usr/local/ossec/logs #
> /usr/local/ossec/active-response/bin/firewall-drop.sh add -
> 200.221.7.401208979566.1118443 20101
> /usr/local/ossec/active-response/bin/firewall-drop.sh add -
> 200.221.7.401208979566.1118443 20101
> cat: "/etc/pf.conf": No such file or directory
>
> IN MANUAL THE SCRIPT DON'T SUCH FILE, THE I EDIT FILE AND SET THE PATH
> /etc/pf.conf INSTEAD VARIABLE ${PFCTL_RULES}
>
> server joao /usr/local/ossec/logs # mcedit
> ../active-response/bin/firewall-drop.sh
> mcedit ../active-response/bin/firewall-drop.sh
>
> TRY AGAIN:
>
> server joao /usr/local/ossec/logs #
> /usr/local/ossec/active-response/bin/firewall-drop.sh add -
> 200.221.7.401208979566.1118443 20101
> /usr/local/ossec/active-response/bin/firewall-drop.sh add -
> 200.221.7.401208979566.1118443 20101
>
> ALL OK, BUT:
>
> server joao /usr/local/ossec/logs # pfctl -t ossec_fwtable -T show
> pfctl -t ossec_fwtable -T show
> server joao /usr/local/ossec/logs #
>
> TABLE STAYED CLEAR.
>
>
>
>
> On Wed, Apr 23, 2008 at 2:01 PM, Daniel Cid <[EMAIL PROTECTED]> wrote:
>
> >
> > Hi Kevin,
> >
> > The active responses are run by the ossec-execd process as root. So
> > there is no need to use sudo
> > in there... I initially thought about that, but since sudo is not
> > widely supported, I decided to stick with
> > running as root instead.
> >
> > Kivanio,
> >
> > Do you mind running the active response manually? Try
> >
> > # /bin/sh -x /var/ossec/active-response/bin/firewall-drop.sh add XXX
> > 192.168.2.1
> >
> > And then check the content of the table:
> >
> > # pfctl -t ossec_fwtable -T show
> >
> > If that doesn' t work, please show us the output from /bin/sh -x
> > (debugging enabled)... I tried this
> > over on OpenBSD and is working fine...
> >
> >
> > Thanks,
> >
> >
> > --
> > Daniel B. Cid
> > dcid ( at ) ossec.net
> >
> >
>
--
Kivanio Pereira Barbosa
Cel 8121-4248
www.eiqconsultoria.com.br
