Hi Daniel,
i test new version 1.5.1 and the problem with PF was fix.
thanks.
On Fri, Apr 25, 2008 at 10:32 AM, Daniel Cid <[EMAIL PROTECTED]> wrote:
>
> Hi Kivanio,
>
> I need the output from the command as I said:
>
> # /bin/sh -x /var/ossec/active-response/bin/firewall-drop.sh add XXX
> 192.168.2.1
>
> This will give me debug information from the script and not from your
> terminal. I also tried it on
> FreeBSD and worked fine...
>
> Thanks,
>
> --
> Daniel B. Cid
> dcid ( at ) ossec.net
>
> On Wed, Apr 23, 2008 at 5:09 PM, Kivanio Barbosa <[EMAIL PROTECTED]>
> wrote:
> > Daniel,
> >
> > i forgot to say ossec is 1.5 beta, but the same happend with 1.4.
> >
> >
> >
> > On Wed, Apr 23, 2008 at 4:00 PM, Kivanio Barbosa <[EMAIL PROTECTED]>
> wrote:
> >
> > > Daniel,
> > >
> > >
> > > I wrote in first mail that i did it.
> > >
> > >
> > > so, I make all again, see:
> > >
> > >
> > > My SO is FREEBSD 7.0, not OpenBSD, OK?
> > >
> > >
> > > FreeBSD server.org.br 7.0-RELEASE FreeBSD 7.0-RELEASE #8: Thu Mar 20
> > 12:06:04 AMT 2008 [EMAIL PROTECTED]:
> /usr/src/sys/i386/compile/server
> > i386
> > >
> > >
> > >
> > >
> > >
> > >
> > > server joao /usr/home/joao # /bin/csh -x (I use csh instead of sh)
> > > You have mail.
> > >
> > >
> > > server joao /usr/local/ossec # cd logs/
> > > chdir logs/
> > > set prompt=`hostname -s` joao `pwd` #
> > > hostname -s
> > > pwd
> > >
> > >
> > > LAST LOGS:
> > >
> > >
> > > server joao /usr/local/ossec/logs # tail -f active-responses.log
> > > tail -f active-responses.log
> > > Wed Apr 23 15:34:08 AMT 2008
> > /usr/local/ossec/active-response/bin/host-deny.sh delete - 200.154.55.4
> > 1208978646.1095546 20101
> > > Wed Apr 23 15:34:08 AMT 2008
> > /usr/local/ossec/active-response/bin/host-deny.sh delete - 64.15.125.220
> > 1208978568.1092931 20101
> > > Wed Apr 23 15:34:09 AMT 2008
> > /usr/local/ossec/active-response/bin/firewall-drop.sh delete -
> 200.154.55.4
> > 1208978646.1095546 20101
> > > Wed Apr 23 15:34:09 AMT 2008
> > /usr/local/ossec/active-response/bin/firewall-drop.sh delete -
> 64.15.125.220
> > 1208978568.1092931 20101
> > > Wed Apr 23 15:34:24 AMT 2008
> > /usr/local/ossec/active-response/bin/host-deny.sh add - 64.15.120.163
> > 1208979264.1112819 20101
> > > Wed Apr 23 15:34:24 AMT 2008
> > /usr/local/ossec/active-response/bin/firewall-drop.sh add -
> 64.15.120.163
> > 1208979264.1112819 20101
> > > Wed Apr 23 15:37:14 AMT 2008
> > /usr/local/ossec/active-response/bin/host-deny.sh delete - 64.15.125.226
> > 1208978772.1096671 20101
> > > Wed Apr 23 15:37:14 AMT 2008
> > /usr/local/ossec/active-response/bin/firewall-drop.sh delete -
> 64.15.125.226
> > 1208978772.1096671 20101
> > > Wed Apr 23 15:37:36 AMT 2008
> > /usr/local/ossec/active-response/bin/host-deny.sh add - 64.15.117.210
> > 1208979456.1117309 20101
> > > Wed Apr 23 15:37:36 AMT 2008
> > /usr/local/ossec/active-response/bin/firewall-drop.sh add -
> 64.15.117.210
> > 1208979456.1117309 20101
> > >
> > >
> > >
> > >
> > > TABLE CLEAR:
> > >
> > >
> > > server joao /usr/local/ossec/logs # pfctl -t ossec_fwtable -T show
> > >
> > > pfctl -t ossec_fwtable -T show
> > >
> > >
> > >
> > >
> > > I TRY USE MANUALLY:
> > >
> > >
> > > server joao /usr/local/ossec/logs #
> > /usr/local/ossec/active-response/bin/firewall-drop.sh add - 200.221.7.40
> > 1208979566.1118443 20101
> > > /usr/local/ossec/active-response/bin/firewall-drop.sh add -
> 200.221.7.40
> > 1208979566.1118443 20101
> > > cat: "/etc/pf.conf": No such file or directory
> > >
> > >
> > > IN MANUAL THE SCRIPT DON'T SUCH FILE, THE I EDIT FILE AND SET THE PATH
> > /etc/pf.conf INSTEAD VARIABLE ${PFCTL_RULES}
> > >
> > >
> > > server joao /usr/local/ossec/logs # mcedit
> > ../active-response/bin/firewall-drop.sh
> > > mcedit ../active-response/bin/firewall-drop.sh
> > >
> > >
> > > TRY AGAIN:
> > >
> > >
> > > server joao /usr/local/ossec/logs #
> > /usr/local/ossec/active-response/bin/firewall-drop.sh add - 200.221.7.40
> > 1208979566.1118443 20101
> > > /usr/local/ossec/active-response/bin/firewall-drop.sh add -
> 200.221.7.40
> > 1208979566.1118443 20101
> > >
> > >
> > > ALL OK, BUT:
> > >
> > >
> > > server joao /usr/local/ossec/logs # pfctl -t ossec_fwtable -T show
> > >
> > > pfctl -t ossec_fwtable -T show
> > > server joao /usr/local/ossec/logs #
> > >
> > >
> > > TABLE STAYED CLEAR.
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > On Wed, Apr 23, 2008 at 2:01 PM, Daniel Cid <[EMAIL PROTECTED]>
> wrote:
> > >
> > > >
> > > > Hi Kevin,
> > > >
> > > > The active responses are run by the ossec-execd process as root. So
> > > > there is no need to use sudo
> > > > in there... I initially thought about that, but since sudo is not
> > > > widely supported, I decided to stick with
> > > > running as root instead.
> > > >
> > > > Kivanio,
> > > >
> > > > Do you mind running the active response manually? Try
> > > >
> > > > # /bin/sh -x /var/ossec/active-response/bin/firewall-drop.sh add XXX
> > 192.168.2.1
> > > >
> > > > And then check the content of the table:
> > > >
> > > >
> > > > # pfctl -t ossec_fwtable -T show
> > > >
> > > > If that doesn' t work, please show us the output from /bin/sh -x
> > > > (debugging enabled)... I tried this
> > > > over on OpenBSD and is working fine...
> > > >
> > > >
> > > >
> > > > Thanks,
> > > >
> > > >
> > > > --
> > > > Daniel B. Cid
> > > > dcid ( at ) ossec.net
> > > >
> > > >
> > >
> > >
> >
> >
> >
> > --
> > Kivanio Pereira Barbosa
> > Cel 8121-4248
> >
> > www.eiqconsultoria.com.br
>
--
Kivanio Pereira Barbosa
Cel 8121-4248
www.eiqconsultoria.com.br
