Hi Matthew, It was indeed a bug. You should be able to use 0.0.0.0/0 or the keyword "any" to define any IP address. It is fixed at:
http://www.ossec.net/files/snapshots/ossec-hids-080725.tar.gz You will also need to update the agent-side to make sure they don't fail with 0.0.0.0/0. Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Wed, Jul 23, 2008 at 7:09 AM, Matthew Richardson <[EMAIL PROTECTED]> wrote: > > I'm currently experimenting with Ossec for use within our department. > > We have several methods of network access for our clients (agents) which are > spread across several subnets, none of which can be encompassed by a single > netmask, and where the client's ip address will change on conenction method > (wired, wireless, vpn etc). I would therefore like to use 0.0.0.0/0 as the IP > Address for all our clients, and ensure each one has a separate key and > ID/name. > > I have tried setting the IP Address both using manage_agents and directly > editing client.keys to 0.0.0.0/0, but this doesn't seem to work (manage_agents > explicitly refuses this as an ip address). I've tested setting this to a > netmask that is smaller in scope (e.g 192.168.0.0/16) and this works happily - > it seems that there is a specific restriction (deliberate or otherwise) > against > an 'unlimited' range. > > There's a post from this list from Aug 07 implying that 0.0.0.0/0 used to work > - http://www.ossec.net/ossec-list/2007-April/msg00105.html > > Can anyone let me know if either this is a bug that I should report > officially, > if there's a reason for this range not being allowed, or an alternative way > of > achieving what I'm aiming for? > > Thanks, > > Matthew > -- > The University of Edinburgh is a charitable body, registered in > Scotland, with registration number SC005336. >
