Daniel, I'm running the management server on Ubuntu 8.04, and the agent on Win2K3 SP2. 1.6 release of OSSEC installed on both agent and server.
When I run the test with agent_control, everything works as expected. I'm trying to get the response to block any IP that causes a level 10 (or higher) alert. To test, I put an empty file called "union+1.html" on my web server. When I access the file via a browser on another machine, it triggers a false positive on rule 31106. I receive an e-mail alert and the event is written to the OSSEC log, as follows (IP addresses and server names have been removed): ** Alert 1220482999.7011126: mail - web,accesslog,attack, 2008 Sep 03 19:03:19 ([agent name]) [agent IP address]->\WINDOWS\System32\LogFiles\W3SVC1\ex080903.log Rule: 31106 (level 12) -> 'A web attack returned code 200 (success).' Src IP: [source IP address] User: (none) 2008-09-03 23:00:53 W3SVC1 [agent] [agent IP] GET /union+1.html - 80 - [source IP] HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1) - - [agent URL] 200 0 0 250 443 156 Though I removed the source IP address above, it shows up fine in the log. I'm not attempting the test immediately after restarting the server. The IP I'm testing from is not whitelisted. I have the following in ossec.log on the agent, from the last time I restarted it: 2008/09/02 11:52:42 ossec-agent: INFO: Started (pid: 336). I also see the other entries you mentioned about host-deny.sh and firewall-drop.sh not being present. I have verified that c:\program files\ossec-agent\active-response\bin\route-null.cmd exists. I also see that I have entries in active-responses.log for every time that I tested the response using agent_control. Any other ideas? Thanks for the help!!! Wes On Wed, Sep 3, 2008 at 2:10 PM, Daniel Cid <[EMAIL PROTECTED]> wrote: > > Hey, > > Can you guys give more information about your setup? I have it running > well in here, and tested > on XP and 2003. > > -Does it work when you run with the agent_control tool? > -Which alerts were you expecting the response to run? Note that it > will only run if the source ip was > decoded properly. Can you show the alert pasted from > /var/ossec/logs/alerts/alerts.log ? > -Did you just tried it after restarting the server? Note that when you > restart the server, it loses the connection > to the agent, so the responses will only be called again on the next > keep alive (which can take a few > minutes). It may also take a few more minutes, for the ar.conf to be > shared with the agent (see bellow). > -Is the ip your are testing white_listed? > > -What do you see in your ossec.log (agent-side?). > > Make sure that you have: (meaning active response started) > 2008/08/31 16:31:18 ossec-execd: INFO: Started (pid: 3448). > > And you will probably see messages like this when the first response is > called: > 2008/09/01 00:02:14 ossec-agent: INFO: Active response command not > present: 'active-response/bin/host-deny.sh'. Not using it on this > system. > 2008/09/01 00:02:14 ossec-agent: INFO: Active response command not > present: 'active-response/bin/firewall-drop.sh'. Not using it on this > system. > > > If you see the following, it is because you didn't enable it properly. > 2008/08/13 14:17:49 ossec-execd(1350): INFO: Active response disabled. > Exiting. > > > -What do you have at C:\Program Files\ossec-agent\active-response ? > You should have a "bin" directory > with the route-null command and a active-responses.log file. > > These are some of the entries I have the responses log file: > 08/29/2008 03:45 "active-response/bin/route-null.cmd" add - > xx.168.2.99 1220035222.362251 31106 (winhome2) 192.168.2.0- > 08/29/2008 03:59 "active-response/bin/route-null.cmd" delete - > xx.168.2.99 1220035222.362251 31106 (winhome2) 192.168.2.0- > 08/29/2008 05:31 "active-response/bin/route-null.cmd" add - x.6.7.4 > (from_the_server) (no_rule_id) > 08/29/2008 05:31 "active-response/bin/route-null.cmd" add - x.6.7.5 > (from_the_server) (no_rule_id) > > *Note that the first one is a real live response, while the other is > just a test from the agent_control tool. > > > -Inside C:\Program Files\ossec-agent\shared you should have an ar.conf > file, with the following entry > at least: > win_nullroute600 - route-null.cmd - 600 > > This file can take a few minutes to be populated from the server, so > that might be a reason why it is not > working. > > > Thanks. > > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > On Wed, Sep 3, 2008 at 1:28 PM, Michel van Dop <[EMAIL PROTECTED]> wrote: >> >> I'm having the same issue with the 1.6 release for windows (2003 server). >> >> Regards, >> >> Michel >> >> ----- Original Message ----- >> From: "Wes" <[EMAIL PROTECTED]> >> To: <[email protected]> >> Sent: Wednesday, September 03, 2008 2:27 AM >> Subject: [ossec-list] Re: Windows active response not working >> >> >>> >>> Unfortunately, no -- even after upgrading to the official 1.6 release, >>> I still can't get active response to work on the Windows side. >>> >>> >>> On Tue, Sep 2, 2008 at 4:52 PM, Will Metcalf <[EMAIL PROTECTED]> >>> wrote: >>>> >>>> I'm having the same issue with the 1.6 release... Did you ever get >>>> this figured out? >>>> >>>> Regards, >>>> >>>> Will >>>> >>>> On 8/29/08, Wes <[EMAIL PROTECTED]> wrote: >>>>> >>>>> I was happy to learn that active response is now available for >>>>> Windows, but as of yet I've had no luck getting it working. Here's >>>>> what I've done so far: >>>>> >>>>> - Installed 8/28 server snapshot and 8/28 Windows agent snapshot >>>>> >>>>> - Added the following to ossec.conf on the agent side: >>>>> >>>>> <active-response> >>>>> <disabled>no</disabled> >>>>> </active-response> >>>>> >>>>> - Added the following to ossec.conf on the server side (the goal being >>>>> to trigger the active response when any rule level 10 or higher fires, >>>>> and block the source IP for 10 minutes): >>>>> >>>>> <command> >>>>> <name>win_nullroute</name> >>>>> <executable>route-null.cmd</executable> >>>>> <expect>srcip</expect> >>>>> <timeout_allowed>yes</timeout_allowed> >>>>> </command> >>>>> >>>>> <active-response> >>>>> <command>win_nullroute</command> >>>>> <location>local</location> >>>>> <level>10</level> >>>>> <timeout>600</timeout> >>>>> </active-response> >>>>> >>>>> - Restarted both the server and the agent >>>>> >>>>> - Checked ossec.log (on the agent) to verify that active response is >>>>> working: >>>>> >>>>> 2008/08/29 13:35:29 ossec-execd: INFO: Started (pid: 2772). >>>>> >>>>> - Tested the active response with: >>>>> >>>>> # /var/ossec/bin/agent_control -b 2.3.4.5 -f win_nullroute600 -u 011 >>>>> >>>>> After running the test, the IP 2.3.4.5 shows up when running a 'route >>>>> print' on the agent machine. Up until this point, everything appears >>>>> to be working fine. >>>>> >>>>> However, when I send a request to the server that fires a level 12 >>>>> false positive (specifically, rule 31106), the alert is logged and I >>>>> get the e-mail notification as per usual, but the active response is >>>>> not triggered. The IP that I'm sending the test request from does not >>>>> get temporarily blocked, nor does anything show up when running a >>>>> 'route print'. I've verified that this IP is not whitelisted in >>>>> ossec.conf. >>>>> >>>>> Any ideas what I might be doing wrong? Thanks! >>>>> >>>> >>> >> >> >
