Daniel, The new agent snapshot fixed it for me. Thanks again!
Wes On Fri, Sep 5, 2008 at 10:11 AM, Daniel Cid <[EMAIL PROTECTED]> wrote: > > Hi all, > > I think I figured out what was going on. Depending on the argument (if > it had spaces), > the command to block would not be called properly. I am pretty sure it is > fixed > on the following snapshot: > > http://www.ossec.net/files/snapshots/ossec-win32-080904.exe > > Can you try with this version? You don't need to update the server, > just the agent side. > > *I will release a v1.6.1 soon with the fixes for some of the reported > bugs so far. > > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > > On Thu, Sep 4, 2008 at 12:15 PM, Michel van Dop <[EMAIL PROTECTED]> wrote: >> >> Hello, >> >> I try again, to make sure. >> I have see a problem on C:\Program Files\ossec-agent\shared\ar.conf >> I add a line win_nullroute600 after restart he change the file and is >> remove the last rule. win_nullroute600 - route-null.cmd - 600 >> >> I do a upgrade from ossec agent 1.5.1 on windows 2k3 sp2 to ossec 1.6. >> >> I also make a uninstall of ossec agent 1.6 and try again, same problem. >> >> Can any one give a good full example of ossec.conf for windows agent and >> active response? >> >> This is my begin: >> <ossec_config> >> >> <active-response> >> <disabled>no</disabled> >> </active-response> >> >> <command> >> <name>win_nullroute</name> >> <executable>route-null.cmd</executable> >> <expect>srcip</expect> >> <timeout_allowed>yes</timeout_allowed> >> </command> >> >> <active-response> >> <command>win_nullroute</command> >> <location>local</location> >> <level>10</level> >> <timeout>600</timeout> >> </active-response> >> >> Thanks, >> Michel >> >>> >>> Forgot one thing: I also verified that I have the ar.conf file, and >>> it contains a line with win_nullroute600 as you mentioned. >>> >>> On Wed, Sep 3, 2008 at 7:33 PM, Wes <[EMAIL PROTECTED]> wrote: >>>> Daniel, >>>> >>>> I'm running the management server on Ubuntu 8.04, and the agent on >>>> Win2K3 SP2. 1.6 release of OSSEC installed on both agent and server. >>>> >>>> When I run the test with agent_control, everything works as expected. >>>> >>>> I'm trying to get the response to block any IP that causes a level 10 >>>> (or higher) alert. To test, I put an empty file called "union+1.html" >>>> on my web server. When I access the file via a browser on another >>>> machine, it triggers a false positive on rule 31106. I receive an >>>> e-mail alert and the event is written to the OSSEC log, as follows (IP >>>> addresses and server names have been removed): >>>> >>>> ** Alert 1220482999.7011126: mail - web,accesslog,attack, >>>> 2008 Sep 03 19:03:19 ([agent name]) [agent IP >>>> address]->\WINDOWS\System32\LogFiles\W3SVC1\ex080903.log >>>> Rule: 31106 (level 12) -> 'A web attack returned code 200 (success).' >>>> Src IP: [source IP address] >>>> User: (none) >>>> 2008-09-03 23:00:53 W3SVC1 [agent] [agent IP] GET /union+1.html - 80 - >>>> [source IP] HTTP/1.1 >>>> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1) - - [agent >>>> URL] 200 0 0 250 443 156 >>>> >>>> Though I removed the source IP address above, it shows up fine in the >>>> log. >>>> >>>> I'm not attempting the test immediately after restarting the server. >>>> >>>> The IP I'm testing from is not whitelisted. >>>> >>>> I have the following in ossec.log on the agent, from the last time I >>>> restarted it: >>>> >>>> 2008/09/02 11:52:42 ossec-agent: INFO: Started (pid: 336). >>>> >>>> I also see the other entries you%2 >> >> >
