Hi Aaron, Yes, you need to white list your domains too. OSSEC doesn't do a reverse lookup, but uses whatever the log provides. So, if in the log itself there is a hostname, it will try to block using it.
To ignore the whole gmail.com domain you need to use: <white_list>.gmail.com$</white_list> To ignore a specific domain: <white_list>^www.gmail.com$</white_list> I don't think there is any security issues, but I always try to disable reverse lookup on the applications itself (it needs to be done on a per application base). Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Mon, Apr 20, 2009 at 9:38 PM, Aaron Bliss <[email protected]> wrote: > > Hi all I have a few questions on white listing and active response; > Even though I've white listed our network (using CIDR format, on our > server, not the agents) I noticed that some hosts on our network were > getting blacklisted. Today I was able to catch one while the black > listing happened and the iptables rules (on a linux host) showed the > block was by hostname instead of IP address. The active response > logfile showed the same (I'm assuming that ossec is doing a reverse > lookup on the offending IP address to get a hostname). So I have a > few questions. > 1. Is it therefore appropriate to also white list our domain name as well? > 2. If so, if our dns namespace was gmail.com, would the white list > rule look like this (assume our hosts are named hostname.dnsname) and > have corresponding forward and reverse dns entries: > <white_list>^gmail.com$</white_list> > > 3. Are there any security issues with adding this, other than any > hosts with a hostname of *.gmail.com would not be black listed? > Thanks for your help. > > Aaron >
