On Thu, 23 Apr 2009 11:20:55 +0200, [email protected] wrote: > Hello > > we intend to to install OSSEC server in secure subnet and/but some Windows > clients in the DMZ should be monitored. > Our security policy is, that no host in the DMZ can establish a connection > to the > secure subnet behind the firewall... > > As much I do know OSSEC Windows client does push its monitoring > informations(initiate the connection) to the OSSEC server. > > Is there a way to change this behaviour in order that the OSSEC sever does > "request" the required informations from the clients to be monitored?
Hello John, To the best of my knowledge, this isn't natively possible. I know where you're coming from though, because I used to do this with Enterasys Dragon Hids. I used to do something else that was similar for tunneling logs. We would establish an outbound Zebedee tunnel and then the client would log to the localhost tunnel, where it would then be sent to the server. I don't know if this would work with OSSEC. Off the top of my head, I don't see why not. This may also be possible with later versions of SSH--I hear it can tunnel UDP now. Another option, of course, is to make an informed, risk-based exception to your security policy. OSSEC is designed to be secure software, so if you examine the protections it has in place you may be comfortable with making an exception to the policy. Good luck.
