Hi all,
I'm testing an Active Response script but keep getting this in the
ossec.log:
2009/12/07 10:45:08 ossec-execd(1312): ERROR: Error executing '/var/
ossec/active-response/bin/bad-ip.sh': Exec format error
The script that I'm just trying to get working is this:
echo `date` >> /home/jlee/badip.log
Eventually I want to append the IP but all I'm doing here [as a test
to see if things are even working] is appending the current date to
badip.log whenever rule 5720 is triggered. Is there something else
that *always* needs to be in these .sh scripts? If I run this script
on it's own it seems to work just fine.
In the ossec.conf I have the following;
<command>
<name>bad-ip</name>
<executable>bad-ip.sh</executable>
<expect>user, srcip</expect>
<timeout_allowed>no</timeout_allowed>
</command>
<active-response>
<disabled>no</disabled>
<command>bad-ip</command>
<location>local</location>
<rules_id>5720</rules_id>
<rules_group>authentication_failures</rules_group>
</active-response>
Thanks
