Hi,
This log is already supported by default on OSSEC. Plus, if you
enabled active response the attacker
IP would be blocked by default too (since this alert is treated as an
IDS event).
This is the output of log-test:
# /var/ossec/bin/ossec-logtest
Dec 13 23:07:24 web2 suhosin[18198]: ALERT - script tried to increase
memory_limit to 134217728 bytes which is above the allowed value
(attacker '1.2.3.4', file '/lala', line 65)
**Phase 1: Completed pre-decoding.
full event: 'Dec 13 23:07:24 web2 suhosin[18198]: ALERT -
script tried to increase memory_limit to 134217728 bytes which is
above the allowed value (attacker '1.2.3.4', file '/lala', line 65)'
hostname: 'web2'
program_name: 'suhosin'
log: 'ALERT - script tried to increase memory_limit to
134217728 bytes which is above the allowed value (attacker '1.2.3.4',
file '/lala', line 65)'
**Phase 2: Completed decoding.
decoder: 'suhosin'
id: 'script tried to increase memory_limit to 134217728 bytes
which is above the allowed value'
srcip: '1.2.3.4'
**Phase 3: Completed filtering (rules).
Rule id: '20100'
Level: '8'
Description: 'First time this IDS alert is generated.'
**Alert to be generated.
Thanks,
--
Daniel B. Cid
dcid ( at ) ossec.net
On Mon, Dec 14, 2009 at 2:53 PM, oscar schneider <[email protected]> wrote:
> 1. Check if the alert level is high enough to trigger active response ->
> check rule alert level and compare /var/ossec/etc/ossec.conf for the minimum
> alert level to trigger an active response (i think default is level="7" or
> "6")
> If the level of the rule is too low, you have 3 options.
> a) make a trigger for an AR for the specific rule in your ossec.conf:
> <active-response>
> <!-- Firewall Drop response. Block the IP for
> - 600 seconds on the firewall (iptables,
> - ipfilter, etc).
> -->
> <command>firewall-drop</command>
> <location>local</location>
> <rules_id>{Rule id without quotation marks}</rules_id>
> <timeout>600</timeout>
> </active-response>
> b) set the alert level of the rule higher (not recommended) to fit the
> minimum alert level for AR, e.g. level="9"
> c) copy the rule from the default rule file in /var/ossec/rules/ to your
> /var/ossec/rules/local_rules.xml, add an overwrite="yes" and increase the
> alert level there (e.g. level="9") in the <rule.. > section:
> <rule id={the rule id WITH quotes} level="9" overwrite="yes"> as first line
> of your rule definition
>
> Then restart ossec.
>
> 2. Run the part of the logfile through /var/ossec/bin/ossec-logtest, check
> if there is a srcip decoded. If there isn't you need to write a decoder,
> i.e. adding a section in /var/ossec/etc/decoders.xml that matches your log
> format, see http://www.madirish.net/?article=434 and have a look at
> http://www.ossec.net/wiki/Know_How:Regex_Readme as well as
> http://www.ossec.net/wiki/Decoder_rules_relation
>
> Test the decoder by running your logs through ossec-logtest.
> As soon as you got your decoder decoding the srcip right: Restart ossec.
>
> Of course active response has to be enabled on your install.
>
> Kind regards,
>
> oscar
>
>
>
> On Mon, Dec 14, 2009 at 6:08 PM, Peter M. Abraham
> <[email protected]> wrote:
>>
>> Greetings:
>>
>> Given the following alert...
>>
>> Dec 13 23:07:24 web2 suhosin[18198]: ALERT - script tried to increase
>> memory_limit to 134217728 bytes which is above the allowed value
>> (attacker '[IP ADDRESS OF ALLEGED ATTACKER]', file '[full path to file
>> goes here]', line 65)
>>
>>
>> ... if this rule was tied to an active response "as is" would ossec
>> know to block the [IP ADDRESS OF ALLEGED ATTACKER]?
>>
>> If not, what modifications would I have to make?
>>
>> Thank you.
>
>
