Hello, I was wondering if one of the developers might address this issue.
It appears that the OSSEC agent always binds itself to the highest numbered interface. At present we have been able to work around this at the OS/Networking configuration level on the client (e.g. by disabling /etc/sysconfig/network-scripts/ifcfg-ethx) or on the server by adjusting the IP address of the client in /etc/client.keys. However, sooner or later, we will run into a situation with multiple interfaces where we need to force the OSSEC agent to bind to a particular interface without disabling interfaces or forcing the OSSEC server to use the interface that the agent happens to bind to. Are there any plans to add say an "agentd" section to the agent's ossec.conf so that you can specify the interface to bind to? Thanks, Trevor On Jun 2, 9:34 pm, tm <[email protected]> wrote: > Hello, > > There are items in the list about forcing the OSSEC server to use a > particular network interface by specifying it in the <remoted> section > of the ossec.conf. > > However, I can find nothing about the same on an OSSEC agent. > > I have a host running the OSSEC agent with two network interfaces. > The agent seems to be communicating over the second interface rather > than the first. How do you force the agent to use the first > interface? > > In the meantime, I have configured the client.keys file on the server > to use the network address of the second interface on the agent. > > Trevor
