Hello, I have no socket programming experience, but I have been doing some digging:
1. ../src/config/client-config allows for an element within the <client> element in the agent ossec.conf called local_ip. I have tried adding local_ip to the ossec.conf file but the agent doesn't bind to that address. What is the purpose of local_ip? 2. ../src/remoted/remoted.c calls OS_Bindportudp using the local_ip address found in the <remote> element in the server ossec.conf. OK, is there something similar in client-agent? 3. ../src/client-agent/start_agent.c doesn't call OS_Bindportudp but does call OS_ConnectUDP. There doesn't appear to be any binding to an IP address. So, is the only way to force the agent to talk over a specific interface to add a route in the agent's routing table that specifies the hostname of the OSSEC server and the interface to use? I've tried it and it seems to work. Trevor On Jun 8, 2:29 pm, tm <[email protected]> wrote: > Hello, > > I was wondering if one of the developers might address this issue. > > It appears that the OSSEC agent always binds itself to the highest > numbered interface. At present we have been able to work around this > at the OS/Networking configuration level on the client (e.g. by > disabling /etc/sysconfig/network-scripts/ifcfg-ethx) or on the server > by adjusting the IP address of the client in /etc/client.keys. > However, sooner or later, we will run into a situation with multiple > interfaces where we need to force the OSSEC agent to bind to a > particular interface without disabling interfaces or forcing the OSSEC > server to use the interface that the agent happens to bind to. > > Are there any plans to add say an "agentd" section to the agent's > ossec.conf so that you can specify the interface to bind to? > > Thanks, > Trevor > > On Jun 2, 9:34 pm, tm <[email protected]> wrote: > > > > > Hello, > > > There are items in the list about forcing the OSSEC server to use a > > particular network interface by specifying it in the <remoted> section > > of the ossec.conf. > > > However, I can find nothing about the same on an OSSEC agent. > > > I have a host running the OSSEC agent with two network interfaces. > > The agent seems to be communicating over the second interface rather > > than the first. How do you force the agent to use the first > > interface? > > > In the meantime, I have configured the client.keys file on the server > > to use the network address of the second interface on the agent. > > > Trevor- Hide quoted text - > > - Show quoted text -
