Hi again, it just happened again. But this time a got a ACCEPT from all to all in the FORWARD Section and no access to the host anymore. The only way to enter the host is my remote KVM. And now I have a Split-Brain on my DRBD. So I'm a bit busy now.
I think, I leave OSSEC switched of for the next three days and see, if anything suspect will happen then. I let you know... Oskar On 24 Aug., 13:52, Andre Pawlowski <[email protected]> wrote: > Hi Oskar, > > did it happen again? Did the log tell you something? > > Andre Pawlowski > > ------------------------------------------------------------------- > > Poor is the pupil who does not surpass his master. > -Leonardo da Vinci > > On 08/22/2010 09:10 AM, WebWusel wrote: > > > Tonight I got the same "anywhere to anywhere" rule but found my server > > offline, this morning. DAMMED! A few hours offline! > > > And there's again nothing suspect in the default logs. > > > To figure out, what exactly happens I did some little changes into > > firewall-drop.sh, this morning: > > > First of all, I've added a ristriction to eth0. If I get a total block > > on eth1, I'm in real trouble! ... more as I am already, when all the > > VServers are down. > > > Propably, the question for a specific device could be an Installation- > > Option? > > >> if [ "X${UNAME}" = "XLinux" ]; then > >> if [ "x${ACTION}" = "xadd" ]; then > >> ARG1="-I INPUT -i eth0 -s ${IP} -j DROP" > >> ARG2="-I FORWARD -i eth0 -s ${IP} -j DROP" > >> else > >> ARG1="-D INPUT -i eth0 -s ${IP} -j DROP" > >> ARG2="-D FORWARD -i eth0 -s ${IP} -j DROP" > >> fi > > > directly after this, I added my custom Log in this way: > > > echo "`date`: ARG1: $ARG1, ARG2: $ARG2" >> /var/ossec/logs/ossec- > > custlog.log > > > within the executing and exiting section I added this two lines > > directly after the executing lines: > > >> echo "`date` $IPTABLES $ARG1" >> /var/ossec/logs/ossec-execlog.log > > and > >> echo "`date` $IPTABLES $ARG2" >> /var/ossec/logs/ossec-execlog.log > > > I hope, I'll find the Problem in this way, > > > Have a nice Sunday, > > > Oskar
