Okay, here's what happened last night.
There was a rule in the forward chain "ACCEPT all from all" and the default policy for the input chain was DROP. So I was able to reach the virtual Hosts on this machine, but couldnt connect to the host anyhow. The only way to fix the system was to connect via my KVM over IP. Again, this never happened before I used OSSEC, so I fear, it's caused by OSSEC in some strange way. The Logfiles are clean, there's nothing suspect inside but I havent had a look at the syslog yet. For Information what system we talking about: Two Servers, lets say SrvA and SrvB. Both are holding two DRBD Drives while normally SrvA is Holding "R0" and SrvB is holding "R1". They're talking via an internal Network, connected via eth1 to each other with heartbeat. Both running OpenVZ with about 4 virtual machines (containers) on each. If SrvA is invisible for SrvB for two minutes, SrvB has to assume SrvA is dead and has then to mount the R0 Partition and start all the virtual hosts on it and visa versa. On both servers I have installed OSSEC. While SrvB has a total Traffic (to the real world) of about 16 Gig a day, SrvA has about 13 Gig a day but no email Server on it. So OSSEC is really relaxed on SrvA but very busy at SrvB. So, the default setting DROP for the Input Chain has effect to all network-devices. This causes Heartbeat to take over all ressources from SrvA to SrvB and mount the DRBD-Partitions. SrvA is also not seeing SrvB anymore and does the same with it's ressources. We have a split-brain situation. I also have two other servers running in the same mode as SrvA and SrvB, also installed OSSEC and no problems so far. But these servers have much less stress as the first cluster has. Can it be, that there's a security leak in OSSEC? I finnally run a rkhunter and chkrootkit on my servers but couldn't find any thing suspect. I would like to use OSSEC but I am helpless at the moment. For the next three days I leave OSSEC stopped on SrvB to see, if any strange things appear again. Would be glad for any hint! Thanks, Oskar On 24 Aug., 22:47, WebWusel <[email protected]> wrote: > Hi again, > > it just happened again. But this time a got a ACCEPT from all to all > in the FORWARD Section and no access to the host anymore. The only way > to enter the host is my remote KVM. And now I have a Split-Brain on my > DRBD. So I'm a bit busy now. > > I think, I leave OSSEC switched of for the next three days and see, if > anything suspect will happen then. > > I let you know... > > Oskar > > On 24 Aug., 13:52, Andre Pawlowski <[email protected]> wrote: > > > > > Hi Oskar, > > > did it happen again? Did the log tell you something? > > > Andre Pawlowski > > > ------------------------------------------------------------------- > > > Poor is the pupil who does not surpass his master. > > -Leonardo da Vinci > > > On 08/22/2010 09:10 AM, WebWusel wrote: > > > > Tonight I got the same "anywhere to anywhere" rule but found my server > > > offline, this morning. DAMMED! A few hours offline! > > > > And there's again nothing suspect in the default logs. > > > > To figure out, what exactly happens I did some little changes into > > > firewall-drop.sh, this morning: > > > > First of all, I've added a ristriction to eth0. If I get a total block > > > on eth1, I'm in real trouble! ... more as I am already, when all the > > > VServers are down. > > > > Propably, the question for a specific device could be an Installation- > > > Option? > > > >> if [ "X${UNAME}" = "XLinux" ]; then > > >> if [ "x${ACTION}" = "xadd" ]; then > > >> ARG1="-I INPUT -i eth0 -s ${IP} -j DROP" > > >> ARG2="-I FORWARD -i eth0 -s ${IP} -j DROP" > > >> else > > >> ARG1="-D INPUT -i eth0 -s ${IP} -j DROP" > > >> ARG2="-D FORWARD -i eth0 -s ${IP} -j DROP" > > >> fi > > > > directly after this, I added my custom Log in this way: > > > > echo "`date`: ARG1: $ARG1, ARG2: $ARG2" >> /var/ossec/logs/ossec- > > > custlog.log > > > > within the executing and exiting section I added this two lines > > > directly after the executing lines: > > > >> echo "`date` $IPTABLES $ARG1" >> /var/ossec/logs/ossec-execlog.log > > > and > > >> echo "`date` $IPTABLES $ARG2" >> /var/ossec/logs/ossec-execlog.log > > > > I hope, I'll find the Problem in this way, > > > > Have a nice Sunday, > > > > Oskar- Zitierten Text ausblenden - > > - Zitierten Text anzeigen -
