If we were to apply the rule method, how do we specify the <hostname> variable when we have several hosts with the same relative host name e.g. app01 but distinct FQDN's? For example, we want the host app01.applesauce.com to be whitelisted but not any other hosts whose relative host name is app01. And unfortunately for us, every one of these hosts's syslog has "app01" as the hostname.
On Oct 1, 1:00 pm, "dan (ddp)" <[email protected]> wrote: > On Fri, Oct 1, 2010 at 12:40 PM, blacklight <[email protected]> wrote: > > The scalability problem comes in two ways: > > > (1) While all our OSSEC agent hosts have unique FQDN's, the relative > > host name i.e. the name that appears in the agent host syslog for > > example, may not be unique. For example, app01.applesauce.com and > > app01.bananapeel.com have the same relative host name in their > > respective syslogs: app01 We might want app01.applesauce not to block > > the source IP host but we might want app01.bananapeel to do just that. > > So, if the correct syntax for <hostname> is <hostname>app01</ > > hostname>, we would be in trouble. I am not sure that using an IP > > address or an FQDN for <hostname> will work because I believe that the > > OSSEC server reads off the <hostname> directly from the log entry. > > > (2) Let's say that on a customer subnet, we have five hosts that we > > want to whitelist. We would have to derive a rule for each one of > > them. Right now, we are managing 150+ hosts - I could end up writing > > up quite a few rules :) > > > There are quite a few situations where we want whitelisting where the > > source or attack IP is a host whose behavior creates log messages on > > the target host that fall under a rule that triggers an active > > response, but where we know the source or attack IP is harmless. We > > definitely would want active response to be triggered to protect the > > target host if the source or attack IP were any other host. > > > I have done some research in the meantime: > > [ossec-list] Re: Can agents have their own white list which adds to > > the server white list? > >http://www.mail-archive.com/[email protected]/msg02761.html > > > The ossec-list discussion thread (year date 2007) just above seems to > > indicate that the rule method is more fine grained than the outright > > whitelist method, but Peter Abraham's objection to the rule method is > > the same as mine: we are monitoring lots of agents and we could be > > adding to the clutter with as many rules. > > Clutter in the rulesets is an organizational issue, not really technical. ;) > Using the rule_dir option could definitely make things a bit easier to > keep track of:http://www.ossec.net/doc/syntax/head_ossec_config.rules.html > > > > > Again, if agents could be whitelisted at the agent rather than at the > > server, the manual configuration work would be simpler. Is there a way > > to whitelist at the agent level? If not, is there another option aside > > from the rule method? The whitelist method at the server is too much > > of a blunt instrument for us.
