On Sun, Oct 10, 2010 at 9:48 AM, tux3132 <[email protected]> wrote: > I > > I have installed OSSEC 2.5 on Debian Lenny and all is working fine. > > I have created a command : > > <command> > <name>firewall_drop</name> > <executable>firewall-drop.sh</executable> > <expect>srcip</expect> > <timeout_allowed>yes</timeout_allowed> > </command> > > and two active-response, one for each agents 007 (its name is > James ...lol) and 008. All parameters are identical but <agent_id>...</ > agent_id> > agent 007 > <active-response> > <command>firewall_drop</command> > <location>defined-agent</location> > <agent_id>007</agent_id> > > <rules_id>3301,3302,3303,3304,3305,3306,3351,3352,3353,3354,3355,3356,3357,</ > rules_id> > <timeout>3610</timeout> > </active-response> > agent 008 > <active-response> > <command>firewall_drop</command> > <location>defined-agent</location> > <agent_id>008</agent_id> > > <rules_id>3301,3302,3303,3304,3305,3306,3351,3352,3353,3354,3355,3356,3357,</ > rules_id> > <timeout>3610</timeout> > </active-response> > > When, for example, the rule 3306 is fired up by the agent 007 the > script firewall-drop.sh is ran on its host and is also ran on the > other host where agent 008 reside. > > Obviously in this case of spam it is not really a problem because an > active spammer is blacklisted even on a machine where it is not > active ... But for some other kinds of responses it may become a > problem. > > Have-I understood the OSSEC principle and/or syntax ? > Have-you encountered this problem and how do you solve it ? > > Thank you for your help. > > Best regards. >
It's doing what you asked. You told it that if rule (example) 3301 fires run it on 0007. Then run the script on 008. It sounds like that is what is happening. If you want only 007 to run the script when the event happens on 007 use <location>local</location>. See http://www.ossec.net/doc/manual/ar/ar-unix.html for more information. Otherwise, if you're worried, you'll have to be careful which rules you add into these configurations.
