Hi Alessandro, On Wed, Jan 26, 2011 at 11:22 AM, Alessandro Di Giuseppe <[email protected]> wrote: > Hi all, > Has anyone implemented any kind of custom check where OSSEC validates > whether a host has outbound connectivity to a specific IP or to the > Internet? > This would be useful to us, as we have some hosts which should *not* have > Internet access, and we would like to have OSSEC check for this so we can > validate for policy compliance. > I'm not sure how to do this, but was thinking that it might be possible > leveraging OSSEC's Active Response functionality to run a script testing web > access, e.g. wget to google.com. > Thanks, > Alessandro >
Not quite the same, but I had a host (unix) whose wireless network card would stop working randomly, requiring me to ifconfig down/ifconfig up it. I wrote a script that would try to ping the gateway, and on failure down the card, then bring it back up. If it had to down the card it would then create a log message (via logger) about it and a rule would fire when the log message arrived at the server. This was only 1 host though, so it wasn't too difficult to pull off. For a bunch of hosts, you might want to look at the full_command option pointed out by Shawn Jefferson.
