Hi all, Could active response not work for servers based on FreeBSD using pf as a firewall? I have three FreeBSD hosts and it doesn't seems it is working:
root@itafbsd01:/usr/local/ossec-hids/bin# pfctl -sr No ALTQ support in kernel ALTQ related functions disabled block drop in log quick on ! lo0 inet from 127.0.0.0/8 to any block drop in log quick on ! em0 inet from 10.196.0.0/24 to any block drop in log quick inet from 10.196.0.104 to any block drop in log quick inet from 10.196.0.93 to any block drop in log quick on ! em1 inet from 172.17.22.0/29 to any block drop in log quick inet from 172.17.22.2 to any block drop in log quick on ! em2 inet from 172.17.23.0/29 to any block drop in log quick inet from 172.17.23.2 to any block drop in log quick on ! lo0 inet6 from ::1 to any block drop in log quick on em0 inet6 from fe80::250:56ff:fe38:c2bf to any block drop in log quick on em1 inet6 from fe80::250:56ff:fe22:be36 to any block drop in log quick on em2 inet6 from fe80::250:56ff:fe03:5d90 to any block drop in log all block drop in log quick from <ossec_fwtable> to any block drop out log quick from any to <ossec_fwtable> root@itafbsd01:/usr/local/ossec-hids/bin# cat /usr/local/ossec-hids/logs/active-responses.log Mon Apr 8 12:16:28 UTC 2013 /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 10.196.0.15 1365423388.106418930 100307 Mon Apr 8 12:33:22 UTC 2013 /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 192.168.65.16 1365424402.107310243 100310 Mon Apr 8 12:56:32 UTC 2013 /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 81.84.99.182 1365425792.109009489 100306 Mon Apr 8 12:59:06 UTC 2013 /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 84.253.190.122 1365425946.109167068 100306 Mon Apr 8 13:11:25 UTC 2013 /usr/local/ossec-hids/active-response/bin/firewall-drop.sh add - 212.163.33.165 1365426685.109822795 100306 ... but: root@itafbsd01:/usr/local/ossec-hids/bin# pfctl -t ossec_fwtable -T show No ALTQ support in kernel ALTQ related functions disabled root@itafbsd01:/usr/local/ossec-hids/bin Ossec server and these FreeBSD agents use 2.7 release ... -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
