On Mon, Dec 9, 2013 at 9:54 PM, frwa onto <[email protected]> wrote: > Dear Dan, > This log is showing " 2013/12/08 01:48:43 ossec-execd: INFO: > Active response command not present: > >> '/var/ossec/active-response/bin/restart-ossec.cmd'. Not using it on this
That is a Windows command, it should not be present on a linux system. >> system. " That active response is not present right so then why does is >> deny the host. In fact that is my local ip where I am accessing the server The hosts deny script is different than the restart-ossec.cmd command. >> locally not from eternal. I only do is that using phmyadmin to access my db >> and I always get denied and my ssh is broken? Does ossec sniff it as an >> attack is it? > It looks like you are triggering rule 31106, and that is causing you to be blocked. Find out why you are triggering this rule, and correct that situation. > Regards, > Frwa. > > On Sunday, December 8, 2013 3:24:39 PM UTC+8, frwa onto wrote: >> >> I have centos 6.5(Final) running. Lately I notice whenever I do anything >> in mysql after few minutes my ssh gets freeze. I dont know what is happening >> so looking to my /var/log/secure nothing is pointing there then I look into >> my ossec logs and I notice these lines. >> >> In my /var/ossec/log/ossec-log I see this >> >> 2013/12/07 20:50:27 ossec-syscheckd: INFO: Ending syscheck scan. >> 2013/12/08 01:48:43 ossec-execd: INFO: Active response command not >> present: '/var/ossec/active-response/bin/restart-ossec.cmd'. Not using it on >> this system. >> 2013/12/08 14:20:27 ossec-rootcheck: INFO: Starting rootcheck scan. >> 2013/12/08 14:31:27 ossec-rootcheck: INFO: Ending rootcheck scan. >> >> But in my /var/ossec/log/active-responses.log I see this >> >> Sun Dec 8 15:14:25 MYT 2013 /var/ossec/active-response/bin/host-deny.sh >> delete - 10.212.134.200 1386486234.11964 31106 >> Sun Dec 8 15:14:25 MYT 2013 >> /var/ossec/active-response/bin/firewall-drop.sh delete - 10.212.134.200 >> 1386486234.11964 31106 >> >> What can I do about this? > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
