Dear Dan,
Ok I went into web_rules.xml and saw its says A web attack
returned code 200 (success) . So what could be the problem I am just
accessing data from my phpmyadmin what is the attack no description on this?
Regards,
Frwa.
On Tuesday, December 10, 2013 10:29:09 PM UTC+8, dan (ddpbsd) wrote:
>
> On Tue, Dec 10, 2013 at 9:25 AM, frwa onto <[email protected]<javascript:>>
> wrote:
> > Dear Dan,
> > Even if I am logged with other email is the same scenario
> I
> > get locked. Its more got to do with phpmyadmin. Could it be that I am
> doing
> > big select statement causing this behavior? Is it possible to pause the
> > active response for temporary ? How can I further investigate the cause?
> >
>
> Look at the alerts (rule ID 31106 specifically). They will provide
> more information about what is happening.
>
> > Regards,
> > Frwa.
> >
> > On Tuesday, December 10, 2013 10:11:49 PM UTC+8, dan (ddpbsd) wrote:
> >>
> >> On Tue, Dec 10, 2013 at 9:08 AM, frwa onto <[email protected]> wrote:
> >> > Dear Christian,
> >> > Thank you for sharing your experience too.
> >> > Hopefully
> >> > some one can exactly confirm what is the main cause of this behavior?
> I
> >> > am
> >> > not sure if I off the active response should help?
> >> >
> >>
> >> If the IP address being blocked in the active response log is your IP
> >> address, then that is what is causing you to lose your ssh connection.
> >>
> >> > Regards,
> >> > Frwa.
> >> >
> >> >
> >> > On Tuesday, December 10, 2013 1:29:53 PM UTC+8, Christian Beer wrote:
> >> >>
> >> >> I also had this problem some time ago. Make sure you either
> whitelist
> >> >> your IP (if it doesn't change) or disable ossec before using
> >> >> phpmyadmin.
> >> >> As it is now, some actions are detected by ossec as malicious
> >> >> SQLInjection attacks and thus trigger the rule 31106. The
> firewall-drop
> >> >> is triggered by the 31106 rule and thus you ssh freezes. I found
> (and
> >> >> didn't really investigate) no other way to whitelist the phpmyadmin
> >> >> installation.
> >> >>
> >> >> Regards
> >> >> Christian
> >> >>
> >> >> Am 10.12.2013 03:54, schrieb frwa onto:
> >> >> > Dear Dan,
> >> >> > This log is showing " 2013/12/08 01:48:43
> ossec-execd:
> >> >> > INFO:
> >> >> > Active response command not present:
> >> >> >> '/var/ossec/active-response/bin/restart-ossec.cmd'. Not using it
> on
> >> >> >> this
> >> >> >> system. " That active response is not present right so then why
> does
> >> >> >> is
> >> >> > deny the host. In fact that is my local ip where I am accessing
> the
> >> >> > server
> >> >> > locally not from eternal. I only do is that using phmyadmin to
> access
> >> >> > my
> >> >> > db
> >> >> > and I always get denied and my ssh is broken? Does ossec sniff it
> as
> >> >> > an
> >> >> > attack is it?
> >> >> >
> >> >> > Regards,
> >> >> > Frwa.
> >> >> >
> >> >> > On Sunday, December 8, 2013 3:24:39 PM UTC+8, frwa onto wrote:
> >> >> >>
> >> >> >> I have centos 6.5(Final) running. Lately I notice whenever I do
> >> >> >> anything
> >> >> >> in mysql after few minutes my ssh gets freeze. I dont know what
> is
> >> >> >> happening so looking to my /var/log/secure nothing is pointing
> there
> >> >> >> then I
> >> >> >> look into my ossec logs and I notice these lines.
> >> >> >>
> >> >> >> In my /var/ossec/log/ossec-log I see this
> >> >> >>
> >> >> >> 2013/12/07 20:50:27 ossec-syscheckd: INFO: Ending syscheck scan.
> >> >> >> 2013/12/08 01:48:43 ossec-execd: INFO: Active response command
> not
> >> >> >> present: '/var/ossec/active-response/bin/restart-ossec.cmd'. Not
> >> >> >> using
> >> >> >> it
> >> >> >> on this system.
> >> >> >> 2013/12/08 14:20:27 ossec-rootcheck: INFO: Starting rootcheck
> scan.
> >> >> >> 2013/12/08 14:31:27 ossec-rootcheck: INFO: Ending rootcheck scan.
> >> >> >>
> >> >> >> But in my /var/ossec/log/active-responses.log I see this
> >> >> >>
> >> >> >> Sun Dec 8 15:14:25 MYT 2013
> >> >> >> /var/ossec/active-response/bin/host-deny.sh
> >> >> >> delete - 10.212.134.200 1386486234.11964 31106
> >> >> >> Sun Dec 8 15:14:25 MYT 2013
> >> >> >> /var/ossec/active-response/bin/firewall-drop.sh delete -
> >> >> >> 10.212.134.200
> >> >> >> 1386486234.11964 31106
> >> >> >>
> >> >> >> What can I do about this?
> >> >> >>
> >> >> >
> >> >>
> >> > --
> >> >
> >> > ---
> >> > You received this message because you are subscribed to the Google
> >> > Groups
> >> > "ossec-list" group.
> >> > To unsubscribe from this group and stop receiving emails from it,
> send
> >> > an
> >> > email to [email protected].
> >> > For more options, visit https://groups.google.com/groups/opt_out.
> >
> > --
> >
> > ---
> > You received this message because you are subscribed to the Google
> Groups
> > "ossec-list" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> an
> > email to [email protected] <javascript:>.
> > For more options, visit https://groups.google.com/groups/opt_out.
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
