On Thu, Jan 23, 2014 at 8:10 PM, Jeremiah Brock <[email protected]> wrote: > Hi All, > > Just a follow up, I was able to get around this strange issue by doing > the following : >
Was this a new install? > On the Server : > chown root:ossec ar.conf > service ossec restart > > On the Agent : > service ossec restart > > The Agent /var/ossec/etc/shared now magically downloaded the proper ar.conf > file : > root@host1:/var/ossec/etc/shared# ls -l > total 168 > -rw-r--r-- 1 ossec ossec 153 Jan 23 16:41 ar.conf > -rwxrwx--- 1 root ossec 9501 Jan 23 16:41 cis_debian_linux_rcl.txt > -rwxrwx--- 1 root ossec 8192 Jan 23 16:41 cis_rhel5_linux_rcl.txt > -rwxrwx--- 1 root ossec 14251 Jan 23 16:41 cis_rhel_linux_rcl.txt > -rw-r--r-- 1 ossec ossec 70352 Jan 23 16:41 merged.mg > -rwxrwx--- 1 root ossec 14872 Jan 23 16:41 rootkit_files.txt > -rwxrwx--- 1 root ossec 5193 Jan 23 16:41 rootkit_trojans.txt > -rwxrwx--- 1 root ossec 4457 Jan 23 16:41 system_audit_rcl.txt > -rwxrwx--- 1 root ossec 4682 Jan 23 16:41 win_applications_rcl.txt > -rwxrwx--- 1 root ossec 3859 Jan 23 16:41 win_audit_rcl.txt > -rwxrwx--- 1 root ossec 4929 Jan 23 16:41 win_malware_rcl.txt > > > No more errors in my logs!! > > ~Jeremy > > > > On 1/23/2014 4:32 PM, Jeremiah Brock wrote: > > Hi All, > > I am running ossec 2.7 on Ubuntu and have run into some surprising > issues with the Active Response. > > Server : Linux mercury 2.6.32-33-server #72-Ubuntu SMP Fri Jul 29 > 21:21:55 UTC 2011 x86_64 GNU/Linux > > Client : Linux host1 3.2.0-56-virtual #86-Ubuntu SMP Wed Oct 23 18:12:10 > UTC 2013 i686 athlon i386 GNU/Linux > > Server available active responses : > /var/ossec/bin/agent_control -L > > OSSEC HIDS agent_control. Available active responses: > > No active response available. > > > Server ossec.log errors : > 2014/01/23 14:58:50 ossec-remoted: Error accessing file > '/etc/shared/ar.conf' > > Agent ossec.log errors : > 2014/01/23 14:30:13 ossec-execd(1103): ERROR: Unable to open file > '/var/ossec/etc/shared/ar.conf'. > 2014/01/23 14:30:13 ossec-execd(1311): ERROR: Invalid command name > 'firewall-drop600' provided. > > Server ossec.conf : > <command> > <name>host-deny</name> > <executable>host-deny.sh</executable> > <expect>srcip</expect> > <timeout_allowed>yes</timeout_allowed> > </command> > > <command> > <name>firewall-drop</name> > <executable>firewall-drop.sh</executable> > <expect>srcip</expect> > <timeout_allowed>yes</timeout_allowed> > </command> > > <active-response> > <command>host-deny</command> > <location>local</location> > <level>6</level> > <timeout>600</timeout> > </active-response> > > <active-response> > <command>firewall-drop</command> > <location>local</location> > <level>6</level> > <timeout>600</timeout> > </active-response> > > > Server etc/shared directory : > root@mercury:/var/ossec/etc/shared# ls -l > total 168 > -r--r----- 1 root root 153 Jan 23 14:58 ar.conf > -r--r----- 1 root ossec 9501 Nov 8 2012 cis_debian_linux_rcl.txt > -r--r----- 1 root ossec 8192 Nov 8 2012 cis_rhel5_linux_rcl.txt > -r--r----- 1 root ossec 14251 Nov 8 2012 cis_rhel_linux_rcl.txt > -rw-r--r-- 1 ossecr ossec 70186 Jan 23 14:58 merged.mg > -r--r----- 1 root ossec 14872 Nov 8 2012 rootkit_files.txt > -r--r----- 1 root ossec 5193 Nov 8 2012 rootkit_trojans.txt > -r--r----- 1 root ossec 4457 Nov 8 2012 system_audit_rcl.txt > -r--r----- 1 root ossec 4682 Nov 8 2012 win_applications_rcl.txt > -r--r----- 1 root ossec 3859 Nov 8 2012 win_audit_rcl.txt > -r--r----- 1 root ossec 4929 Nov 8 2012 win_malware_rcl.txt > > > Client etc/shared directory : > root@host1:/var/ossec/etc/shared# ls -l > total 88 > -rwxrwx--- 1 root ossec 9501 Jan 1 15:21 cis_debian_linux_rcl.txt > -rwxrwx--- 1 root ossec 8192 Jan 1 15:21 cis_rhel5_linux_rcl.txt > -rwxrwx--- 1 root ossec 14251 Jan 1 15:21 cis_rhel_linux_rcl.txt > -rwxrwx--- 1 root ossec 14872 Jan 1 15:21 rootkit_files.txt > -rwxrwx--- 1 root ossec 5193 Jan 1 15:21 rootkit_trojans.txt > -rwxrwx--- 1 root ossec 4457 Jan 1 15:21 system_audit_rcl.txt > -rwxrwx--- 1 root ossec 4682 Jan 1 15:21 win_applications_rcl.txt > -rwxrwx--- 1 root ossec 3859 Jan 1 15:21 win_audit_rcl.txt > -rwxrwx--- 1 root ossec 4929 Jan 1 15:21 win_malware_rcl.txt > > > Does Active Response not work out of the box? > > ~Jeremy > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
