Hello Dan,
Yes, fresh install of 2.7 server mode.I confirmed this again this am on another ubuntu 12.04 system doing the following :
su root cd /root/installs wget http://www.ossec.net/files/ossec-hids-2.7.tar.gz tar -zxvf ossec-hids-2.7.tar.gz cd ossec-hids-2.7 ./install.shIn the prompts I enabled Active Response resulting with the following ar.conf root:root ownership which is wrong :
~Jeremy On 1/24/2014 4:59 AM, dan (ddp) wrote:
On Thu, Jan 23, 2014 at 8:10 PM, Jeremiah Brock <[email protected]> wrote:Hi All, Just a follow up, I was able to get around this strange issue by doing the following :Was this a new install?On the Server : chown root:ossec ar.conf service ossec restart On the Agent : service ossec restart The Agent /var/ossec/etc/shared now magically downloaded the proper ar.conf file : root@host1:/var/ossec/etc/shared# ls -l total 168 -rw-r--r-- 1 ossec ossec 153 Jan 23 16:41 ar.conf -rwxrwx--- 1 root ossec 9501 Jan 23 16:41 cis_debian_linux_rcl.txt -rwxrwx--- 1 root ossec 8192 Jan 23 16:41 cis_rhel5_linux_rcl.txt -rwxrwx--- 1 root ossec 14251 Jan 23 16:41 cis_rhel_linux_rcl.txt -rw-r--r-- 1 ossec ossec 70352 Jan 23 16:41 merged.mg -rwxrwx--- 1 root ossec 14872 Jan 23 16:41 rootkit_files.txt -rwxrwx--- 1 root ossec 5193 Jan 23 16:41 rootkit_trojans.txt -rwxrwx--- 1 root ossec 4457 Jan 23 16:41 system_audit_rcl.txt -rwxrwx--- 1 root ossec 4682 Jan 23 16:41 win_applications_rcl.txt -rwxrwx--- 1 root ossec 3859 Jan 23 16:41 win_audit_rcl.txt -rwxrwx--- 1 root ossec 4929 Jan 23 16:41 win_malware_rcl.txt No more errors in my logs!! ~Jeremy On 1/23/2014 4:32 PM, Jeremiah Brock wrote: Hi All, I am running ossec 2.7 on Ubuntu and have run into some surprising issues with the Active Response. Server : Linux mercury 2.6.32-33-server #72-Ubuntu SMP Fri Jul 29 21:21:55 UTC 2011 x86_64 GNU/Linux Client : Linux host1 3.2.0-56-virtual #86-Ubuntu SMP Wed Oct 23 18:12:10 UTC 2013 i686 athlon i386 GNU/Linux Server available active responses : /var/ossec/bin/agent_control -L OSSEC HIDS agent_control. Available active responses: No active response available. Server ossec.log errors : 2014/01/23 14:58:50 ossec-remoted: Error accessing file '/etc/shared/ar.conf' Agent ossec.log errors : 2014/01/23 14:30:13 ossec-execd(1103): ERROR: Unable to open file '/var/ossec/etc/shared/ar.conf'. 2014/01/23 14:30:13 ossec-execd(1311): ERROR: Invalid command name 'firewall-drop600' provided. Server ossec.conf : <command> <name>host-deny</name> <executable>host-deny.sh</executable> <expect>srcip</expect> <timeout_allowed>yes</timeout_allowed> </command> <command> <name>firewall-drop</name> <executable>firewall-drop.sh</executable> <expect>srcip</expect> <timeout_allowed>yes</timeout_allowed> </command> <active-response> <command>host-deny</command> <location>local</location> <level>6</level> <timeout>600</timeout> </active-response> <active-response> <command>firewall-drop</command> <location>local</location> <level>6</level> <timeout>600</timeout> </active-response> Server etc/shared directory : root@mercury:/var/ossec/etc/shared# ls -l total 168 -r--r----- 1 root root 153 Jan 23 14:58 ar.conf -r--r----- 1 root ossec 9501 Nov 8 2012 cis_debian_linux_rcl.txt -r--r----- 1 root ossec 8192 Nov 8 2012 cis_rhel5_linux_rcl.txt -r--r----- 1 root ossec 14251 Nov 8 2012 cis_rhel_linux_rcl.txt -rw-r--r-- 1 ossecr ossec 70186 Jan 23 14:58 merged.mg -r--r----- 1 root ossec 14872 Nov 8 2012 rootkit_files.txt -r--r----- 1 root ossec 5193 Nov 8 2012 rootkit_trojans.txt -r--r----- 1 root ossec 4457 Nov 8 2012 system_audit_rcl.txt -r--r----- 1 root ossec 4682 Nov 8 2012 win_applications_rcl.txt -r--r----- 1 root ossec 3859 Nov 8 2012 win_audit_rcl.txt -r--r----- 1 root ossec 4929 Nov 8 2012 win_malware_rcl.txt Client etc/shared directory : root@host1:/var/ossec/etc/shared# ls -l total 88 -rwxrwx--- 1 root ossec 9501 Jan 1 15:21 cis_debian_linux_rcl.txt -rwxrwx--- 1 root ossec 8192 Jan 1 15:21 cis_rhel5_linux_rcl.txt -rwxrwx--- 1 root ossec 14251 Jan 1 15:21 cis_rhel_linux_rcl.txt -rwxrwx--- 1 root ossec 14872 Jan 1 15:21 rootkit_files.txt -rwxrwx--- 1 root ossec 5193 Jan 1 15:21 rootkit_trojans.txt -rwxrwx--- 1 root ossec 4457 Jan 1 15:21 system_audit_rcl.txt -rwxrwx--- 1 root ossec 4682 Jan 1 15:21 win_applications_rcl.txt -rwxrwx--- 1 root ossec 3859 Jan 1 15:21 win_audit_rcl.txt -rwxrwx--- 1 root ossec 4929 Jan 1 15:21 win_malware_rcl.txt Does Active Response not work out of the box? ~Jeremy -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
----- You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
<<inline: gagcidca.png>>
