On Wed, Aug 20, 2014 at 9:44 AM, Patrick S <[email protected]> wrote: > Thanks for your reply, Dan. I was under the impression that the server > generated the hashes, through one of these agentless types. > > ssh_integrity_check_bsd > ssh_integrity_check_linux > ssh_generic_diff > ssh_pixconfig_diff >
It probably depends on which one you choose. I can't imagine the linux or bsd scripts transferring every file you've configured to be checked to the manager. I could be wrong, I haven't looked at the scripts much. > The docs state that ssh authentication details for the host are required. > Doesn't a machine doing the work go against what agentless appears to be? > My understanding was that nothing was installed? > The scripts are supposed to use what is already installed on the system, so no? > Hmm I seem to have inadvertently also answered my question, as I didn't > provide any SSH authentication details for the agent based monitoring. > > > On Wednesday, August 20, 2014 1:29:29 PM UTC+1, dan (ddpbsd) wrote: >> >> On Wed, Aug 20, 2014 at 8:17 AM, Patrick S <[email protected]> wrote: >> > I understand that in agentless monitoring the server takes the baseline >> > of >> > files, but what about when an agent is installed on a machine - does the >> > agent take the baseline or does the server? >> > >> >> The agent generates the hashes of the files on the system and sends >> that information to the manager. I believe it works the same way for >> agentless. >> >> > Many thanks, >> > Patrick >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
