Hello,
I am using ansible to auto deploy new systems and register with the ossec
server.
I am running into an issue where after successfully running the agent-auth
command, the new system appears in ossec server but any requests from the
client are rejected by the server. I have found that changing the servers
etc/client.keys from any to the actual IP and restarting ossec fixes the
problem. Is there a work around for this? Or is there an easy way to push
keys into the client.keys file (I know the IP and client name but I don't
know how to make the key that goes into client.keys)?
In my example, .116 is the new client, and .120 is the server
.116 ) /var/ossec/bin/agent-auth -m 10.0.253.120 1515
.120 ) cat etc/client.keys
1024 newclient any a87b4ab3b744fd4505445.....
.116 ) netcat -u 10.0.253.120 1514
test
.120 ) tail logs/ossec.log
2014/09/05 16:32:06 ossec-remoted(1213): WARN: Message from
10.0.253.116 not allowed.
.120 ) vim etc/client.keys # change any to the ip
1024 newclient 10.0.253.116 a87b4ab3b744fd4505445.....
service ossec restart
.116) netcat -u 10.0.253.120 1514
test
.120 ) tail logs/ossec.log
2014/09/05 16:35:51 ossec-remoted(1403): ERROR: Incorrectly
formated message from '10.0.253.116'.
I am running ossec 2.8 on both server and agent.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
