On Fri, Sep 5, 2014 at 5:43 PM, Kyle Sloan <[email protected]> wrote: > Hello, > > I am using ansible to auto deploy new systems and register with the ossec > server. > > I am running into an issue where after successfully running the agent-auth > command, the new system appears in ossec server but any requests from the > client are rejected by the server. I have found that changing the servers > etc/client.keys from any to the actual IP and restarting ossec fixes the > problem. Is there a work around for this? Or is there an easy way to push > keys into the client.keys file (I know the IP and client name but I don't > know how to make the key that goes into client.keys)? > > In my example, .116 is the new client, and .120 is the server > > > .116 ) /var/ossec/bin/agent-auth -m 10.0.253.120 1515 > > .120 ) cat etc/client.keys > 1024 newclient any a87b4ab3b744fd4505445..... > > > .116 ) netcat -u 10.0.253.120 1514 > test > > .120 ) tail logs/ossec.log > 2014/09/05 16:32:06 ossec-remoted(1213): WARN: Message from > 10.0.253.116 not allowed. > > > > .120 ) vim etc/client.keys # change any to the ip > 1024 newclient 10.0.253.116 a87b4ab3b744fd4505445..... > > service ossec restart > > .116) netcat -u 10.0.253.120 1514 > test > > .120 ) tail logs/ossec.log > 2014/09/05 16:35:51 ossec-remoted(1403): ERROR: Incorrectly > formated message from '10.0.253.116'. > > > I am running ossec 2.8 on both server and agent. >
I thought this issue had been fixed, but it's been a while so maybe not. I think there's a switch for ossec-authd to add the agent's IP instead of registering it as "any." > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
