On Wed, Nov 12, 2014 at 3:02 PM, Jim Nofsinger <[email protected]> wrote: > Hello Guys/Gals, > > I have a new system up and running with OSSEC. trying to get an agentless > deployment working and it is timing out right after a successful login. I > have tried the expect script with commands such as "pwd" and it always times > out. this happens for a few linux hosts and a MAC host... on the same > subnet, no firewalls on. > > Anyone have suggestions on what to try next? I do get a login prompt, so I > get to the box... frustrating :) >
Try running the script manually. I'm guessing the script is expecting to see something it isn't seeing. > 2014/11/12 14:31:22 ossec-agentlessd: DEBUG: buffer: spawn ssh > [email protected] > > 2014/11/12 14:31:22 ossec-agentlessd: DEBUG: buffer: [email protected] > password: > > 2014/11/12 14:31:22 ossec-agentlessd: DEBUG: buffer: Last login: Wed Nov 12 > 14:29:10 2014 from ossec.local > > 2014/11/12 14:31:26 ossec-syscheckd: INFO: Starting syscheck scan > (forwarding database). > > 2014/11/12 14:31:26 ossec-syscheckd: INFO: Starting syscheck database > (pre-scan). > > 2014/11/12 14:31:42 ossec-agentlessd: DEBUG: buffer: > juser@system1:^[[1;4;31;40mPRODUCTION^[[0m:~> > > 2014/11/12 14:31:42 ossec-agentlessd: ERROR: ssh_integrity_check_linux: > [email protected]: Timeout while running on host: [email protected] . > > 2014/11/12 14:40:42 ossec-syscheckd: INFO: Finished creating syscheck > database (pre-scan completed). > > 2014/11/12 14:40:54 ossec-syscheckd: INFO: Ending syscheck scan (forwarding > database). > > 2014/11/12 14:41:14 ossec-rootcheck: INFO: Starting rootcheck scan. > > 2014/11/12 14:41:14 ossec-rootcheck: DEBUG: Starting on check_rc_files > > 2014/11/12 14:41:14 ossec-rootcheck: DEBUG: Starting on check_rc_trojans > > 2014/11/12 14:41:17 ossec-rootcheck: DEBUG: Starting on check_rc_unixaudit > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
