Just to post a followup with this problem. It was resolved by editing the expect script, because we had a non-standard linux prompt. This was the problem juser@system1:^[[1;4;31;40mPRODUCTION^[[0m:~>
On Wednesday, November 12, 2014 3:05:01 PM UTC-5, dan (ddpbsd) wrote: > > On Wed, Nov 12, 2014 at 3:02 PM, Jim Nofsinger <[email protected] > <javascript:>> wrote: > > Hello Guys/Gals, > > > > I have a new system up and running with OSSEC. trying to get an > agentless > > deployment working and it is timing out right after a successful login. > I > > have tried the expect script with commands such as "pwd" and it always > times > > out. this happens for a few linux hosts and a MAC host... on the same > > subnet, no firewalls on. > > > > Anyone have suggestions on what to try next? I do get a login prompt, > so I > > get to the box... frustrating :) > > > > Try running the script manually. I'm guessing the script is expecting > to see something it isn't seeing. > > > 2014/11/12 14:31:22 ossec-agentlessd: DEBUG: buffer: spawn ssh > > [email protected] <javascript:> > > > > 2014/11/12 14:31:22 ossec-agentlessd: DEBUG: buffer: [email protected] > > password: > > > > 2014/11/12 14:31:22 ossec-agentlessd: DEBUG: buffer: Last login: Wed Nov > 12 > > 14:29:10 2014 from ossec.local > > > > 2014/11/12 14:31:26 ossec-syscheckd: INFO: Starting syscheck scan > > (forwarding database). > > > > 2014/11/12 14:31:26 ossec-syscheckd: INFO: Starting syscheck database > > (pre-scan). > > > > 2014/11/12 14:31:42 ossec-agentlessd: DEBUG: buffer: > > juser@system1:^[[1;4;31;40mPRODUCTION^[[0m:~> > > > > 2014/11/12 14:31:42 ossec-agentlessd: ERROR: ssh_integrity_check_linux: > > [email protected] <javascript:>: Timeout while running on host: > [email protected] <javascript:> . > > > > 2014/11/12 14:40:42 ossec-syscheckd: INFO: Finished creating syscheck > > database (pre-scan completed). > > > > 2014/11/12 14:40:54 ossec-syscheckd: INFO: Ending syscheck scan > (forwarding > > database). > > > > 2014/11/12 14:41:14 ossec-rootcheck: INFO: Starting rootcheck scan. > > > > 2014/11/12 14:41:14 ossec-rootcheck: DEBUG: Starting on check_rc_files > > > > 2014/11/12 14:41:14 ossec-rootcheck: DEBUG: Starting on check_rc_trojans > > > > 2014/11/12 14:41:17 ossec-rootcheck: DEBUG: Starting on > check_rc_unixaudit > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
