I have ossec running (version included included in security-onion) and am generating alerts, along with the active responses for the stock host-deny and firewall-drop scripts.
I am wanting to go a step further and send a "ssh" command to my router (tomato router with iptables) and block offending IP addresses at the router to keep bad stuff out of my network. I created an additional active response by copying firewall-drop.sh to router-drop.sh, and setting up the corresponding "command" and "active-response" sections within ossec.conf. I then went and modified the lines that actually execute iptables for ARG1 and ARG2 and made them look like this: sshpass -p "rootpasswordforrouter" ssh [email protected] iptables ${ARG1} This works. When the active response fires, it creates an entry in the iptables on my router.... yea. I know this is sloppy, because the code actually checks for the existence of iptables on the so box and not the router, but so what,,,, I know iptables exists on both. I would also like to get this working with straight ssh and keys and such but that is for a later refinement. I have a few questions: What user ID is ossec running under? I would assume "ossec" but not sure. I am getting some errors in my active-responses.log file complaining about "Unable kill process 16828 holding lock" following some but not all of my router-drop entries. I am trying to understand the lock() and unlock() functions within my firewall-drop.sh and similar firewall-drop.sh scripts. Why do we need to lock something and what are we locking? It looks like the lock exists somewhere as a created directory named after a PID, but where are these created exactly, and do I need to make sure these get cleaned up? Is my firewall-drop response followed immediately by my router-drop response causing these "unable kill process" errors? Would I be better off simply sticking with only the firewall-drop script and putting my ssh-iptables command for my router in after the "${IPTABLES} ${ARG1}" command as shown below? ${IPTABLES} ${ARG1} sshpass -p "rootpasswordforrouter" ssh [email protected] iptables ${ARG1} Is the lock() and unlock() function what allows the iptables entries to be deleted after the expiration time? If there is documentation on this, I would be happy to read it. Just point me there. Thanks in advance, Tom Travis -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
