On Fri, Dec 5, 2014 at 8:16 AM, Tom Travis
<[email protected]> wrote:
> I have ossec running (version included included in security-onion) and am
> generating alerts, along with the active responses for the stock host-deny
> and firewall-drop scripts.
>
> I am wanting to go a step further and send a "ssh" command to my router
> (tomato router with iptables) and block offending IP addresses at the router
> to keep bad stuff out of my network.
>
> I created an additional active response by copying firewall-drop.sh to
> router-drop.sh, and setting up the corresponding "command" and
> "active-response" sections within ossec.conf.
>
> I then went and modified the lines that actually execute iptables for ARG1
> and ARG2 and made them look like this:
>
> sshpass -p "rootpasswordforrouter" ssh [email protected] iptables ${ARG1}
>
> This works. When the active response fires, it creates an entry in the
> iptables on my router.... yea.
>
> I know this is sloppy, because the code actually checks for the existence of
> iptables on the so box and not the router, but so what,,,, I know iptables
> exists on both.
>
> I would also like to get this working with straight ssh and keys and such
> but that is for a later refinement.
>
> I have a few questions:
>
> What user ID is ossec running under? I would assume "ossec" but not sure.
>
Depends on the daemon. Some are ossec, some are (one is?) ossecr, some
are root. `ps auxww | grep ossec`
> I am getting some errors in my active-responses.log file complaining about
> "Unable kill process 16828 holding lock" following some but not all of my
> router-drop entries.
>
> I am trying to understand the lock() and unlock() functions within my
> firewall-drop.sh and similar firewall-drop.sh scripts.
>
> Why do we need to lock something and what are we locking?
>
Without looking at the script I'm guessing it doesn't want too many
copies of the script to be modifying the firewall at the same time.
It's easy to include a "lock" so that subsequent copies wait for the
earlier copies to finish. Since you're going through a whole ssh
session, I'm guessing each run of the script takes your system longer
than most.
> It looks like the lock exists somewhere as a created directory named after a
> PID, but where are these created exactly, and do I need to make sure these
> get cleaned up?
>
> Is my firewall-drop response followed immediately by my router-drop response
> causing these "unable kill process" errors?
>
> Would I be better off simply sticking with only the firewall-drop script and
> putting my ssh-iptables command for my router in after the "${IPTABLES}
> ${ARG1}" command as shown below?
>
> ${IPTABLES} ${ARG1}
> sshpass -p "rootpasswordforrouter" ssh [email protected] iptables ${ARG1}
>
>
> Is the lock() and unlock() function what allows the iptables entries to be
> deleted after the expiration time?
>
>
> If there is documentation on this, I would be happy to read it. Just point
> me there.
>
Have you looked at the script? I don't think it's documented, but I
don't think it's very complex either.
> Thanks in advance,
>
> Tom Travis
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
