Hi, Am running OSSEC 2.8.3-3jessie (from the alientvault.com repo)
I'm trying to test active-response rules for a Wordpress install - specifically to add source IPs as DROP rules in iptables where they have multiple authentication issues, or where they are trying to brute force via XMLRPC multicall. The rules all work well in ipv4, but I get no active response under ipv6 - though I do get the alert at level 10 as follows (via email notification) - is picked up as an auth failure thanks to WPfail2ban (I don't have the WPsyslog2 plugin so it skips the WP specific rules - though may rectify that), or via a custom rule for xmlrpc.php POSTS: OSSEC HIDS Notification. 2015 Nov 26 23:04:34 Received From: host->/var/log/auth.log Rule: 40111 fired (level 10) -> "Multiple authentication failures." Portion of the log(s): Nov 26 23:04:33 host wordpress(www.chromosphere.co.uk)[10102]: Authentication failure for sam from x:x:x:x:0:3:0:1 Nov 26 23:04:32 host wordpress(www.chromosphere.co.uk)[10102]: Authentication failure for sam from x:x:x:x:0:3:0:1 Nov 26 23:04:31 fuggle wordpress(www.chromosphere.co.uk)[10102]: Authentication failure for sam from x:x:x:x:0:3:0:1 ...etc... (Original log: /var/log/auth: Nov 26 23:04:32 fuggle wordpress(www.chromosphere.co.uk)[10102]: Authentication failure for sam from x:x:x:x:0:3:0:1 ) Is ipv6 supported for active-responses yet? I've added debug statements to mail me when the firewall-drop.sh rule active-response runs (and to tell me what the params are) but see nothing for ipv6 (but works for ipv4) . The script looks like it should work with ipv6 as there's different logic as to whether the ip address has dots or colons... Thanks Graeme -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
