I have ossec server and agent running in two different docker images. The agent is not able to connect to the server:
2016/08/26 20:56:25 ossec-agentd: INFO: Trying to connect to server (ossec. domain/10.0.129.94:1514). 2016/08/26 20:56:25 ossec-agentd: INFO: Using IPv4 for: 10.0.129.94 . 2016/08/26 20:56:46 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'ossec.domain/10.0.129.94'. There's no log on the server for the connection attempt. However, if I execute nc -u 10.0.129.94 1514 and send a random message, I see this in the server log: 2016/08/26 19:19:46 ossec-remoted(1213): WARN: Message from 172.17.42.1 not allowed. 172.17.42.1 is the IP from the docker interface. I already have this in my server ossec.conf: <global> <white_list>127.0.0.1</white_list> <white_list>10.0.0.0/16</white_list> <white_list>172.17.0.0/16</white_list> </global> <remote> <connection>secure</connection> <allowed-ips>10.0.0.0/16</allowed-ips> <allowed-ips>172.17.0.0/16</allowed-ips> </remote> Any ideas? - Ka-Hing -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
