On Wed, Oct 19, 2016 at 11:04 AM, Adiel Navarro <adiel.nava...@mail.telcel.com> wrote: > Question, Dan > > Active response works in Solaris systems? >
It should, as long as you configure it I guess. I've never tried it. > > > > -----Mensaje original----- > De: ossec-list@googlegroups.com [mailto:ossec-list@googlegroups.com] En > nombre de dan (ddp) > Enviado el: miércoles, 19 de octubre de 2016 07:50 a.m. > Para: ossec-list@googlegroups.com > Asunto: Re: [ossec-list] Active response > > On Wed, Oct 19, 2016 at 8:43 AM, dan (ddp) <ddp...@gmail.com> wrote: >> On Tue, Oct 18, 2016 at 6:54 PM, Aj Navarro <ajnavarro1...@gmail.com> wrote: > >>> Only I see the next messages in /var/ossec/logs/alers/alerts.log >>> >>> ** Alert 1476724188.107242: mail - syslog,errors, >>> >>> 2016 Oct 17 12:09:48 ixtrtc42scf->/var/log/messages >>> >>> Rule: 1002 (level 2) -> 'Unknown problem somewhere in the system.' >>> >>> Oct 17 12:09:48 ixtrtc42scf kernel: type=1100 >>> audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295 >>> ses=4294967295 msg= >>> >>> 'op=PAM:authentication acct="root" exe="/usr/sbin/sshd" >>> hostname=10.188.62.176 addr=10.188.62.176 terminal=ssh res=failed' >>> >> >> These log messages are not triggering 5712. In fact OSSEC isn't sure >> what to do with these log messages. >> Is there anything in your auth log? >> > > Digging into it further, we get: > # cat /tmp/yy | /var/ossec/bin/ossec-logtest -q > 2016/10/19 08:44:09 ossec-testrule: INFO: Reading the lists file: > 'rules/lists/ossec.block' > 2016/10/19 08:44:09 ossec-testrule: INFO: Started (pid: 16098). > ossec-testrule: Type one log per line. > > **Phase 1: Completed pre-decoding. > full event: 'Oct 17 12:09:48 ixtrtc42scf kernel: type=1100 > audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295 > ses=4294967295 msg='op=PAM:authentication acct="root" > exe="/usr/sbin/sshd" hostname=10.188.62.176 addr=10.188.62.176 terminal=ssh > res=failed'' > hostname: 'ixtrtc42scf' > program_name: 'kernel' > log: 'type=1100 audit(1476724188.016:36149378): user pid=6141 > uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="root" > exe="/usr/sbin/sshd" hostname=10.188.62.176 > addr=10.188.62.176 terminal=ssh res=failed'' > > **Phase 2: Completed decoding. > decoder: 'iptables' > > **Phase 3: Completed filtering (rules). > Rule id: '1002' > Level: '2' > Description: 'Unknown problem somewhere in the system.' > **Alert to be generated. > > So we'll have to create a decoder to deal with these odd log messages. > Adding the following decoder to my local decoders file: > <decoder name="wtf-iptables"> > <parent>iptables</parent> > <prematch> exe="/usr/sbin/sshd" </prematch> > <!--<regex> acct="(\S+)" hostname="(\S+)" addr="(\S+)" </regex>--> > <regex> acct="(\S+)" exe="/\.+/sshd" hostname=(\S+) addr=(\S+) </regex> > <order>user,dstip, srcip</order> > </decoder> > > I get: > **Phase 1: Completed pre-decoding. > full event: 'Oct 17 12:09:48 ixtrtc42scf kernel: type=1100 > audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295 > ses=4294967295 msg='op=PAM:authentication acct="root" > exe="/usr/sbin/sshd" hostname=10.188.62.176 addr=10.188.62.176 terminal=ssh > res=failed'' > hostname: 'ixtrtc42scf' > program_name: 'kernel' > log: 'type=1100 audit(1476724188.016:36149378): user pid=6141 > uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="root" > exe="/usr/sbin/sshd" hostname=10.188.62.176 > addr=10.188.62.176 terminal=ssh res=failed'' > > **Phase 2: Completed decoding. > decoder: 'iptables' > dstuser: 'root' > dstip: '10.188.62.176' > srcip: '10.188.62.176' > > **Phase 3: Completed filtering (rules). > Rule id: '1002' > Level: '2' > Description: 'Unknown problem somewhere in the system.' > **Alert to be generated. > > > I haven't done any testing to see if this will affect anything else though. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
