This is the log after the process started. I also tried to remove the
setuid/setgid sticky bytes from executable.
Aug 26 07:30:16 register.cgi(0) INFO: 192.168.2.15 - 00:21:70:90:4e:2f
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_register_2ecgi::handler)
Aug 26 07:30:16 register.cgi(0) INFO: calling /usr/local/pf/bin/pfcmd 'manage
register 00:21:70:90:4e:2f "anguyen" pid="1",user_agent="Mozilla 4.0
compatible; MSIE 8.0; Windows NT 5.1; Trident 4.0; .NET CLR 1.1.4322; .NET CLR
2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729 "' (pf::web::_sanitize_and_register)
Aug 26 07:30:16 pfcmd(0) INFO: grace expired on violation 1200001 for node
00:21:70:90:4e:2f (pf::violation::violation_add)
Aug 26 07:30:16 pfcmd(0) INFO: violation 1200001 added for 00:21:70:90:4e:2f
(pf::violation::violation_add)
Aug 26 07:30:16 pfcmd(0) INFO: executing action 'log' on class 1200001
(pf::action::action_execute)Aug 26 07:30:16 pfcmd(0) INFO:
/usr/local/pf/logs/violation.log 2011-08-26 07:30:16: System Scan (1200001)
detected on node 00:21:70:90:4e:2f (192.168.2.15) (pf::action::action_log)
Aug 26 07:30:16 pfcmd(0) INFO: executing action 'trap' on class 1200001
(pf::action::action_execute)
Aug 26 07:30:16 pfcmd(0) INFO: re-evaluating access for node 00:21:70:90:4e:2f
(manage_register called) (pf::enforcement::reevaluate_access)
Aug 26 07:30:16 pfcmd(0) INFO: 00:21:70:90:4e:2f is currentlog connected at
10.0.10.2 ifIndex 10105 in VLAN 2 (pf::enforcement::_vlan_reevaluation)
Aug 26 07:30:16 pfcmd(0) INFO: highest priority violation for 00:21:70:90:4e:2f
is 1200001. Target VLAN for violation: registrationVlan (2)
(pf::vlan::getViolationVlan)
Aug 26 07:30:16 register.cgi(0) INFO: more violations yet to come for
00:21:70:90:4e:2f
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_register_2ecgi::handler)
Aug 26 07:30:17 redir.cgi(0) INFO: 00:21:70:90:4e:2f being redirected
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Aug 26 07:30:17 redir.cgi(0) INFO: captive portal redirect on violation vid:
1200001, redirect url: /remediation.php?template=system_scan
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Aug 26 07:30:17 redir.cgi(0) INFO: 00:21:70:90:4e:2f being redirected
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Aug 26 07:30:17 redir.cgi(0) INFO: captive portal redirect on violation vid:
1200001, redirect url: /remediation.php?template=system_scan
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Aug 26 07:30:27 release.pm(0) INFO: scanning 192.168.2.15 by calling
/usr/local/pf/bin/pfcmd schedule now 192.168.2.15 1>/dev/null 2>&1
(pf::web::release::handler)
Aug 26 07:30:27 release.pm(0) INFO: violation for mac 00:21:70:90:4e:2f vid
1200001 modified (pf::violation::violation_modify)Aug 26 07:30:28 pfcmd(0)
INFO: executing HOME=/usr/local/pf/conf/nessus/ /opt/nessus/bin/nessus -q -V -x
--dot-nessus /usr/local/pf/conf/nessus/remotescan.nessus --policy-name
RemoteScan 10.0.10.21 1241 admin <password> --target-file
/tmp/pf_nessus_192.168.2.15_2011-08-26-07:30:28.txt
/usr/local/pf/html/admin/scan/results/dump_192.168.2.15_2011-08-26-07:30:28.nbe
(pf::scan::runScan)
Aug 26 07:31:33 redir.cgi(0) INFO: 00:21:70:90:4e:2f being redirected
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Aug 26 07:31:33 redir.cgi(0) INFO: captive portal redirect to the scan in
progress page
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Aug 26 07:32:13 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:32:13,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:32:13 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:32:13 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:32:13,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:32:13 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:32:13 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:34:43 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:34:43,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:34:43 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:34:43 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:34:43,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:34:43 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:37:13 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:37:13,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:37:13 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:37:13,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:37:13 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:37:13 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:38:34 pfmon(1) INFO: running expire check (main::cleanup)
Aug 26 07:38:34 pfmon(1) INFO: checking registered nodes for expiration
(main::cleanup)
Aug 26 07:39:43 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:39:43,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:39:43 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:39:43,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:39:43 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:39:43 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:42:13 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:42:13,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:42:13 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:42:13,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:42:13 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:42:13 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:44:43 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:44:43,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:44:43 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:44:43,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:44:44 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:44:44 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:47:14 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:47:14,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:47:14 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:47:14,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:47:14 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:47:14 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:48:34 pfmon(1) INFO: running expire check (main::cleanup)
Aug 26 07:48:34 pfmon(1) INFO: checking registered nodes for expiration
(main::cleanup)
Aug 26 07:49:44 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:49:44,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:49:44 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:49:44 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:49:44,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:49:44 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:52:14 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:52:14,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:52:14 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:52:14 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:52:14,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:52:14 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:52:56 redir.cgi(0) INFO: 00:21:70:90:4e:2f being redirected
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Aug 26 07:52:56 redir.cgi(0) INFO: Updating node 00:21:70:90:4e:2f user_agent
with useragent: 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;
Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET
CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)'
(pf::web::web_node_record_user_agent)
Aug 26 07:52:56 redir.cgi(0) INFO: Static User-Agent lookup data initialized
(pf::useragent::_init)
Aug 26 07:52:56 redir.cgi(0) INFO: captive portal redirect to the scan in
progress page
(ModPerl::ROOT::ModPerl::PerlRun::usr_local_pf_html_captive_2dportal_redir_2ecgi::handler)
Aug 26 07:54:44 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:54:44,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:54:44 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:54:44 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:54:44,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:54:44 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:57:14 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:57:14,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:58:34 pfmon(1) INFO: running expire check (main::cleanup)
Aug 26 07:58:34 pfmon(1) INFO: checking registered nodes for expiration
(main::cleanup)
Aug 26 07:59:44 pfdhcplistener(12426) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:59:44,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:59:44 pfdhcplistener(12427) INFO: 00:21:70:90:4e:2f requested an IP.
DHCP Fingerprint: OS::100 (Microsoft Windows XP). Modified node with last_dhcp
= 2011-08-26 07:59:44,computername = 2009-8168-03,dhcp_fingerprint =
1,15,3,6,44,46,47,31,33,249,43 (main::listen_dhcp)
Aug 26 07:59:44 pfdhcplistener(12427) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15) (main::listen_dhcp)
Aug 26 07:59:44 pfdhcplistener(12426) INFO: DHCPACK from 10.0.10.10
(00:0c:29:5a:c8:19) to host 00:21:70:90:4e:2f (192.168.2.15)
(main::listen_dhcp)Aug 26 08:00:59 pfcmd(0) INFO: Nessus scan did not detect
any vulnerabilities on 192.168.2.15 (pf::scan::runScan)
Aug 26 08:00:59 pfcmd(0) INFO: calling /usr/local/pf/bin/pfcmd manage vclose
00:21:70:90:4e:2f 1200001 (pf::scan::runScan)
Aug 26 08:00:59 pfcmd(0) INFO: violation 1200001 closed for 00:21:70:90:4e:2f
(pf::violation::violation_close)
Aug 26 08:00:59 pfcmd(0) INFO: re-evaluating access for node 00:21:70:90:4e:2f
(manage_vclose called) (pf::enforcement::reevaluate_access)
Aug 26 08:00:59 pfcmd(0) INFO: 00:21:70:90:4e:2f is currentlog connected at
10.0.10.2 ifIndex 10105 in VLAN 2 (pf::enforcement::_vlan_reevaluation)
Aug 26 08:00:59 pfcmd(0) INFO: MAC: 00:21:70:90:4e:2f, PID: anguyen, Status:
reg. Returned VLAN: 10 (pf::vlan::fetchVlanForNode)
Aug 26 08:00:59 pfcmd(0) INFO: calling /usr/local/pf/bin/flip.pl for node
00:21:70:90:4e:2f (current VLAN = 2 but should be in VLAN 10)
(pf::enforcement::_vlan_reevaluation)
Aug 26 08:01:00 flip.pl(0) INFO: flip.pl called with 00:21:70:90:4e:2f (main::)
Aug 26 08:01:00 flip.pl(0) INFO: switch port for 00:21:70:90:4e:2f is 10.0.10.2
ifIndex 10105 connection type: Wired SNMP (main::)
Aug 26 08:01:00 pfcmd(0) WARN: Error trying to run command:
/usr/local/pf/bin/pfcmd manage vclose 00:21:70:90:4e:2f 1200001 called from
runScan. Child exited with non-zero value 1 (pf::util::pf_run)
Aug 26 08:01:02 pfsetvlan(21) INFO: local (127.0.0.1) trap for switch 10.0.10.2
(main::parseTrap)
Aug 26 08:01:02 pfsetvlan(1) INFO: nb of items in queue: 1; nb of threads
running: 0 (main::startTrapHandlers)
Aug 26 08:01:02 pfsetvlan(1) INFO: reAssignVlan trap received on 10.0.10.2
ifIndex 10105 (main::handleTrap)
Aug 26 08:01:02 pfsetvlan(1) INFO: security traps are configured on 10.0.10.2
ifIndex 10105. Re-assigning VLAN for 00:21:70:90:4e:2f (main::handleTrap)
Aug 26 08:01:02 pfsetvlan(1) WARN: couldn't get MAC at ifIndex 10105. This is a
problem. (pf::SNMP::_getMacAtIfIndex)
------------------------------------------------------------------------------
Special Offer -- Download ArcSight Logger for FREE!
Finally, a world-class log management solution at an even better
price-free! And you'll get a free "Love Thy Logs" t-shirt when you
download Logger. Secure your free ArcSight Logger TODAY!
http://p.sf.net/sfu/arcsisghtdev2dev
_______________________________________________
Packetfence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
