On Tue, Nov 26, 2013 at 1:55 PM, dan (ddp) <ddp...@gmail.com> wrote: > On Tue, Nov 26, 2013 at 8:52 AM, C. L. Martinez <carlopm...@gmail.com> wrote: >> On Tue, Nov 26, 2013 at 1:09 PM, dan (ddp) <ddp...@gmail.com> wrote: >>> On Tue, Nov 26, 2013 at 3:08 AM, C. L. Martinez <carlopm...@gmail.com> >>> wrote: >>>> On Tue, Nov 26, 2013 at 6:12 AM, C. L. Martinez <carlopm...@gmail.com> >>>> wrote: >>>>> On Mon, Nov 25, 2013 at 2:06 PM, C. L. Martinez <carlopm...@gmail.com> >>>>> wrote: >>>>>> On Mon, Nov 25, 2013 at 2:02 PM, dan (ddp) <ddp...@gmail.com> wrote: >>>>>>> On Mon, Nov 25, 2013 at 8:51 AM, C. L. Martinez <carlopm...@gmail.com> >>>>>>> wrote: >>>>>>>> On Mon, Nov 25, 2013 at 1:17 PM, dan (ddp) <ddp...@gmail.com> wrote: >>>>>>>>> On Mon, Nov 25, 2013 at 6:36 AM, C. L. Martinez >>>>>>>>> <carlopm...@gmail.com> wrote: >>>>>>>>>> Hi all, >>>>>>>>>> >>>>>>>>>> Last week, I have updated 5 clients and one ossec server to release >>>>>>>>>> 2.7.1. My surprise is with restart-ossec active response: it doesn't >>>>>>>>>> works. >>>>>>>>>> >>>>>>>>>> My config (as appears in OSSEC docs) is: >>>>>>>>>> >>>>>>>>>> <command> >>>>>>>>>> <name>restart-ossec</name> >>>>>>>>>> <executable>restart-ossec.sh</executable> >>>>>>>>>> <expect></expect> >>>>>>>>>> </command> >>>>>>>>>> >>>>>>>>>> <active-response> >>>>>>>>>> <command>restart-ossec</command> >>>>>>>>>> <location>local</location> >>>>>>>>>> <rules_id>120000</rules_id> >>>>>>>>>> </active-response> >>>>>>>>>> >>>>>>>>>> and rule 120000: >>>>>>>>>> >>>>>>>>>> <rule id="120000" level="10"> >>>>>>>>>> <if_sid>550</if_sid> >>>>>>>>>> <match>/var/ossec/etc/shared/agent.conf</match> >>>>>>>>>> <description>Customized agent.conf has been >>>>>>>>>> modified.</description> >>>>>>>>>> </rule> >>>>>>>>>> >>>>>>>>>> but running agent_control -L: >>>>>>>>>> >>>>>>>>>> OSSEC HIDS agent_control. Available active responses: >>>>>>>>>> >>>>>>>>>> Response name: firewall-drop86400, command: firewall-drop.sh >>>>>>>>>> >>>>>>>>>> .. it doesn't appears ... Any idea why?? >>>>>>>>>> >>>>>>>>> >>>>>>>>> Is ossec-execd running? >>>>>>>>> >>>>>>>>>> -- >>>>>>>> >>>>>>>> Yes, in all components: agents and server ... >>>>>>>> >>>>>>> >>>>>>> Is 120000 firing properly? >>>>>>> >>>>>>>> -- >>>>>>>> >>>>>> >>>>>> Yes, according to my tests .... To be sure, I have added >>>>>> /var/ossec/etc/shared to syscheck section. For example: >>>>>> >>>>>> <agent_config os="Linux"> >>>>>> <syscheck> >>>>>> <scan_on_start>no</scan_on_start> >>>>>> <frequency>43200</frequency> >>>>>> <scan_time>01:33</scan_time> >>>>>> <auto_ignore>no</auto_ignore> >>>>>> <alert_new_files>yes</alert_new_files> >>>>>> <directories report_changes="yes" realtime="yes" >>>>>> check_all="yes">/etc,/var/ossec/etc/shared</directories> >>>>>> <directories check_all="yes" >>>>>> realtime="yes">/usr/bin,/usr/sbin,/bin,/sbin,/usr/local/bin,/usr/local/sbin</directories> >>>>>> <ignore>/etc/adjtime</ignore> >>>>>> <ignore>/etc/aliases.db</ignore> >>>>>> <ignore>/etc/hosts.deny</ignore> >>>>>> <ignore>/etc/ld.so.cache</ignore> >>>>>> <ignore>/etc/lvm/cache/.cache</ignore> >>>>>> <ignore>/etc/mtab</ignore> >>>>>> >>>>>> <ignore>/etc/rc.d/rc0.d,/etc/rc.d/rc1.d,/etc/rc.d/rc2.d,/etc/rc.d/rc3.d,/etc/rc.d/rc4.d,/etc/rc.d/rc5.d,/etc/rc.d/rc6.d</ignore> >>>>>> </syscheck> >>>>>> .... >>>>> >>>>> >>>>> Please, any idea ?? >>>> >>>> >>>> Uhmm .. is this restart-ossec.sh script correct?? >>>> >>> >>> The best part about open source is that you don't have to ask such >>> questions: >>> https://bitbucket.org/jbcheng/ossec-hids/src/e0b12fd4961c97850841a6f1a7e8af47f1bb3e41/active-response/restart-ossec.sh?at=default >>> >> >> I've checked first, and it is the same script.... >> > > Then I misunderstood. What part of the script looks incorrect to you? >
The content of the restart-ossec.sh script. It is not appears an ossec-control restart action when agent.conf is modified. For example, executing without arguments: [root@ossec02 bin]# ./restart-ossec.sh ./restart-ossec.sh: invalid action: Perfect, but the problem is with the action: it can only be "add" or "delete" for the hosts.deny file ... But, where is the option to do a restart of the agent? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
