Hi Eduardo, I agree with Dan, I tested OSSEC v2.9 on a clean CentOS 7 with your <remote> configuration and it worked. But when I disabled IPv6 I got the same errors you have.
Please try to enable IPv6 on the running system with: sysctl -w net.ipv6.conf.all.disable_ipv6=1 sysctl -w net.ipv6.conf.default.disable_ipv6=1 And try to start OSSEC. If it works, consider enabling IPv6 permanently by editing file */etc/sysctl.conf*. Hope it help. If I find another way to run OSSEC with IPv6 disabled I will let you know. Best regards. On Thu, Mar 23, 2017 at 11:19 AM, dan (ddp) <ddp...@gmail.com> wrote: > On Thu, Mar 23, 2017 at 1:08 PM, Eduardo Reichert Figueiredo > <eduardo.reich...@hotmail.com> wrote: > > Hi dan, i dont have ipv6 enabled in my system linux, so i dont have > inet6 in > > my ifconfig configurations, only ipv4. > > > > This can caused for the problem? > > > > I think having ipv6 support is necessary now. You don't need to have > addresses or anything, but the facilities need to be available. > > > Em quarta-feira, 22 de março de 2017 20:30:08 UTC-3, dan (ddpbsd) > escreveu: > >> > >> On Tue, Mar 21, 2017 at 10:46 AM, Eduardo Reichert Figueiredo > >> <eduardo....@hotmail.com> wrote: > >> > When i install ossec 2.9.0 on rhel 7.3 (no ipv6 feature and address) i > >> > have > >> > >> Is IPv6 totally disabled for your system (support for IPv6 was removed)? > >> > >> > a problem to ossec-remoted and ossec-auth, this services cant bind > ports > >> > 1514, log error below. > >> > I generated my certificated with commands "openssl genrsa -out" and > >> > "openssl > >> > req -new -x509 -key ". > >> > > >> > ##Log OSSEC.LOG > >> > 2017/03/21 11:34:34 ossec-remoted: DEBUG: Forking remoted: '0'. > >> > 2017/03/21 11:34:34 ossec-remoted: Remote syslog allowed from: > >> > '0.0.0.0/0' > >> > 2017/03/21 11:34:34 ossec-remoted: DEBUG: Forking remoted: '1'. > >> > 2017/03/21 11:34:34 getaddrinfo: Name or service not known > >> > 2017/03/21 11:34:34 getaddrinfo: Name or service not known > >> > 2017/03/21 11:34:34 ossec-remoted(1206): ERROR: Unable to Bind port > >> > '1514' > >> > 2017/03/21 11:34:34 ossec-remoted(1206): ERROR: Unable to Bind port > >> > '514' > >> > 2017/03/21 11:34:41 ossec-syscheckd: INFO: Starting syscheck scan > >> > (forwarding database). > >> > 2017/03/21 11:34:41 ossec-syscheckd: INFO: Starting syscheck database > >> > (pre-scan). > >> > 2017/03/21 11:35:47 ossec-authd: DEBUG: Starting ... > >> > 2017/03/21 11:35:47 ossec-authd: INFO: Started (pid: 24420). > >> > 2017/03/21 11:35:47 ossec-authd: DEBUG: Returning CTX for server. > >> > 2017/03/21 11:35:47 getaddrinfo: Name or service not known > >> > 2017/03/21 11:35:47 ossec-authd: Unable to bind to port 1514 > >> > > >> > in other cases for unable to bind port 1514, my error was my > >> > client.keys, > >> > but now i have a new error "getaddrinfo". > >> > > >> > Can you help me? > >> > > >> > Kind regards > >> > > >> > -- > >> > > >> > --- > >> > You received this message because you are subscribed to the Google > >> > Groups > >> > "ossec-list" group. > >> > To unsubscribe from this group and stop receiving emails from it, send > >> > an > >> > email to ossec-list+...@googlegroups.com. > >> > For more options, visit https://groups.google.com/d/optout. > > > > -- > > > > --- > > You received this message because you are subscribed to the Google Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to ossec-list+unsubscr...@googlegroups.com. > > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- Victor M. Fernandez-Castro IT Security Engineer Wazuh Inc. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
