[ossec-list] syscheck - what am I doing wrong?

2014-10-16 Thread derek
I'm trying to get syscheck to work. Actually, not so much work as show any signs of life. :) I've pared the task down to getting it to indicate something - anything - has changed in a directory I've created on the local installation machine: /etc/test. My ossec.conf has this: 180 n

[ossec-list] ESXi 5.1 & 5.5 support

2014-10-16 Thread Luke Hinds
Hello All, I note there is agent support for VMWare ESX 3.0,3.5 Is there any plan to work on support for later versions, for example 5.1 or 5.5? Or has anyone verified if the current code works on the later versions of ESXi? If not, I personally don't mind rolling up sleeves and testing (althou

[ossec-list] OSSEC file integrity tool questions

2014-10-16 Thread jason polachak
All, Do you know if OSSEC is able to support these three DoD STIG requirements? I am unable to find this out in the documentation. I tried to get an answer from the standard contact us email section of OSSEC and they said to post here. The three questions are first, does the file integrity too

Re: [ossec-list] Installation Query

2014-10-16 Thread dan (ddp)
On Wed, Oct 15, 2014 at 9:26 PM, Colin Bruce wrote: > Dear Dan, > > The command you mentioned (ossec-remoted-df) did the trick It produced two > errors which explained why it wasn't running and once they were fixed it all > worked fine. This is a default installation running on the machine it wa

Re: [ossec-list] syscheck - what am I doing wrong?

2014-10-16 Thread dan (ddp)
On Thu, Oct 16, 2014 at 4:33 AM, wrote: > I'm trying to get syscheck to work. Actually, not so much work as show any > signs of life. :) > > I've pared the task down to getting it to indicate something - anything - > has changed in a directory I've created on the local installation machine: > /et

Re: [ossec-list] Installation Query

2014-10-16 Thread dan (ddp)
On Thu, Oct 16, 2014 at 8:39 AM, dan (ddp) wrote: > On Wed, Oct 15, 2014 at 9:26 PM, Colin Bruce wrote: >> Dear Dan, >> >> The command you mentioned (ossec-remoted-df) did the trick It produced two >> errors which explained why it wasn't running and once they were fixed it all >> worked fine. T

Re: [ossec-list] ESXi 5.1 & 5.5 support

2014-10-16 Thread dan (ddp)
On Thu, Oct 16, 2014 at 6:13 AM, Luke Hinds wrote: > Hello All, > > I note there is agent support for > > VMWare ESX 3.0,3.5 > > Is there any plan to work on support for later versions, for example 5.1 or > 5.5? Or has anyone verified if the current code works on the later versions > of ESXi? > >

Re: [ossec-list] OSSEC file integrity tool questions

2014-10-16 Thread dan (ddp)
On Thu, Oct 16, 2014 at 7:38 AM, jason polachak wrote: > All, > > Do you know if OSSEC is able to support these three DoD STIG requirements? I > am unable to find this out in the documentation. I tried to get an answer > from the standard contact us email section of OSSEC and they said to post > h

RE: [ossec-list] Installation Query

2014-10-16 Thread Colin Bruce
Dear Dan, That's great thanks. I think you are right about trying to do 3 things at once. I have rebuilt it with the default location (/var/ossec) and run it on the server it was built on and it works fine so I guess there are several things I am not doing correctly that are causing the problems I

Re: [ossec-list] OSSEC file integrity tool questions

2014-10-16 Thread Michael Starks
On 10/16/2014 06:38 AM, jason polachak wrote: > All, > > Do you know if OSSEC is able to support these three DoD STIG > requirements? > Rule Title: The file integrity tool must be configured to verify ACLs. > Vulnerability Discussion: ACLs can provide permissions beyond those > permitted through

[ossec-list] POODLE/sandworm - CVE-2014-3566

2014-10-16 Thread Farnsworth, Robert
Hi, My organization has just issued warnings against this vulnerability CVE-2014-3566, it appears it maybe an old bug that has just resurfaced, does OSSEC alert on this vulnerability, my current OSSEC environment is 2.8.1? AS always thank you for your help, I am fairly new to OSSEC so please go

Re: [ossec-list] POODLE/sandworm - CVE-2014-3566

2014-10-16 Thread dan (ddp)
On Thu, Oct 16, 2014 at 11:37 AM, Farnsworth, Robert wrote: > Hi, > > > > My organization has just issued warnings against this vulnerability > CVE-2014-3566, it appears it maybe an old bug that has just resurfaced, does > OSSEC alert on this vulnerability, my current OSSEC environment is 2.8.1? >

Re: [ossec-list] ESXi 5.1 & 5.5 support

2014-10-16 Thread luke
On Thursday, October 16, 2014 1:56:43 PM UTC+1, dan (ddpbsd) wrote: > > On Thu, Oct 16, 2014 at 6:13 AM, Luke Hinds > wrote: > > Hello All, > > > > I note there is agent support for > > > > VMWare ESX 3.0,3.5 > > > > Is there any plan to work on support for later versions, for example 5.1