Re: [ossec-list] Active response against external harware.

2010-12-01 Thread Jason 'XenoPhage' Frisvold
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 11/29/2010 02:31 PM, dan (ddp) wrote: > Since the SSH keys probably wouldn't have a passphrase to use them, > it's basically just as risky as having the password (IMHO). Slightly less overall risk as you don't expose a password that might be used e

Re: [ossec-list] Active response against external harware.

2010-11-29 Thread dan (ddp)
On Sun, Nov 28, 2010 at 12:51 PM, Kacper Wysocki wrote: > On Sun, Nov 28, 2010 at 12:44 PM, Anton Löthman > wrote: >> Im doing some research on having the active response on a server send stuff >> to a external firewall (juniper/cisco). Have any one of you experience in >> this. I guess you have

Re: [ossec-list] Active response against external harware.

2010-11-28 Thread Kacper Wysocki
On Sun, Nov 28, 2010 at 12:44 PM, Anton Löthman wrote: > Im doing some research on having the active response on a server send stuff > to a external firewall (juniper/cisco). Have any one of you experience in > this. I guess you have to creat a script in the active-response folder that > ssh into

[ossec-list] Active response against external harware.

2010-11-28 Thread Anton Löthman
Im doing some research on having the active response on a server send stuff to a external firewall (juniper/cisco). Have any one of you experience in this. I guess you have to creat a script in the active-response folder that ssh into the machine and add the rule. Always feels kind of bad to h