detecte the ipsrc responsable of the syscheck integrity

detecte the ipsrc responsable of the syscheck integrity

Pre-shared keys do not work for dynamic cloud based environments like AWS where hosts can pop up and down at a moments notice.
Using a technology like SSL would mean that the agent only needs to know where to send it's data.

Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):
Files hidden inside directory '/dev'. Link count does not match number of files (5,17).

I guess something has changed in bsd 9.0 and OSSEC fires a false positive

Root check reports:
"Trojaned version of file '/sbin/init' detected. Signature used: 'bash|/dev/h|HOME' (Generic)" while checking opensuse 12.1 (and probably all Linux versions that use "systemd" instead of "init".

This happens because systemd includes the string "HOME".

So this is a false positive and should be fixed.

http://www.ossec.net/doc/manual/monitoring/process-monitoring.html

In the load average example, the match tag uses double quotes in

ossec: output: "uptime":

and in the regex tag:

load averages: 2.

In my new CentOS 6.1 installation, it will only work if single quotes (apostrophes) are used within the match tag and "load average: 2" (singular) is used within the regex tag.

When ossec is updated, any customizations to the rules in /var/ossec/etc/shared are overwritten.

A specific example is system_audit_rcl.txt where the locations of php.ini as well as the web directories are different for us and our clients than the default.

We make the changes in system_audit_rcl.txt and updates overwrite our changes.

The goal is to either A) allow the solution to be white label or branded or B) allow providers to include messages in the body of the ossec alert for their clients.

Change:

System Audit: Web vulnerability - Outdated WordPress installation. File: **FULL PATH WAS HERE. Reference: http://sucuri.net/latest-versions

To

*** HOSTNAME*** System Audit: Web vulnerability - Outdated WordPress installation. File: **FULL PATH WAS HERE. Reference: http://sucuri.net/latest-versions

This should allow ossec-reportd to be used to show outdated applications by agent.

looks like a coding error in Alert.php line 48 for the way it asks the date

Fix description on rule 4386 in pix_rules.xml
now it is
Nultiple AAA (VPN) authentication failures.
should be
Multiple AAA (VPN) authentication failures.

Line 209 specifies ossec-logtest line as:

echo | ${DIR}/ossec-logtest > /dev/null 2>&1;

It should be:

echo | ${DIR}/bin/ossec-logtest > /dev/null 2>&1;

If it isn't then the following line appears on startup:

OSSEC analysisd: Testing rules failed. Configuration error. Exiting.

At the moment is not possible to configure process monitoring using agent.conf and therefore it must be configure on every single agent.
It would be handy to remove this limitation by having command and command_full configurable from agent.conf and therefore centrally manageable from the OSSEC master.

if I type "list_agents -c" I can see my agent that has previously been added to ossec as "active" even I did "ossec-control stop" and there are no ossec* process running there.

It stays "active" even after ossec-server has been restarted.

And it means this system is VERY unreliable cos if someone/something killed your agent you would never know about that.
Could it be fixed?

Thanks

There is an issue compiling on Lion using XCode 4.1.

When making os_crypto:

sha_locl.h:261: error: unsupported inline asm: input constraint with a matching output constraint of incompatible type!

After getting alerts on windows registry \Enum keys changing, I noticed this rule in the default config file:
<registry_ignore type=“sregex”>\Enum$</registry_ignore>

Is this a typo? What would the \E match - it doesn't seem to be a documented expression?

There are multiple links in the documentation and missing "complete" examples.

Similar to:
http://www.mail-archive.com/ossec-list@googlegroups.com/msg03429.html

Allow the user to configure the timeout length before a client is considered 'disconnected'. We can get 12 alerts/agent/day which becomes very 'noisy'.
Many Thanks