Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have installed Ossec on one server and agents on some other servers running on Redhat. The issue is that some servers are able to communicate and send the logs to servers and others are in INACTIVE state even though I have imported the security keys.

2013/02/23 15:34:34 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'.
2013/02/23 15:38:30 ossec-agentd: INFO: Trying to connect to server (192.168.109.1:1514).
2013/02/23 15:38:30 ossec-agentd: INFO: Using IPv4 for: 192.168.109.1 .
2013/02/23 15:38:51 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'.
2013/02/23 15:43:05 ossec-agentd: INFO: Trying to connect to server (192.168.109.1:1514).
2013/02/23 15:43:05 ossec-agentd: INFO: Using IPv4 for: 192.168.109.1 .
2013/02/23 15:43:26 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'.
2013/02/23 15:47:58 ossec-agentd: INFO: Trying to connect to server (192.168.109.1:1514).
2013/02/23 15:47:58 ossec-agentd: INFO: Using IPv4 for: 192.168.109.1 .
2013/02/23 15:48:19 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'.
2013/02/23 15:53:09 ossec-agentd: INFO: Trying to connect to server (192.168.109.1:1514).
2013/02/23 15:53:09 ossec-agentd: INFO: Using IPv4 for: 192.168.109.1 .
2013/02/23 15:53:30 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'.
2013/02/23 15:58:38 ossec-agentd: INFO: Trying to connect to server (192.168.109.1:1514).
2013/02/23 15:58:38 ossec-agentd: INFO: Using IPv4 for: 192.168.109.1 .
2013/02/23 15:58:59 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'

And I checked with Security team and they said that there is a firewall between Host and agents. And they have enabled port 514 UDP on server. But still agents not able to communicate with server

Netstat output

[emerg@Monit ~]$ netstat -panu
(No info could be read for "-p": geteuid()=1344 but you should be root.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
udp        0      0 0.0.0.0:32769               0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:514                 0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:10000               0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:657                 0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:660                 0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:5353                0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:1514                0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:111                 0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:631                 0.0.0.0:*                               -                   
udp        0      0 10.1.1.109:123              0.0.0.0:*                               -                   
udp        0      0 192.168.109.1:123           0.0.0.0:*                               -                   
udp        0      0 127.0.0.1:123               0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:123                 0.0.0.0:*                               -                   
udp        0      0 :::32771                    :::*                                    -                   
udp        0      0 :::5353                     :::*                                    -                   
udp        0      0 fe80::21e:c9ff:fee0:123     :::*                                    -                   
udp        0      0 fe80::21e:c9ff:fee0:123     :::*                                    -                   
udp        0      0 ::1:123                     :::*                                    -                   
udp        0      0 :::123                      :::*  

Contents of Ossec.conf from Ossec HIDS Server

<ossec_config>
  <global>
    <email_notification>yes</email_notification>
    <email_to>systems@advancedoperations.com</email_to>
    <smtp_server>10.171.1.10</smtp_server>
    <email_from>ossec.osl@advancedoperations.com</email_from>
  </global>

  <rules>
    <include>rules_config.xml</include>
    <include>pam_rules.xml</include>
    <include>sshd_rules.xml</include>
    <include>telnetd_rules.xml</include>
    <include>syslog_rules.xml</include>
    <include>arpwatch_rules.xml</include>
    <include>symantec-av_rules.xml</include>
    <include>symantec-ws_rules.xml</include>
    <include>pix_rules.xml</include>
    <include>named_rules.xml</include>
    <include>smbd_rules.xml</include>
    <include>vsftpd_rules.xml</include>
    <include>pure-ftpd_rules.xml</include>
    <include>proftpd_rules.xml</include>
    <include>ms_ftpd_rules.xml</include>
    <include>ftpd_rules.xml</include>
    <include>hordeimp_rules.xml</include>
    <include>roundcube_rules.xml</include>
    <include>wordpress_rules.xml</include>
    <include>vpopmail_rules.xml</include>
    <include>vmpop3d_rules.xml</include>
    <include>courier_rules.xml</include>
    <include>web_rules.xml</include>
    <include>apache_rules.xml</include>
"ossec.conf" 162L, 5585C

Firewall rule

 13M 3734M ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.9.1         multiport dports 123,514
share|improve this question
    
it might be a problem of port because you are using restricted port.can you please send the output of netstat -panu of your server machine...??? –  raghav mishra Feb 23 '13 at 14:56
    
@raghavmishra, Thanks for replying I have added the netstat output in Question... –  OmiPenguin Feb 24 '13 at 6:22
    
it seems like you are running same service on two different ports(1514, 514). stop service running on 1514 or 514. –  raghav mishra Feb 25 '13 at 3:29
    
I have also added the contents of Ossec.conf Im not sure how to restrict Ossec Server to listen to only 1514 port. Because the agents are trying to contact to 1514 but they can reach it. Also added the firewall rule for Ossec Server in Question –  OmiPenguin Feb 25 '13 at 7:24
    

2 Answers 2

Is your ossec-remoted running? I've had problems with that starting as a part of ossec-control, had to patch it manually to do it for me.

share|improve this answer

So if you assume, that firewall blocks in between, then u can test the connection on commandline:

netcat -u servername 1514

If you now type some text, you should find on the ossec server side a log message like:

less /var/ossec/logs/ossec.log 2014/02/14 17:54:07 ossec-remoted(1403): ERROR: Incorrectly formated message from 'nn.nn.nn.nnn'.

As u see, I use here the ossec default port 1514 for communication - so are u shure for using port 514?

For an step by step HowTo debuging an ossec connection you can have a look at: https://www.jerger.org/en_GB/blog-lang/-/blogs/how-to-debug-a-ossec-connection

share|improve this answer
1  
Please give a summary, the link might dissapear any time. –  vonbrand Feb 14 at 17:48
    
Welcome to Unix & Linux Stack Exchange! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  slm Feb 14 at 17:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.