4

I have installed Ossec on one server and agents on some other servers running on Redhat. The issue is that some servers are able to communicate and send the logs to servers and others are in INACTIVE state even though I have imported the security keys.

2013/02/23 15:34:34 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'.
2013/02/23 15:38:30 ossec-agentd: INFO: Trying to connect to server (192.168.109.1:1514).
2013/02/23 15:38:30 ossec-agentd: INFO: Using IPv4 for: 192.168.109.1 .
2013/02/23 15:38:51 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'.
2013/02/23 15:43:05 ossec-agentd: INFO: Trying to connect to server (192.168.109.1:1514).
2013/02/23 15:43:05 ossec-agentd: INFO: Using IPv4 for: 192.168.109.1 .
2013/02/23 15:43:26 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'.
2013/02/23 15:47:58 ossec-agentd: INFO: Trying to connect to server (192.168.109.1:1514).
2013/02/23 15:47:58 ossec-agentd: INFO: Using IPv4 for: 192.168.109.1 .
2013/02/23 15:48:19 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'.
2013/02/23 15:53:09 ossec-agentd: INFO: Trying to connect to server (192.168.109.1:1514).
2013/02/23 15:53:09 ossec-agentd: INFO: Using IPv4 for: 192.168.109.1 .
2013/02/23 15:53:30 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'.
2013/02/23 15:58:38 ossec-agentd: INFO: Trying to connect to server (192.168.109.1:1514).
2013/02/23 15:58:38 ossec-agentd: INFO: Using IPv4 for: 192.168.109.1 .
2013/02/23 15:58:59 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '192.168.109.1'

And I checked with Security team and they said that there is a firewall between Host and agents. And they have enabled port 514 UDP on server. But still agents not able to communicate with server

Netstat output

[emerg@Monit ~]$ netstat -panu
(No info could be read for "-p": geteuid()=1344 but you should be root.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
udp        0      0 0.0.0.0:32769               0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:514                 0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:10000               0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:657                 0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:660                 0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:5353                0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:1514                0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:111                 0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:631                 0.0.0.0:*                               -                   
udp        0      0 10.1.1.109:123              0.0.0.0:*                               -                   
udp        0      0 192.168.109.1:123           0.0.0.0:*                               -                   
udp        0      0 127.0.0.1:123               0.0.0.0:*                               -                   
udp        0      0 0.0.0.0:123                 0.0.0.0:*                               -                   
udp        0      0 :::32771                    :::*                                    -                   
udp        0      0 :::5353                     :::*                                    -                   
udp        0      0 fe80::21e:c9ff:fee0:123     :::*                                    -                   
udp        0      0 fe80::21e:c9ff:fee0:123     :::*                                    -                   
udp        0      0 ::1:123                     :::*                                    -                   
udp        0      0 :::123                      :::*  

Contents of Ossec.conf from Ossec HIDS Server

<ossec_config>
  <global>
    <email_notification>yes</email_notification>
    <email_to>systems@advancedoperations.com</email_to>
    <smtp_server>10.171.1.10</smtp_server>
    <email_from>ossec.osl@advancedoperations.com</email_from>
  </global>

  <rules>
    <include>rules_config.xml</include>
    <include>pam_rules.xml</include>
    <include>sshd_rules.xml</include>
    <include>telnetd_rules.xml</include>
    <include>syslog_rules.xml</include>
    <include>arpwatch_rules.xml</include>
    <include>symantec-av_rules.xml</include>
    <include>symantec-ws_rules.xml</include>
    <include>pix_rules.xml</include>
    <include>named_rules.xml</include>
    <include>smbd_rules.xml</include>
    <include>vsftpd_rules.xml</include>
    <include>pure-ftpd_rules.xml</include>
    <include>proftpd_rules.xml</include>
    <include>ms_ftpd_rules.xml</include>
    <include>ftpd_rules.xml</include>
    <include>hordeimp_rules.xml</include>
    <include>roundcube_rules.xml</include>
    <include>wordpress_rules.xml</include>
    <include>vpopmail_rules.xml</include>
    <include>vmpop3d_rules.xml</include>
    <include>courier_rules.xml</include>
    <include>web_rules.xml</include>
    <include>apache_rules.xml</include>
"ossec.conf" 162L, 5585C

Firewall rule

 13M 3734M ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.9.1         multiport dports 123,514
  • it might be a problem of port because you are using restricted port.can you please send the output of netstat -panu of your server machine...??? – P4cK3tHuNt3R Feb 23 '13 at 14:56
  • @raghavmishra, Thanks for replying I have added the netstat output in Question... – OmiPenguin Feb 24 '13 at 6:22
  • it seems like you are running same service on two different ports(1514, 514). stop service running on 1514 or 514. – P4cK3tHuNt3R Feb 25 '13 at 3:29
  • I have also added the contents of Ossec.conf Im not sure how to restrict Ossec Server to listen to only 1514 port. Because the agents are trying to contact to 1514 but they can reach it. Also added the firewall rule for Ossec Server in Question – OmiPenguin Feb 25 '13 at 7:24
1

If you assume that firewall blocks in between, you can test the connection on commandline:

netcat -u servername 1514

Now, if you type some text, you should find on the OSSEC server-side a log message like:

less /var/ossec/logs/ossec.log
2014/02/14 17:54:07 ossec-remoted(1403): ERROR: Incorrectly formated message from 'nn.nn.nn.nnn'.

As you see, I use the OSSEC default port 1514 for communication. So, are you sure you're using port 514?

For a step-by-step how-to debuging an OSSEC connection, you can have a look at my blog, How to debug a OSSEC connection.

| improve this answer | |
1

I have seen OSSEC connection related questions here and on other websites, with no suitable answer.

Did you check the server log and does it show "Message from w.x.y.z not allowed"? That indicates (I think) an IP address mismatch. The messages from the agent are getting through, i.e. no firewall or NAT issues, but the server does not accept them.

The IP address mismatch seems to occur when specifying a subnet for the agent; the problem does not occur with a single IP address. When an agent exe file is created, say you specify an address 10.1.20.0/24, because the host relies on DHCP. You must add, in the ossec.conf file on the server, the <allowed-ips> tag:

<remote>
  <connection>secure</connection>
  <allowed-ips>10.1.20.0/24(<allowed-ips>
</remote>

This tag is not created by default and adding this tag solves the problem. You need to re-start the OSSEC service.

| improve this answer | |
0

Is your ossec-remoted running? I've had problems with that starting as a part of ossec-control, had to patch it manually to do it for me.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.