I have OSSEC 2.0 installed on a CentOS 5.3 server, but I can't get any of my Windows agents to connect to it. I've checked the application firewall on Windows (it's not enabled), but the OSSEC agent log just says that it can't connect to the server. Does anyone have a suggestion about what to try next?
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations gkittelson on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Help setting up OSSEC
- Thread starter jet042
- Start date
You'll probably need to start with Wireshark or tcpdump on your CentOS machine to determine if the agents are getting to the Linux box or not.
My first thought would be that the firewall on your CentOS box is enabled and blocking the incoming connection requests. That may be wrong if you have clients from other OSs connecting to your CentOS box already.
You might want to try an 'lsof -i' and/or 'netstat -a |grep LISTENING' to see if OSSEC is really listening on any ports.
Another possibility is that SELinux is enabled on your CentOS box and keeping OSSEC from being able to run with the privileges that it requires.
pansophic
My first thought would be that the firewall on your CentOS box is enabled and blocking the incoming connection requests. That may be wrong if you have clients from other OSs connecting to your CentOS box already.
You might want to try an 'lsof -i' and/or 'netstat -a |grep LISTENING' to see if OSSEC is really listening on any ports.
Another possibility is that SELinux is enabled on your CentOS box and keeping OSSEC from being able to run with the privileges that it requires.
pansophic
- Thread starter
- #4
@pansophic - Thanks. lsof -i shows that OSSEC is listening on the right port.
@QatQat - I have set SELinux to permissive and re-started the server, but the agents still won't connect. Is there a way to see if it is actually running permissive or check the logs for it?
@QatQat - I have set SELinux to permissive and re-started the server, but the agents still won't connect. Is there a way to see if it is actually running permissive or check the logs for it?
- Thread starter
- #6
- Thread starter
- #8
Sorry for replying so late,
have you tried to issue a
The two lines above flush all eventual rules in the filter and nat chain of your iptables, if they are enabled by default.
to stop iptables completely
QatQat
If I could have sex each time I reboot my server, I would definitely prefer Windoz over Linux!
have you tried to issue a
Code:
iptables -F
iptables -t nat -FThe two lines above flush all eventual rules in the filter and nat chain of your iptables, if they are enabled by default.
to stop iptables completely
Code:
service iptables stop
chkconfig --level 2345 iptables offQatQat
If I could have sex each time I reboot my server, I would definitely prefer Windoz over Linux!
- Status
Similar threads
- Locked
- Question