[ossec-dev] bug(s) in active response?

[John Ives <jives@xxxxxxxxxxxxxxxxxxxxx>]

After banging my head against a wall about why an active response script 
that sent emails was not working as expected, I added code to log 
information to the log/active-response.log and discovered that it didn't 
appear the script was being called at all.  When I went back and changed 
the <expects> option to not expect anything (it had previously expected 
srcip and username), I started to get logs and emails (I had always 
gotten alerts for the event that caused it), I noticed that the script 
was not being passed the ip and username at all.  Below are the logs 
both from the active-response.log and alerts.log files.  One one test 
system I am getting username and srcip most of the time, on another I am 
getting them occasionally, and on the 'production' system I don't seem 
to ever get them.  The script itself works, I just don't get the 
information I am expecting at the other end without these two pieces of 
information.

One thing to note is that there seems to be a discrepancy in times.  
When you look at the times in the active-response log, the `date` 
information is the same as the one in the alert log, however, the epoch 
times are different.  Specifically, the epoch times in the alert.log are 
the times seen for the previous alert in the active-response logs.

active-response.log
Fri Jul 27 15:28:19 PDT 2007 
/var/ossec/active-response/bin/login-alert.pl add - - 1185575299.2386412 
666012
Fri Jul 27 15:28:47 PDT 2007 
/var/ossec/active-response/bin/login-alert.pl add - - 1185575327.2386707 
666012
Fri Jul 27 15:28:47 PDT 2007 
/var/ossec/active-response/bin/login-alert.pl add - - 1185575327.2386985 
666012
Fri Jul 27 15:29:11 PDT 2007 
/var/ossec/active-response/bin/login-alert.pl add - - 1185575351.2388825 
666012
Fri Jul 27 15:34:32 PDT 2007 
/var/ossec/active-response/bin/login-alert.pl add - - 1185575672.2396850 
666012
Fri Jul 27 15:35:00 PDT 2007 
/var/ossec/active-response/bin/login-alert.pl add - - 1185575700.2397152 
666012

alert.log
** Alert 1185575299.2386136: - local
2007 Jul 27 15:28:19 system1->/var/log/auth.log
Rule: 666012 (level 3) -> 'Login to secure server.'
Src IP: <IP Address>
User: jives
Jul 27 15:28:19 system1 sshd[33190]: Accepted keyboard-interactive/pam 
for jives from <IP Address> port 51085 ssh2

** Alert 1185575327.2386412: - local
2007 Jul 27 15:28:47 (system2) <system2 IP>->/var/log/auth.log
Rule: 666012 (level 3) -> 'Login to secure server.'
Src IP: <IP Address>
User: jives
Jul 27 15:28:47 system2 sshd[13989]: Accepted keyboard-interactive/pam 
for jives from <IP Address> port 51086 ssh2

** Alert 1185575327.2386707: - local
2007 Jul 27 15:28:47 system2->/var/log/auth.log
Rule: 666012 (level 3) -> 'Login to secure server.'
Src IP: <IP Address>
User: jives
Jul 27 15:28:47 system2 sshd[13989]: Accepted keyboard-interactive/pam 
for jives from <IP Address> port 51086 ssh2

--
** Alert 1185575351.2388541: - local
2007 Jul 27 15:29:11 system3->/var/log/auth.log
Rule: 666012 (level 3) -> 'Login to secure server.'
Src IP: <IP Address>
User: jives
Jul 27 15:29:11 system3 sshd[36667]: Accepted keyboard-interactive/pam 
for jives from <IP Address> port 51088 ssh2

--
** Alert 1185575672.2396551: - local
2007 Jul 27 15:34:32 (system4) <system4 IP>->/var/log/auth.log
Rule: 666012 (level 3) -> 'Login to secure server.'
Src IP: <IP Address>
User: jives
Jul 27 15:34:31 system4 sshd[32699]: Accepted keyboard-interactive/pam 
for jives from <IP Address> port 51093 ssh2

** Alert 1185575700.2396850: - local
2007 Jul 27 15:35:00 (system5) <system5 IP>->/var/log/auth.log
Rule: 666012 (level 3) -> 'Login to secure server.'
Src IP: <IP Address>
User: jives
Jul 27 15:34:59 system5 sshd[8464]: Accepted keyboard-interactive/pam 
for jives from <IP Address> port 51094 ssh2


Thanks for all the hard work,

John

--
-------------------------------------------------------------------------
John Ives                                           Phone (510) 642-7773
System & Network Security			     Cell (510) 229-8676
University of California, Berkeley
-------------------------------------------------------------------------