[ossec-list] Re: Can IP ranges be put in the whitelist

[Leslie S Arvin <arvin@xxxxxxxxxx>]

Can less-common IP ranges be put in the whitelist?  I haven't
deployed 0.9 yet, but in ossec-hids 0.8 when I tried to specify
in the configuration file:

<white_list>128.210.191.128/25</white_list>

...ossec reported configuration errors and would not start.


# /opt/ossec  bin/ossec-control restart
Killing ossec-logcollector ..
ossec-remoted not running ..
Killing ossec-syscheckd ..
Killing ossec-analysisd ..
Killing ossec-maild ..
Killing ossec-execd ..
OSSEC HIDS v0.8 Stopped
Starting OSSEC HIDS v0.8 (by Daniel B. Cid)...
2006/08/08 10:51:57 ossec-analysisd(1237): Invalid ip address: '128.210.191.128/25'.
2006/08/08 10:51:57 ossec-analysisd(1202): Configuration problem. Exiting.
2006/08/08 10:51:57 ossec-analysisd(1202): Configuration problem. Exiting.
ossec-analysisd: Configuration error. Exiting


-- Leslie Arvin
   arvin@xxxxxxxxxx, Office: SCCA 23F, Phone: 765-496-3971
   Network Systems Administrator, ITI-Networks
   Purdue University, Information Technology at Purdue


Meir Michanie wrote:
> yes, read the online manual
>
> On 8/8/06, *Charles Webb* <bmallice@xxxxxxxxx 
> <mailto:bmallice@xxxxxxxxx>> wrote:
>
>
>     My main question for this is due to the hoster I am with requires
>     certain ip's be whitelisted so
>     their monitoring can get in correctly. Any help would be greatly
>     appreciated.