[ossec-list] Re: White-list for a network

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Jorge,

White listing with CIDR should work. Remember that the white_list option must
be inside the "global" section. Something like that:

  <global>
    <white_list>127.0.0.1</white_list>
    <white_list>10.0.0.0/8</white_list>
  </global>

What error are you getting? Did you restart ossec after adding the
IP there? With white listing, you will still see the alert, but no
response will be taken. Is there anything on
/var/ossec/active-response/ossec-hids-responses.log regarding
any IP on this network?

Thanks,

--
Daniel B. Cid
dcid @ ( at ) ossec.net

On 6/20/06, Jorge Augusto Senger <jorge@xxxxxxxxxxx> wrote:
>
> Hy Daniel,
>
> I need do add a C class in the white-list (10.0.0.0/8). It's possible?
> With these line on osse.conf the rule doesn't work:
>     <white_list>10.0.0.0/8</white_list>
>
> Thanks
> Jorge
>
> >
>

--~--~---------~--~----~------------~-------~--~----~
-~----------~----~----~----~------~----~------~--~---