[Ossec-list] agent-server connection not allowed

[campoe at usf.edu (Alex Campoe)]

Daniel

Yeah, I restarted both client and server several times. 100.6 is my only 
client so far, both client_keys files (server and agent) seem to be the 
same, owned by root, group ossec.

Alex

Daniel Cid wrote:
> Hi Alex,
> 
> The message you are getting means that OSSEC didn't find this
> IP on the client.keys file (the one used for authentication between
> server/agent)...
> Did you restart OSSEC on the server after running the manage_agents?
> Also, make sure that on the server, the /var/ossec/etc/client.keys
> file has an entry for that specific ip address: 131.247.100.6 .
> 
> Let me know if it works or not :)
> 
> thanks,
> 
> -- 
> Daniel B. Cid
> dcid @ ( at ) ossec.net
> 
> 
> On 5/26/06, Alex Campoe <campoe at usf.edu> wrote:
>> Probably simple and right under my nose, but ...
>>
>> Server is running on a Fedora Core 5 box, agent on Solaris 9 box. I used
>> the manage_agents per instructions, punched hole on iptable for 1514 and
>> 514. One the server log I am getting this:
>>
>> 2006/05/26 09:55:02 ossec-remoted(1213): Message from 131.247.100.6 not
>> allowed. <repeat several times per minute>
>>
>>
>> but the configuration is correct (I think):
>>
>> ossec.conf snippet
>>
>>     <remote>
>>       <connection>syslog</connection>
>>       <allowed-ips>131.247.100.6</allowed-ips>
>>     </remote>
>>
>>     <remote>
>>       <connection>secure</connection>
>>       <allowed-ips>131.247.100.6</allowed-ips>
>>     </remote>
>>
>> Any ideas?
>>
>> Alex
>> C
>> -- 
>> --  Alex Campoe, CISSP            Information Security Manager       --
>> --                                Associate Director, Systems        --
>> --  Email: campoe at usf.edu         Phone: (813) 974-1796              --
>> --  Academic Computing            University of South Florida        --
>> -----------------------------------------------------------------------
>>
>>
>> _______________________________________________
>> ossec-list mailing list
>> ossec-list at ossec.net
>> http://mailman.underlinux.com.br/mailman/listinfo/ossec-list
>>
>>
>>
>>

-- 
--  Alex Campoe, CISSP            Information Security Manager       --
--                                Associate Director, Systems        --
--  Email: campoe at usf.edu         Phone: (813) 974-1796              --
--  Academic Computing            University of South Florida        --
-----------------------------------------------------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3158 bytes
Desc: S/MIME Cryptographic Signature
Url : http://mailman.underlinux.com.br/pipermail/ossec-list/attachments/20060526/0044675a/attachment-0001.bin