|
Hi there … I have set up ossec with active response using firewall-drop.sh
but I can’t see deny rules being added to my iptables firewall rules here
is the ossec log which says it’s adding the rules but I can’t see
anywhere in my system where the ip is being denied … what am I missing ? /var/ossec/logs/active-responses.log Fri May 11 01:46:32 SAST 2007
/var/ossec/active-response/bin/host-deny.sh delete - 70.43.201.230
1178840162.4923 3104 Fri May 11 01:46:32 SAST 2007
/var/ossec/active-response/bin/firewall-drop.sh delete - 70.43.201.230
1178840162.4923 3104 Fri May 11 02:22:24 SAST 2007
/var/ossec/active-response/bin/host-deny.sh add - 59.39.99.84 1178842944.6383
3104 Fri May 11 02:22:24 SAST 2007
/var/ossec/active-response/bin/firewall-drop.sh add - 59.39.99.84
1178842944.6383 3104 Fri May 11 02:31:12 SAST 2007
/var/ossec/active-response/bin/firewall-drop.sh add - 221.221.173.175
1178843472.7158 3104 Fri May 11 02:31:12 SAST 2007 /var/ossec/active-response/bin/host-deny.sh
add - 221.221.173.175 1178843472.7158 3104 Fri May 11 02:32:42 SAST 2007
/var/ossec/active-response/bin/host-deny.sh delete - 59.39.99.84
1178842944.6383 3104 Fri May 11 02:32:42 SAST 2007
/var/ossec/active-response/bin/firewall-drop.sh delete - 59.39.99.84
1178842944.6383 3104 Fri May 11 02:41:42 SAST 2007
/var/ossec/active-response/bin/host-deny.sh delete - 221.221.173.175
1178843472.7158 3104 Fri May 11 02:41:42 SAST 2007
/var/ossec/active-response/bin/firewall-drop.sh delete - 221.221.173.175
1178843472.7158 3104 Fri May 11 03:55:44 SAST 2007
/var/ossec/active-response/bin/firewall-drop.sh add - 116.21.125.24
1178848544.10311 3104 Fri May 11 03:55:44 SAST 2007
/var/ossec/active-response/bin/host-deny.sh add - 116.21.125.24
1178848544.10311 3104 Fri May 11 04:06:14 SAST 2007
/var/ossec/active-response/bin/host-deny.sh delete - 116.21.125.24
1178848544.10311 3104 Fri May 11 04:06:14 SAST 2007
/var/ossec/active-response/bin/firewall-drop.sh delete - 116.21.125.24
1178848544.10311 3104 Fri May 11 04:14:36 SAST 2007
/var/ossec/active-response/bin/firewall-drop.sh add - 196.211.168.210
1178849676.11462 3104 Fri May 11 04:14:36 SAST 2007
/var/ossec/active-response/bin/host-deny.sh add - 196.211.168.210
1178849676.11462 3104 --Gareth |