Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Too many srcip rules #267

Open
boyert opened this issue Aug 6, 2014 · 0 comments
Open

Too many srcip rules #267

boyert opened this issue Aug 6, 2014 · 0 comments
Labels
bug needs-volunteers rn:server

Comments

@boyert
Copy link

boyert commented Aug 6, 2014

ossec 2.8-45 on RHEL5.10. Also on 2.6.

I've got a separate xml in rules called local_nessus_rules.xml where I'm trying to exclude all of the security scan IPs. Separate only for readability, and it looks like so:


<group name="local,syslog,">

<rule id="105010" level="0">
    <if_level>2</if_level>
    <srcip>10.100.131.26</srcip>
    <description>Another nessus scan</description>
</rule>

<rule id="105012" level="0">
    <if_level>2</if_level>
    <srcip>10.100.131.28</srcip>
    <description>Another nessus scan</description>
</rule>


... etc.  Right now there are 13 of these, all basically identical.

# tail -n18 local_nessus_rules.xml

<rule id="105032" level="0">
    <if_level>2</if_level>
    <srcip>10.100.131.22</srcip>
    <description>Another nessus scan</description>
</rule>

<rule id="105033" level="0">
    <if_level>2</if_level>
    <srcip>10.100.131.20</srcip>
    <description>Another nessus scan</description>
</rule>

</group>

<!-- SYSLOG,LOCAL -->

<!-- EOF -->
# time /etc/init.d/ossec restart                            
Stopping OSSEC:                                            [  OK  ]
Starting OSSEC:                                            [  OK  ]

real    0m7.595s
user    0m2.302s
sys     0m0.261s

If I add unlucky rule #14, it takes twice as long to come up - and remoted doesn't start.

# tail -n18 local_nessus_rules.xml

<rule id="105033" level="0">
    <if_level>2</if_level>
    <srcip>10.100.131.26</srcip>
    <description>Another nessus scan</description>
</rule>

<rule id="105034" level="0">
    <if_level>2</if_level>
    <srcip>10.100.131.25</srcip>
    <description>Another nessus scan</description>
</rule>

</group>

<!-- SYSLOG,LOCAL -->

<!-- EOF -->


# time /etc/init.d/ossec restart
Stopping OSSEC:                                            [  OK  ]
Starting OSSEC: 2014/08/04 08:25:08 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2014/08/04 08:25:08 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
                                                           [  OK  ]

real    0m14.761s
user    0m4.314s
sys    0m0.382s

Removing that last rule allows it to start again.  It's replicable, but only if I add another <srcip> rule.  Adding another type - regex, or match - and it will start up just fine.

conf and rule:

 <ossec_config>
  <global>
    <email_notification>yes</email_notification>
    <email_to>tim</email_to>
    <smtp_server>localhost</smtp_server>
    <email_from>ossecm@master</email_from>
    <email_maxperhour>100</email_maxperhour>
  </global>

  <email_alerts>
    <email_to>LINUX</email_to>
    <level>5</level>
    <!-- Prod -->
    <event_location>10.101.32.205|10.101.32.206|10.101.59|10.101.58|10.101.25|10.101.26|10.101.27|10.101.29|10.101.17|10.100.17</event_location>
    <do_not_group />
  </email_alerts>

  <email_alerts>
    <email_to>LINUX</email_to>
    <level>10</level>
    <!-- Dev and COOP -->
    <event_location>10.100.58|10.100.59|10.100.21.70|10.100.25|10.100.25|10.100.26|10.100.27|10.100.29</event_location>
    <do_not_group />
  </email_alerts>

  <email_alerts>
    <email_to>WINDOWS</email_to>
    <level>5</level>
    <!-- Prod -->
    <event_location>10.101.42|10.101.43|10.101.44|10.101.45|10.101.46|10.101.52|10.101.53|10.101.21|10.101.19|10.101.17|10.100.17|10.101.18.40|10.103.17.40|</event_location>
    <do_not_group />
  </email_alerts>

  <email_alerts>
    <email_to>WINDOWS</email_to>
    <level>10</level>
    <!-- Dev and COOP -->
    <event_location>10.100.19|10.100.21|10.100.42|10.100.43|10.100.44|10.100.51|10.100.52|10.100.53|10.100.26.77</event_location>
    <do_not_group />
  </email_alerts>

  <reports>
    <category>syscheck</category>
    <title>Daily report:  file change summary</title>
    <email_to>tim</email_to>
  </reports>

  <rules>
    <include>rules_config.xml</include>
    <include>pam_rules.xml</include>
    <include>sshd_rules.xml</include>
    <include>telnetd_rules.xml</include>
    <include>syslog_rules.xml</include>
    <include>arpwatch_rules.xml</include>
    <include>symantec-av_rules.xml</include>
    <include>symantec-ws_rules.xml</include>
    <include>pix_rules.xml</include>
    <include>named_rules.xml</include>
    <include>smbd_rules.xml</include>
    <include>vsftpd_rules.xml</include>
    <include>pure-ftpd_rules.xml</include>
    <include>proftpd_rules.xml</include>
    <include>ms_ftpd_rules.xml</include>
    <include>ftpd_rules.xml</include>
    <include>hordeimp_rules.xml</include>
    <include>roundcube_rules.xml</include>
    <include>wordpress_rules.xml</include>
    <include>cimserver_rules.xml</include>
    <include>vpopmail_rules.xml</include>
    <include>vmpop3d_rules.xml</include>
    <include>courier_rules.xml</include>
    <include>web_rules.xml</include>
    <include>web_appsec_rules.xml</include>
    <include>apache_rules.xml</include>
    <include>nginx_rules.xml</include>
    <include>php_rules.xml</include>
    <include>mysql_rules.xml</include>
    <include>postgresql_rules.xml</include>
    <include>ids_rules.xml</include>
    <include>squid_rules.xml</include>
    <include>firewall_rules.xml</include>
    <include>cisco-ios_rules.xml</include>
    <include>netscreenfw_rules.xml</include>
    <include>sonicwall_rules.xml</include>
    <include>postfix_rules.xml</include>
    <include>sendmail_rules.xml</include>
    <include>imapd_rules.xml</include>
    <include>mailscanner_rules.xml</include>
    <include>dovecot_rules.xml</include>
    <include>ms-exchange_rules.xml</include>
    <include>racoon_rules.xml</include>
    <include>vpn_concentrator_rules.xml</include>
    <include>spamd_rules.xml</include>
    <include>msauth_rules.xml</include>
    <include>mcafee_av_rules.xml</include>
    <include>trend-osce_rules.xml</include>
    <include>ms-se_rules.xml</include>
    <!-- <include>policy_rules.xml</include> -->
    <include>zeus_rules.xml</include>
    <include>solaris_bsm_rules.xml</include>
    <include>vmware_rules.xml</include>
    <include>ms_dhcp_rules.xml</include>
    <include>asterisk_rules.xml</include>
    <include>ossec_rules.xml</include>
    <include>attack_rules.xml</include>
    <include>local_rules.xml</include>
    <include>local_nessus_rules.xml</include>
  </rules>


  <syscheck>
    <!-- Frequency that syscheck is executed -- default every 20 hours -->
    <frequency>72000</frequency>

    <!-- Directories to check  (perform all possible verifications) -->
    <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes">/bin,/sbin</directories>

    <!-- Files/directories to ignore -->
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <ignore>/etc/mail/statistics</ignore>
    <ignore>/etc/random-seed</ignore>
    <ignore>/etc/adjtime</ignore>
    <ignore>/etc/httpd/logs</ignore>
  </syscheck>

  <rootcheck>
    <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
    <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
  </rootcheck>

  <global>
    <white_list>127.0.0.1</white_list>
  </global>

  <remote>
    <connection>secure</connection>
  </remote>

  <alerts>
    <log_alert_level>1</log_alert_level>
    <email_alert_level>7</email_alert_level>
  </alerts>

  <command>
    <name>host-deny</name>
    <executable>host-deny.sh</executable>
    <expect>srcip</expect>
    <timeout_allowed>yes</timeout_allowed>
  </command>  

  <command>
    <name>firewall-drop</name>
    <executable>firewall-drop.sh</executable>
    <expect>srcip</expect>
    <timeout_allowed>yes</timeout_allowed>
  </command>  

  <command>
    <name>disable-account</name>
    <executable>disable-account.sh</executable>
    <expect>user</expect>
    <timeout_allowed>yes</timeout_allowed>
  </command>  


  <active-response>
    <disabled>yes</disabled>
  </active-response>

  <!-- Files to monitor (localfiles) -->

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/messages</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/authlog</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/secure</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/xferlog</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/maillog</location>
  </localfile>

  <localfile>
    <log_format>apache</log_format>
    <location>/var/www/logs/access_log</location>
  </localfile>

  <localfile>
    <log_format>apache</log_format>
    <location>/var/www/logs/error_log</location>
  </localfile>
</ossec_config>

and nessus rules.  It works if I cut off after 105030.


<group name="local,syslog,">

<rule id="105010" level="0">
    <if_level>2</if_level>
    <srcip>10.100.131.26</srcip>
    <description>Another nessus scan</description>
</rule>

<rule id="105011" level="0">
    <match>10.100.131.26</match>

    <description>Another nessus scan</description>
</rule>

<rule id="105012" level="0">
    <if_level>2</if_level>
    <srcip>10.101.127.38</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105016" level="0">
    <if_level>2</if_level>
    <srcip>10.101.127.51</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105018" level="0">
    <if_level>2</if_level>
    <srcip>10.101.127.50</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105020" level="0">
    <if_level>2</if_level>
    <srcip>10.101.127.45</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105022" level="0">
    <if_level>2</if_level>
    <srcip>10.101.127.44</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105024" level="0">
    <if_level>2</if_level>
    <srcip>10.102.127.22</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105026" level="0">
    <if_level>2</if_level>
    <srcip>10.102.127.14</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105028" level="0">
    <if_level>2</if_level>
    <srcip>10.102.127.13</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105030" level="0">
    <if_level>2</if_level>
    <srcip>10.103.131.25</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105032" level="0">
    <if_level>2</if_level>
    <srcip>10.103.131.22</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105033" level="0">
    <if_level>2</if_level>
    <srcip>10.103.131.26</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105034" level="0">
    <if_level>2</if_level>
    <srcip>10.100.131.25</srcip>
    <description>Another nessus scan</description>
</rule>

<rule id="105036" level="0">
    <if_level>2</if_level>
    <srcip>10.100.131.23</srcip>

    <description>Another nessus scan</description>
</rule>

<rule id="105038" level="0">

    <if_level>2</if_level>
    <srcip>10.100.131.22</srcip>
    <description>Another nessus scan</description>
</rule>

</group>

<!-- SYSLOG,LOCAL -->

<!-- EOF -->

dan (ddpbsd)    has confirmed:
Aug 5
- show quoted text -
Thank you. Putting the local_nessus_rules.xml file in place seems to
make ossec-logtest loop through the rules over and over.

I get (from ossec-logtest -tvd):
LOTS OF OUTPUT
2014/08/05 09:13:17 9 : rule:105038, level 0, timeout: 0
2014/08/05 09:13:17 8 : rule:105033, level 0, timeout: 0
2014/08/05 09:13:17 9 : rule:105034, level 0, timeout: 0
2014/08/05 09:13:17 10 : rule:105036, level 0, timeout: 0
2014/08/05 09:13:17 11 : rule:105038, level 0, timeout: 0
2014/08/05 09:13:17 10 : rule:105038, level 0, timeout: 0
2014/08/05 09:13:17 9 : rule:105036, level 0, timeout: 0
2014/08/05 09:13:17 10 : rule:105038, level 0, timeout: 0
2014/08/05 09:13:17 9 : rule:105038, level 0, timeout: 0
2014/08/05 09:13:17 8 : rule:105034, level 0, timeout: 0
2014/08/05 09:13:17 9 : rule:105036, level 0, timeout: 0
2014/08/05 09:13:17 10 : rule:105038, level 0, timeout: 0
2014/08/05 09:13:17 9 : rule:105038, level 0, timeout: 0
2014/08/05 09:13:17 8 : rule:105036, level 0, timeout: 0
2014/08/05 09:13:17 9 : rule:105038, level 0, timeout: 0
2014/08/05 09:13:17 8 : rule:105038, level 0, timeout: 0
2014/08/05 09:13:17 7 : rule:105032, level 0, timeout: 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug needs-volunteers rn:server
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jrossi @boyert