Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am deploying OSSEC architecture agent-server mode. I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server).

I've seached on the OSSEC's documentation but didn't find a way to do this so far ...

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

You can do this by making a customized active response. This will require you to write a script which can add IPs to your remote firewall. I suggest reading up on the linked documents as they explain this quite well.

share|improve this answer
    
Thanks, that's what i thought, no built-in solution, but there must be someone who allready did this. I'll try to find a script to share here . –  0x1gene Aug 26 '13 at 8:12
add comment

If you have an OSSEC agent running on the remote firewall, you can use native ossec commands.

The < location > option defines where the active response should be executed. Normally it is configured to execute the active response on the host that generated the event ("local"), but can also be configured to execute the active response on any host that has an agent ("defined-agent").

An example of an active response configuration that should always be executed on a specific host, no matter where it was triggered from (in this example the AR triggers on rules from the group ar_central_firewall and is executed on agent 123).

<active-response>
    <command>firewall-drop</command>
    <location>defined-agent</location>
    <agent_id>123</agent_id>
    <rules_group>ar_central_firewall</rules_group>
    <timeout>900</timeout>
</active-response>

The OSSEC documentation has an overview of all possible configuration options for active responses.

share|improve this answer
add comment

For peoples who are in same case as me here is a little scrip I wrote for the occation:

remoteipdrop(){
    local client=$(cut -d':' -f1<<<"$1")
    local vuser=$(cut -d':' -f2<<<"$1")
        local vserver=$(cut -d':' -f3<<<"$1")
    cmd="ssh ${vuser}@${vserver} /sbin/iptables -A INPUT -s ${client} -j DROP"
    $cmd
}

remoteipundrop(){
    local client=$(cut -d':' -f1<<<"$1")
    local vuser=$(cut -d':' -f2<<<"$1")
        local vserver=$(cut -d':' -f3<<<"$1")
    cmd="ssh ${vuser}@${vserver} /sbin/iptables -L INPUT -vn --line-number | grep ${client} | cut -c 1 | xargs /sbin/iptables -D INPUT"
    $cmd
}

usage(){
    echo "Usage: $0 {drop} \"clientIP:serverIP:sshUser:sshServer\""
    echo "Exemples:"
    echo -e "\t$0 drop \"1.2.3.4:root:www.example.com\""
    echo -e "\t$0 open \"1.2.3.4:443:eth0:202.54.1.5:root:www03.example.com\""
    exit 1
}

line="$2"

[ $# -ne 2 ] && usage

case $1 in
    open) remoteipadd "$line";;
    close) remoteipdelete "$line";;
    drop) remoteipdrop "$line";;
    undrop) remoteipundrop "$line";;
    *) usage
esac

I'll add here how to link it whith active response

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.