Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am deploying OSSEC architecture agent-server mode. I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server).

I've seached on the OSSEC's documentation but didn't find a way to do this so far ...

share|improve this question
up vote 4 down vote accepted

You can do this by making a customized active response. This will require you to write a script which can add IPs to your remote firewall. I suggest reading up on the linked documents as they explain this quite well.

share|improve this answer
Thanks, that's what i thought, no built-in solution, but there must be someone who allready did this. I'll try to find a script to share here . – 0x1gene Aug 26 '13 at 8:12

If you have an OSSEC agent running on the remote firewall, you can use native ossec commands.

The < location > option defines where the active response should be executed. Normally it is configured to execute the active response on the host that generated the event ("local"), but can also be configured to execute the active response on any host that has an agent ("defined-agent").

An example of an active response configuration that should always be executed on a specific host, no matter where it was triggered from (in this example the AR triggers on rules from the group ar_central_firewall and is executed on agent 123).


The OSSEC documentation has an overview of all possible configuration options for active responses.

share|improve this answer

For peoples who are in the same case as me, here's a little script I wrote for the occasion:

    local client=$(cut -d':' -f1<<<"$1")
    local vuser=$(cut -d':' -f2<<<"$1")
        local vserver=$(cut -d':' -f3<<<"$1")
    cmd="ssh ${vuser}@${vserver} /sbin/iptables -A INPUT -s ${client} -j DROP"

    local client=$(cut -d':' -f1<<<"$1")
    local vuser=$(cut -d':' -f2<<<"$1")
        local vserver=$(cut -d':' -f3<<<"$1")
    cmd="ssh ${vuser}@${vserver} /sbin/iptables -L INPUT -vn --line-number | \
        grep ${client} | cut -c 1 | xargs /sbin/iptables -D INPUT"

    echo "Usage: $0 {drop} \"clientIP:serverIP:sshUser:sshServer\""
    echo "Exemples:"
    echo -e "\t$0 drop \"\""
    echo -e "\t$0 open \"\""
    exit 1


[ $# -ne 2 ] && usage

case $1 in
    open) remoteipadd "$line";;
    close) remoteipdelete "$line";;
    drop) remoteipdrop "$line";;
    undrop) remoteipundrop "$line";;
    *) usage

I'll add here how to link it whith active response.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.