clear entire shun list

[dpcllc]

is there an easy way to clear the entire shun list?

Thanks

[prupert]

Yes, just restart the HIDS.

Code: Select all

service ossec-hids restart

[dpcllc]

Thanks,

how about to clear the entire block list?

[scott]

That would clear the whole list. Unless you're talking about blacklists or geo?

[dpcllc]

I'm talking about the Blocklist, I figured that was the same as the shunlist but after restarting the service you suggested it didn't change anything I still have 8745 sites blocked.

it seemed to do the restart ok.

[scott]

8700 active responses, wow. Are you getting hit by a botnet or something?

[dpcllc]

I had the shun time set too high.

I do see a lot of attempts to hack some of our older websites using joomla. That is what prompted me to purchase your product.

I have to say there hasn't been one site hacked since I have put the ASL setup in place!

I'm taking some time now to learn more about it and tune things up.

I wish you would come up with an addition to the ASL to take care of spam.

Can you think of any reason that the restart wouldn't have cleared out the list?

[mikeshinn]

I wish you would come up with an addition to the ASL to take care of spam.

Were you thinking of email spam, web spam or both?

[dpcllc]

Email spam,

I am currently using Mailscanner with spamassassin and clamav and it just doesn't seem to get the job done unless you sit there all day and tinker with it.

[dpcllc]

Even after resetting several times I still have over 9000 ip's on the blocked list.
Is there something else I can do to clear that list?

[prupert]

That's odd. You may want to report this to ASL support as that should not be happening!

That said, I have seen it from time to time (and reported it).

Usually the following works for me to clear the "stuck" blocked IP addresses:

Code: Select all

service asl-firewall restart

If that doesn't work:

Code: Select all

sqlite3 /var/ossec/var/execd.sqlite "delete from ar;" && service asl-firewall restart && service ossec-hids restart

[dpcllc]

thanks for the reply,

I have tried both of those commands and neither of them cleared the list.

the restarts all came back as ok.

I guess I will put in a ticket.