No E-Mail and no Blocking of mail/ftp/etc. Logins
Posted: Wed Jan 15, 2014 6:57 pm
I'm new to ASL. I'm currently in the test period and I'm planing to buy it afterwards. I have a CPanel-Server. Previously I used ConfigServer CSF and LFD. I uninstalled these programs before installing ASL.
Currently I have two issues.
First: I do not get any mail except from rkhunter (two each night - before I installed ASL I used rkhunter just on demand and removed it before installing ASL).
I have a lot of security events (mainly from WAF). I have set
OSSEC_ACTIVE_RESPONSE to YES
OSSEC_MAX_MSG 60
HIDS_EMAIL_ALERT_LEVEL 7
I found somewhere I should check for ossec-maild:
When I first did this, I got <defunct> for ossec-maild, but after a restared it seems to be ok. I already tried different email addresses.
Is there something else I could check?
Second: Before I had ASL installed, LFD blocked a lot of IPs because of repeated authentications failures (ftpd, smtpauth, htpasswd, pop3d)
But I did not see any such blocks with ASL. When I reduced the filter to 5 I saw an IP which tried to login to pop3 every 17 seconds all day long (about 4000 times):
I read something about slow attacks in the forum here. Does ASL not detect and block them? And what about the other services like FTP oder SMTP?
When I restart ASL the OSSEC part says:
With LFD I had much more attacks to SMTP and FTP than to POP3. Is there a possibility to block these login attempts with ASL too? E.g. after 10 attempts in 5 minutes? Has this something to do with HIDS_analysisd_default_timeframe? Could not find a discription for these HIDS-values.
Currently I have two issues.
First: I do not get any mail except from rkhunter (two each night - before I installed ASL I used rkhunter just on demand and removed it before installing ASL).
I have a lot of security events (mainly from WAF). I have set
OSSEC_ACTIVE_RESPONSE to YES
OSSEC_MAX_MSG 60
HIDS_EMAIL_ALERT_LEVEL 7
I found somewhere I should check for ossec-maild:
Code: Select all
ps auxwww | grep ossec
ossecm 14721 0.0 0.0 133676 10228 ? S 22:34 0:00 /var/ossec/bin/ossec-dbd
ossecm 14726 0.0 0.0 8608 492 ? S 22:34 0:00 /var/ossec/bin/ossec-maild
ossec 14735 0.2 0.0 17480 9500 ? S 22:34 0:08 /var/ossec/bin/ossec-analysisd
root 14739 0.0 0.0 6540 512 ? S 22:34 0:00 /var/ossec/bin/ossec-logcollector
root 14765 0.0 0.0 8952 2948 ? S 22:34 0:02 /var/ossec/bin/ossec-syscheckd
ossec 14769 0.0 0.0 8704 420 ? S 22:34 0:00 /var/ossec/bin/ossec-monitord
root 15448 0.0 0.0 15656 1172 ? S Jan13 0:01 /var/ossec/bin/ossec-execd
root 32155 0.0 0.0 103304 836 pts/2 S+ 23:34 0:00 grep ossec
Is there something else I could check?
Second: Before I had ASL installed, LFD blocked a lot of IPs because of repeated authentications failures (ftpd, smtpauth, htpasswd, pop3d)
But I did not see any such blocks with ASL. When I reduced the filter to 5 I saw an IP which tried to login to pop3 every 17 seconds all day long (about 4000 times):
Code: Select all
myservername dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 17 secs): user=<je>, method=PLAIN, rip=192.111.78.158, lip=myip, session=<2jMLuQnwKADAb06e>When I restart ASL the OSSEC part says:
Code: Select all
Checking ossec-hids settings
Checking for ossec-hids installation: installed [OK]
ossec-hids set to: enabled [OK]
OSSEC is configured in server mode.
Checking for server installation: installed [OK]
Enable email notification: enabled [OK]
Notifications to address: hs.offnetwork@aon.at [OK]
Notifications from address: asl@dorado.nooxserver.com [OK]
SMTP server: 127.0.0.1 [OK]
Max email per hour setting: 60 [OK]
Active Response: enabled [OK]
Active Response timeout: 600 [OK]
Verifying OSSEC whitelists
checking: 46.4.89.8 [OK]
checking: 127.0.0.1 [OK]
checking: 178.190.219.193 [OK]
Excessive whitelists not detected: 3 [OK]
Checking for monitored log files
/var/log/messages: monitored [OK]
/var/log/secure: monitored [OK]
/var/log/maillog: monitored [OK]
/var/log/httpd/access_log: monitored [OK]
/var/log/httpd/audit_log: monitored [OK]
/var/log/tortixd/audit_log: monitored [OK]
/var/log/httpd/error_log: monitored [OK]
/var/log/httpd/suexec_log: monitored [OK]
/var/log/mysqld.log: monitored [OK]
Reloading ossec-hids: [ OK ]
.