Lab 6.2

Hi,
I've tried various things but I'm stumped on an aspect of this exercise.
When I try to setup the shared key on the client machine as per part 14 (/var/ossec/bin/agent-auth -m 172.16.215.129 -p 1515) I get the messages:
INFO: Connected to 172.16.215.129:1515
INFO: Using agent name as: secondary.example.com
INFO: Send request to manager. Waiting for reply.
INFO: Connection closed.
How would I resolve that?
Comments
-
/var/ossec/logs/ossec.log on the server reports
2019/02/18 11:22:23 ossec-authd: INFO: Started (pid: 9154).
2019/02/18 11:22:23 Accepting connections. Random password chosen for agent authentication: 7c60a713f0d91d8193998ef01d85c92c
2019/02/18 11:22:23 IPv6: :: on port 1515
2019/02/18 11:22:23 Request to allocate and bind sockets failed.
2019/02/18 11:22:23 ossec-authd: Unable to bind to port 1515
2019/02/18 11:22:30 ossec-authd: INFO: New connection from 172.16.215.130
2019/02/18 11:22:30 ossec-authd: ERROR: Invalid password provided by 172.16.215.130. Closing connection.0 -
Hi, A couple of little things: The client side looks ok so far, the server side doen't seem to be binding to port 1515. Make sure that SElinux is in permissive mode and the firewall is off.
0 -
SElinux is disabled on the VM image used by default and I've added tcp and udp ports 1515 to the firewalls of both VMs.
I tried getting both server and agent to read the password from a file (/var/ossec/etc/authd.pass) but it's still the same problem. Not getting a suitable answer from the OSSEC mailing list/Google.
0 -
I ran through the lab this morning, the password generated by agent-auth only goes on the agent machine. The default location is same as you have but I specified it in the command line to be clear.
My command on the server machine:/var/ossec/bin/ossec-authd -p1515 -d -d -d -f
You can see the password to use on the client machine.My client command:
/var/ossec/bin/agent-auth -m 192.168.122.31 -p 1515 -A remote -P /var/ossec/etc/authd.passIf you are running version 3.2 of OSSEC, it will automatically add the client making step 6.2.10 redundant and will cause a "duplicate IP error", no problem, use manage-agents to remove the entry you added in step 6.2.10
The lab will get an update to version 3.2.0 shortly.
Thank you for pointing out the issue.
keep me posted.
Lee1 -
Yes, that worked! Many thanks. Although I did get the duplicate IP error and dealt with it, it seems that was necessary to go through because ossec wouldn't start on the agent without it having imported the server's key for the definition. I don't know if that's a bug or just something weird that happened to me.
0 -
Great !
Yes, the agent must get a key from the server to start communicating.
There seems to be some updates to ossec that need to be incorporated into the lab, specifically to resolve the duplicate ip address issue.
Thank you for your input.1
Categories
- All Categories
- 51 LFX Mentorship
- 104 LFX Mentorship: Linux Kernel
- 576 Linux Foundation IT Professional Programs
- 304 Cloud Engineer IT Professional Program
- 125 Advanced Cloud Engineer IT Professional Program
- 53 DevOps Engineer IT Professional Program
- 61 Cloud Native Developer IT Professional Program
- 5 Express Training Courses
- 5 Express Courses - Discussion Forum
- 2.1K Training Courses
- 19 LFC110 Class Forum
- 7 LFC131 Class Forum
- 27 LFD102 Class Forum
- 158 LFD103 Class Forum
- 21 LFD121 Class Forum
- 1 LFD137 Class Forum
- 61 LFD201 Class Forum
- 1 LFD210 Class Forum
- LFD210-CN Class Forum
- 1 LFD213 Class Forum - Discontinued
- 128 LFD232 Class Forum
- LFD237 Class Forum
- 23 LFD254 Class Forum
- 612 LFD259 Class Forum
- 105 LFD272 Class Forum
- 1 LFD272-JP クラス フォーラム
- 1 LFD273 Class Forum
- 2 LFS145 Class Forum
- 25 LFS200 Class Forum
- 739 LFS201 Class Forum
- 1 LFS201-JP クラス フォーラム
- 11 LFS203 Class Forum
- 75 LFS207 Class Forum
- 300 LFS211 Class Forum
- 54 LFS216 Class Forum
- 47 LFS241 Class Forum
- 41 LFS242 Class Forum
- 37 LFS243 Class Forum
- 11 LFS244 Class Forum
- 37 LFS250 Class Forum
- 1 LFS250-JP クラス フォーラム
- LFS251 Class Forum
- 141 LFS253 Class Forum
- LFS254 Class Forum
- 1.1K LFS258 Class Forum
- 10 LFS258-JP クラス フォーラム
- 93 LFS260 Class Forum
- 132 LFS261 Class Forum
- 33 LFS262 Class Forum
- 80 LFS263 Class Forum
- 15 LFS264 Class Forum
- 11 LFS266 Class Forum
- 18 LFS267 Class Forum
- 18 LFS268 Class Forum
- 23 LFS269 Class Forum
- 203 LFS272 Class Forum
- 1 LFS272-JP クラス フォーラム
- LFS274 Class Forum
- LFS281 Class Forum
- 236 LFW211 Class Forum
- 172 LFW212 Class Forum
- 7 SKF100 Class Forum
- SKF200 Class Forum
- 903 Hardware
- 219 Drivers
- 74 I/O Devices
- 44 Monitors
- 116 Multimedia
- 209 Networking
- 101 Printers & Scanners
- 85 Storage
- 763 Linux Distributions
- 88 Debian
- 66 Fedora
- 15 Linux Mint
- 13 Mageia
- 24 openSUSE
- 142 Red Hat Enterprise
- 33 Slackware
- 13 SUSE Enterprise
- 357 Ubuntu
- 479 Linux System Administration
- 41 Cloud Computing
- 70 Command Line/Scripting
- Github systems admin projects
- 95 Linux Security
- 78 Network Management
- 108 System Management
- 49 Web Management
- 68 Mobile Computing
- 23 Android
- 30 Development
- 1.2K New to Linux
- 1.1K Getting Started with Linux
- 538 Off Topic
- 131 Introductions
- 217 Small Talk
- 22 Study Material
- 826 Programming and Development
- 278 Kernel Development
- 514 Software Development
- 928 Software
- 260 Applications
- 184 Command Line
- 3 Compiling/Installing
- 76 Games
- 316 Installation
- 61 All In Program
- 61 All In Forum
Upcoming Training
-
August 20, 2018
Kubernetes Administration (LFS458)
-
August 20, 2018
Linux System Administration (LFS301)
-
August 27, 2018
Open Source Virtualization (LFS462)
-
August 27, 2018
Linux Kernel Debugging and Security (LFD440)