Tag: error

WARN: Waiting for server reply (not started) OSSEC agent

The first thing to understand is how to check the status of your agents and easiest way to do that is running the following on the server install (my mothership):

# /var/ossec/bin/agent_control -lc

This will list out all your agents and if they are active it’ll read Active. If they are inactive, they don’t read inactive unfortunately, they just don’t show up.

The next thing is to check your logs and in the default installations this is where it’ll be:

# tail -F /var/ossec/logs/ossec.log

If you have a connection issue you’re likely to see something like the following in the client log:

2012/10/09 03:39:33 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '[mothership IP]'.
2012/10/09 03:39:35 ossec-agentd: INFO: Trying to connect to server ([mothership IP]:1514).
2012/10/09 03:39:35 ossec-agentd: INFO: Using IPv4 for: [mothership IP] .
2012/10/09 03:39:56 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '[mothership IP]'.
2012/10/09 03:40:16 ossec-agentd: INFO: Trying to connect to server ([mothership IP]:1514).
2012/10/09 03:40:16 ossec-agentd: INFO: Using IPv4 for: [mothership IP].

As you are probably thinking this isn’t exactly the most helpful of warnings, it’s not telling you anything about the issue. But you do know you can’t connect. A couple of things I can say that will help troubleshoot on the client box is to do the following:

First check your IPTABLES rules:

# iptables -nL

If you have a number of rules and policies you might want to try disabling everything to see if you can establish a connection. To verify that its reaching the mothership server though you’ll want to run tcpdump on the mothership and see if any packets are reaching the box. Easiest way is to do the following:

# tcpdump -i eth0 port 1514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

Note that eth0 is your network interface card. If on a NIX box you can run ifconfig and you’re looking for the card that has your internet protocol address next to the inet addr:. So it’d look like this:

# ifconfig
eth0      Link encap:Ethernet  HWaddr G3:4P:91:CD:5A:6B  
          inet addr:100.1.5.68  Bcast:100.1.5.255  Mask:255.255.255.0

Once you identify the interface that is what you define in the syntax. And port is the UDP port that is used to communicate, if you didn’t change it on setup then it’ll be 1514. If it’s running you’ll start seeing traffic coming into the box as the servers kick it into gear. The easiest way to get it talking is to restart the agent boxes and you can do so here:

# /var/ossec/bin/ossec-control restart

If you have cleared your firewall and you don’t see traffic take a look at the ossec.log file on the mothership to see what might be going on. If you see the following you’re in luck:

# tail -F /var/ossec/logs/ossec.log
2012/10/09 03:47:17 ossec-remoted: WARN: Duplicate error:  global: 0, local: 51, saved global: 5, saved local:7563
2012/10/09 03:47:17 ossec-remoted(1407): ERROR: Duplicated counter for 'Agent001'.
2012/10/09 03:47:23 ossec-remoted: WARN: Duplicate error:  global: 0, local: 52, saved global: 5, saved local:7563
2012/10/09 03:47:23 ossec-remoted(1407): ERROR: Duplicated counter for 'Agent001'.
2012/10/09 03:47:27 ossec-remoted: WARN: Duplicate error:  global: 0, local: 53, saved global: 5, saved local:7563
2012/10/09 03:47:27 ossec-remoted(1407): ERROR: Duplicated counter for 'Agent001'.
2012/10/09 03:47:32 ossec-remoted: WARN: Duplicate error:  global: 0, local: 54, saved global: 5, saved local:7563
2012/10/09 03:47:32 ossec-remoted(1407): ERROR: Duplicated counter for 'Agent001'.
2012/10/09 03:47:38 ossec-remoted: WARN: Duplicate error:  global: 0, local: 55, saved global: 5, saved local:7563
2012/10/09 03:47:38 ossec-remoted(1407): ERROR: Duplicated counter for 'Agent001'.

If it still doesn’t work try removing the agent from master and re-adding it:

OSSEC start problem due to keys

OSSEC start problem due to keys

The following is an error I got after starting ossec as an agent that is supposed to connect back to a central server:

#/var/ossec/bin/ossec-control start
Starting OSSEC HIDS v2.5.1 (by Trend Micro Inc.)…
Started ossec-execd…
ossec-agentd(1402): ERROR: Authentication key file ‘/var/ossec/etc/client.keys’ not found.
ossec-agentd(1750): ERROR: No remote connection configured. Exiting.
ossec-agentd(4109): ERROR: Unable to start without auth keys. Exiting.

If the /var/ossec/etc/client.keys file is already present on agent, comment out the line containing the key in it.

The server (the one that ossec connects to) needs to have a key created for this agent, you can do so via:
# /var/ossec/bin/manage_agents
Press ‘A’ for Adding agent, enter agent name, agent ip.
Return to main menu, press ‘E’ to export keys, enter the agent id from the list given. It will provide with a key.

On the client (the one that got the error message) you need to add the key via the same command.
/var/ossec/bin/manage_agents
Press ‘I’ to import key,
Paste the key we exported from the master.

Finally you can start ossec on the client:
# /var/ossec/bin/ossec-control start

dpkg: error processing package linux-image-generic (–configure): dependency problems – leaving unconfigured

I had this issue just now. What I did was purge the errant package using dpkg in my case then update and force the reinstall:

sudo dpkg --purge linux-image-3.13.0-35-generic
sudo apt-get update
sudo apt-get -f install

GPG error when updating, key expired

Error:

Err:13 http://downloads.metasploit.com/data/releases/metasploit-framework/apt lucid InRelease
  The following signatures were invalid: KEYEXPIRED 1474234115  KEYEXPIRED 1474234115  KEYEXPIRED 1474234115
Fetched 98.2 kB in 0s (150 kB/s)
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://downloads.metasploit.com/data/releases/metasploit-framework/apt lucid InRelease: The following signatures were invalid: KEYEXPIRED 1474234115  KEYEXPIRED 1474234115  KEYEXPIRED 1474234115

Solution:

$ sudo echo 'deb http://apt.metasploit.com/ lucid main' > /etc/apt/sources.list.d/metasploit-framework.list
$ sudo wget -O - http://apt.metasploit.com/metasploit-framework.gpg.key | apt-key add -
$ sudo apt-get update
$ sudo apt-get -y install metasploit-framework

Can’t run screen due to “cannot open terminal ‘/dev/pts/1’ – please check” error

Turns out the problem was that I ssh’ed into the machine as root, then changed to the user kramer65 with su kramer65 and then tried to run screen, where screen can only be run by the user that logs in using ssh. So after I added kramer65 to the sudoers file with usermod -aG sudo kramer65

Could no open output pipe ‘/dev/xconsole’

Create /dev/xconsole and set its correct ownership and permissions:

sudo touch /dev/xconsole
sudo chgrp syslog /dev/xconsole
sudo chmod 664 /dev/xconsole

Restart the rsyslog service

Marathon exited with status 1: Required option ‘master’ not found

Try to keep config in the environment.

cat << EOF > /etc/default/marathon
MARATHON_MASTER=zk://127.0.0.1:2181/mesos
MARATHON_ZK=zk://127.0.0.1:2181/marathon
EOF

Remember to replace 127.0.0.1:2181 with proper Zookeeper location.

fatal: unable to access ‘https://github.com/xxx’: OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to github.com:443

If you are behind a proxy, try the following:

git config --global --add remote.origin.proxy ""
git config --global http.sslBackend "openssl"